University of Oxford Outreach and Your Data

1. What is this?

If you supply personal information for the purpose of an outreach activity organised by the University of Oxford ("the University") (like Oxplore) and/ or its Colleges, some of that information is added to the University's Higher Education Access Tracker (HEAT) database (www.heat.ac.uk), which is used to record information about outreach activities and those who take part in them. HEAT helps us identify which activities are most helpful in preparing students for higher education and progressing to employment.

This document describes how the information added to HEAT is used by the University of Oxford and its Colleges (together "we" or "us") as the "data controllers" for that information. This means that we decide how to use your information and are responsible for looking after it in accordance with data protection legislation.

2. Glossary

Where we refer in this policy to your "personal data", we mean any recorded information that is about you and from which you can be identified. It does not include data where your identity has been removed (anonymous data). Where we refer to the "processing" of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure, deletion or retention.

3. Information collected about you

The information we hold about you on HEAT comprises the following:

• name;
• gender;
• date of birth;
• post code;
• school;
• ethnicity.

We obtain this data when you take part in outreach events/activities organised by the University (including its Departments and Faculties) and/or the Colleges. Information about your ethnicity is a special category of more sensitive personal data and will only be held if you volunteered it when you took part in an event/activity.

We may also add to HEAT information about you that we collect from third parties, including the Office for Students (OfS), the Higher Education Statistics Agency (HESA), University and Colleges Admissions Service (UCAS), the Department for Education (DfE), Skills Funding Agency (SFA) and ACORN. This information may contain statistics about the area in which you live, for example, how many people from your area go on to higher education. Data from these sources will also allow us to track your own educational journey from school to higher education, for example, which university you end up at and what type of degree you obtain.

4. How we use the data on HEAT

We use the data in section 3 for the following purposes:

• monitoring and evaluating the effectiveness of our outreach programmes;
• producing statistics, including event application and participation numbers, and participant outcomes; and
• tracking future outcomes of event participants, including applications to the University and other Higher Education Institutions.

Using your data for these purposes is necessary for tasks that we carry out in the public interest (promoting and widening access to Higher Education) and to meet our legitimate interests in promoting applications to the University from under-represented groups.

5. Who is using your personal data and who will it be shared with?

HEAT is a shared database used by a variety of organisations to identify which activities are most helpful in preparing students for higher education and progressing to employment. Users of HEAT include:

• departments and faculties of the University and Colleges that organise outreach activities. They will have access to your personal data contained in HEAT for the purposes set out in Section 4 above.
• entities associated with the University, including student led organisations such as OUSU and educational charities, and your school, college and/or training organisation. These organisations will only have access to your personal data contained in HEAT if they were involved in organising an outreach event which you attended.

We may also share your data with HESA, UCAS, DfE and SFA to help determine whether our activities are helping participants move on from school into Higher Education and employment.

6. Transfer of your data outside of the European Economic Area (EEA)

There may be occasions when the sharing explained above involves the transfer of your data outside the EEA, for example, to a service provider based overseas. Such transfers will only take place if one of the following applies:

• the country receiving the data is considered by the EU to provide an adequate level of data protection;
• the transfer has your consent;
• the transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract; or
• the transfer is governed by approved contractual clauses.

7. How long will we retain your data?

Providing high quality outreach activities means being able to compare our activities and to determine which ones best help students to move on to Higher Education and employment. How long this takes will vary depending on your age at the time of participation in an outreach activity. In order to conduct long-term evaluation, tracking and research about access to Higher Education, we will retain your data for as long as we need it to meet the purposes set out above.

8. Your rights

Under certain circumstances, by law you have the right to:

• Request access to your data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.
• Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate data we hold about you.
• Request erasure of your data. This enables you to ask us to delete or remove your data in certain circumstances, for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
• Object to processing of your data where we are relying on our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your data to another party.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop. Further information on your rights is available from the Information Commissioner's Office (ICO).

If you want to exercise any of the rights described above or are dissatisfied with the way we have used your information, please contact the University's Information Compliance Team at data.protection@admin.ox.ac.uk. The same address can be used to contact the University's Data Protection Officer. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of the GDPR. Please note that we may keep a record of your communications and/or share your communications with the relevant College(s) to help us resolve any issues which you raise. If you remain dissatisfied, you have the right to lodge a complaint with the ICO.

9. Contact us

If you have any questions about the use of your information as described in this document, please email oxfordheat@admin.ox.ac.uk.

10. Changes to this privacy policy

We reserve the right to update this privacy policy at any time, and will seek to inform you of substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.