We have a legal obligation to protect your personal data and use it line with all applicable laws concerning the protection of personal data, including the Data Protection Act 1998 and General Data Protection Regulations (GDPR), herein collectively referred to in this policy as the ‘data protection laws’.
We are Institute of Public Care (IPC), trading as Oxford Brookes Enterprises Ltd, Harcourt Hill Campus, Oxford, OX2 9AT, UK. For the purposes of the data protection laws we are the data controller of any personal data that you supply. This means that we will make the decisions on how your data is used and for what reasons. We may also act as a data processor of your personal data in certain circumstances, in which case we will process personal data only under the instructions of our clients. We comply with all relevant data protection laws in all our dealings with your personal data.
Personal data we collect about you and why we need it
When we refer to “personal data” in this policy, we mean information that relates to you that we have collected or you have given to us, for example, from forms or surveys you complete. Your personal data may include for example your name, your contact details, information relating to your studies if you are a student with the University, or your views on services you have received.
- For students undertaking our accredited courses we ask for information including your contact details, date of birth, and job title as well as the contact details of your line manager to help support you throughout the course. The majority of the personal data we hold about you is directly related to the administration of your studies or to improve the student experience. We will also use your personal data to comply with our legal obligations, for instance Oxford Brookes is required by law to provide limited personal data to external bodies such as Higher Education Statistics Agency (HESA) and the Office for Students. We will need to know if you have a disability, special learning need or medical condition so that we know if you require additional support or special facilities. We also record information on ethnic origin and other protected characteristics to monitor equal opportunities.
- Surveys with students. Students undertaking some of our accredited courses may be asked to complete self assessments or surveys to, for instance, assess your knowledge or competencies and preferred learning styles at the start of a course or to give us feedback about our courses.
- Surveys with other individuals. We ask individuals to provide responses to surveys at the request of a client as part of our consultancy, evaluation or other work. Clients may provide individuals’ contact information in the first instance. Participants take part in online surveys through 3rd party platforms. We currently use Smartsurvey or Surveymonkey. When participating in a survey, we might ask individuals to provide responses that may constitute personal data such as details about your employment, responsibilities and work; or your your views and opinions about services you have received. This cannot be a comprehensive list, further details would be provided at the point of contact. We process the data provided in surveys for the purpose of providing services to our clients.
- Video conferencing platforms. We deliver and occasionally record meetings, conferences, webinars, workshops and courses via video conferencing platforms such as Zoom, Microsoft Teams or Google Meet. We will collect personal data from you as part of the registration or set up process for the video call, including your name and email address. During the call, the data that you might share with us could include your image and the content of any discussion or information provided during the session. You should be advised at the start the session who is present and if the session will be recorded and if so how that recording will be shared.
- Services. We collect personal contact information from clients that purchase our services (or the key contacts that work for our clients) to help us administer the delivery of those services.
How we use your personal data
We process your personal data to run our business and provide our clients with services and, if you agree, to contact you about other services we offer which may be of interest to you. We must have a legal basis to process your personal data and we rely on a number of legal bases to use your data. In most cases, the legal basis will be one of the following:
- Your consent. You have the right to withdraw your consent at any time by contacting us.
- We have a contractual obligation and it is necessary in order to provide services.
- It is necessary to comply with a legal or regulatory obligation.
- We need it to perform a public task.
- It is necessary for fulfilling our legitimate interests.
We are committed to protecting the personal data we hold by taking appropriate technical and organisational measures against unauthorised, unlawful or accidental access, loss, destruction or damage of such personal data.
Oxford Brookes University uses Google G-suite applications such as Gmail or Google Drive to communicate with individuals and to securely store and share data. Data may be located outside the United Kingdom, including the United States of America, and is covered by the Privacy Shield Framework.
How long will we keep your data?
We will only retain personal data for as long as necessary to:
- Fulfil the purpose for which the data was collected or obtained.
- Fulfil our own obligations under UK law.
Your personal data will be securely deleted once either of these conditions no longer apply.
Data that you submit when subscribing to our newsletter is retained for the duration of your professional contact with us, unless you request otherwise or withdraw your consent. We regularly delete inactive data based on returned email reports.
Recordings from video conferencing platforms will be typically stored for six months before being securely deleted. Under some circumstances recordings will be stored for longer than six months but no longer than is necessary for the purposes for which it was provided.
For more information on retention periods (the exact length of time Brookes retains each category of personal information) for personal data of students attending our accredited courses please refer to the University record retention schedule or contact us.
Your data protection rights
You are entitled to view, amend, or delete your personal data that we hold in line with the data protection laws. You have the right to:
- Ask us for copies of your personal data that we hold.
- Ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Request the deletion of your personal data.
- Object to the processing of your personal data.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. If you wish to make a request regarding any of the above, please do so by contacting the Oxford Brookes University Information Management Team, on email@example.com or telephoning 01865 485420.
If you have a concern in relation to how we use your personal data and satisfy your rights, please let us know. If you are still not satisfied with the way we use your personal data and you believe this is not in accordance with data protection laws, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). You can contact the ICO via their web-form at https://ico.org.uk/concerns/ or call the ICO helpline on 0303 123 1113.
Changes to this policy