Wolsey Hall Oxford Privacy Policy
This privacy policy, in conformance with the UK GDPR, describes how we collect, use, process and share your personal information when you use our website and services.
HOW AND WHY DO WE USE YOUR PERSONAL DATA?
We use your personal information in the following ways:
- To fulfil our contractual obligations to you under Article 6(b) ‘performance of a contract’:
- Provide our courses and services.
- Process your payments.
- For our legitimate business interest under Article 6(f) ‘legitimate interest’:
- Understand how our courses and services are used, so that we may develop and improve them.
- Understand how our website is used, to optimise its performance.
- Keep system logs for operation and maintenance purposes.
- Keep our systems secure.
- Under Article 6(a) ‘consent’:
- Send marketing information by email, as requested with your consent, to promote our services.
- Share data with Google Ads to provision personalised ads whilst online.
- Under Article 6(c) ‘legal obligation’:
- Keep such records as we are required to do by law.
HOW WE COLLECT YOUR DATA
We collect and process personal information from you when you:
- Visit our website.
- Contact us by phone.
- Email or use our web forms to enquire about or apply for our courses or services.
- Interact with our courses.
- Subscribe to our mailing list.
- Subscribe to or comment on our blog.
- Respond to or participate in any survey or questionnaire sent by us.
- Make a purchase through the website.
- Subscribe to our Google Ads audience.
DATA YOU PROVIDE TO US
Enquiries: We collect information you provide when you make an enquiry to us by Livechat, Chatbot, telephone, email form, or the Enquiry web form on our website and in our responses and subsequent correspondence. This information may include your name, contact details, age, nationality, country of residence, and details of your enquiry.
Course Applications: If you apply for a course online, we store the information you provide in your or your child’s application form and in correspondence. This may include any or all of the following:
- Name;
- Date of birth;
- Email address;
- Address for book delivery;
- Nationality;
- Interests and activities you provide as being relevant to planning your child’s studies;
- Preferred method of payment;
- Academic history where needed to confirm eligibility for a course;
- Confirmation of parental responsibility.
Where someone else is helping a student under 18 we store their name, contact email address and relationship to the child.
Learning Support: We collect the name, date of birth, and contact information of the person using the service, information about the type of advice they are seeking where provided, and our advice and correspondence. This may include special categories of data under article 9 of UK GDPR (please see below). We also collect the name and contact details of the person paying and the record of payment including date and amount.
University Advice Service: We collect the name, date of birth, and contact information of the person using the service, the name and contact details of the person paying and the record of payment including date and amount.
Marketing: We collect your name and contact details when you subscribe to our mailing lists, communities, or our blog. Please contact us if you find that your child under 13 has subscribed to our blog or mailing list without your consent and we will remove their details.
Website content: Comment or content you may submit such as essays, assignments, competition entries, feedback, and photographs that we may feature with your consent on our website or social media channels.
DATA WE COLLECT FROM YOU
When you use our online services, such as visiting our website, completing our web forms, participating in our courses, and subscribing to our blog or mailing list, we collect technical information. This may include:
- Your IP address;
- Date and time of sign up or form submission;
- Unique device identifiers;
- Country location;
- Browser type;
- Operating system;
- Information about how visitors use on our website, blog, and courses.
We do not link data collected by our website to any other information we hold to identify any individual visitor. When you visit our website, we may track information to administer the site and analyse its usage for the purpose of serving our visitors and customers better. Our website uses cookies (small text files placed on your device). Please read our Cookies Policy for more information about how we use cookies.
Our website features embedded YouTube content and links that allow you to share our content with social media platforms such as Instagram, YouTube, Facebook, Pinterest, and Twitter. We do not have any control over how third-party sites collect data, and if you choose to follow these links, please read the privacy notices of the sites you link to.
Based on users visiting our website, and the personal data they share with us, third parties such as Google may place ads for us across the internet.
HOW WE SHARE YOUR DATA
We may disclose your personal information to other data controllers and with our trusted suppliers to provide our services to you.
To provide our courses: We share the name and email address of enrolled students and, where relevant their parents/guardians with our learning management system partner, Instructure, to create Student and Parent Observer accounts to fulfil our contract to you to provide courses. Instructure share information with us that is provided by students and parent observers during interactions with our courses on Canvas including assignment submissions, grades and messages and participation statistics. Instructure is the joint data controller of the personal information that is collected when you interact with our courses. You can see their privacy policy here.
Our customer relationship management system Open Apply stores the contact information of our students and families; their Privacy Policy can be found here.
To order books: We provide the contact details needed to our book suppliers to fulfil our contract to provide course books. Our book suppliers and couriers are the data controller of information provided to them. They provide further information about how they process your personal information in their privacy policies:
To process payments: We use Stripe to process online payments. Stripe provide us with details of payments made including name, service, date, and amount. They do not share your billing information with us. Stripe are the data controller of information provided to them via our web forms. You can see their privacy policy here.
To provide our services: We work with third-party companies who support our website for payment processing, accounting, marketing, and other services which may require them to access information about you. If a service provider needs to access our client’s personal information to perform services on our behalf, they do so under our instructions. We do not share your information with third parties for their own purposes. When you consent to our marketing emails, you may be added to our engaged audience group that can be shared with Google so that dedicated ads are shown to you (Google Ads remarketing).
RECIPIENTS OF PERSONAL DATA
We may disclose your personal information:
- If we are under a duty to do so to comply with any legal obligation;
- In order to enforce or apply our terms and other agreements;
- To protect our rights or property;
- To protect the safety of our clients including with healthcare, social and welfare advisors and with central and local government.
If we sell, transfer, or merge our business or assets in future and, as a result, share your data with other parties, they may use your data in the same way as set out in this notice. If your data becomes subject to a different privacy policy, we will contact you in advance.
LAWFUL BASIS FOR PROCESSING
The law on data protection sets out several different reasons for which a company may collect and process your personal data, including:
- To fulfil our contractual obligation to you under Article 6(b) ‘performance of a contract’ in order to:
- Provide our courses and services.
- Process your payments.
- For our legitimate business interest under Article 6(f) ‘legitimate interest’:
- Understand how our courses and services are used, so that we may develop and improve them.
- Understand how our website is used, so as to optimise its performance.
- Keep system logs for operation and maintenance purposes.
- Keep our systems secure.
- Under Article 6(a) ‘consent’:
- Send marketing information by email, as requested with your consent, to promote our services.
- Share data with Google Ads to provision personalised ads whilst online.
- Under Article 6(c) ‘legal obligation’:
- Keep such records as we are required to do by Law.
Sensitive personal information such as religion, race, ethnicity, political beliefs or health information such as learning abilities is classed as Special Category Data under the GDPR. Our legal basis for processing is our legitimate interest which is to provide you with advice and guidance in relation to a course application or during the course of studies, or to use the Support for Learning services where you have provided this information for this limited purpose.
Under Article 9 Paragraph (g) of the UK GDPR for processing special category data, we may store special categories of sensitive data such as race, ethnicity, religious beliefs or health, where provided to us as relevant to your or your child’s studies.
More specifically, under Article 9 Paragraph (g) Reasons of substantial public interest (with a basis in law):
Condition 17 of the UK GDPR (where Counselling etc.):
17(1) This condition is met if the processing—
(a) is necessary for the provision of confidential counselling, advice or support or of another similar service provided confidentially,
(b) is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and
(c) is necessary for reasons of substantial public interest.
(2) The reasons mentioned in sub-paragraph (1)(b) are-
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the service mentioned in sub-paragraph (1)(a).
YOUR RIGHTS
You have the following rights over the processing and use of your personal data. To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this privacy policy. If you have authorised a third party to submit a request on your behalf, we will ask them to show that they have your permission to act.
Withdrawing your consent: Where you have given us your consent to use your personal data, you have the right to withdraw your consent at any time by contacting us at the email address below. You may withdraw your consent to marketing emails by using the unsubscribe link provided in every email or by contacting us at the email address below and we must always comply with your request.
Access to your data: Please contact us at the email address below if you want us to tell you about any data we hold about you or to request a copy by making a Subject Access Request.
Correcting your data: Please contact us at the email address below if your data is incorrect, out of date or incomplete and we will take reasonable steps to correct it.
Restricting use of your data: You have the right to object to our use of your personal information where we are relying on our legitimate interest to process it. If you object, we must stop processing it unless we believe we have a legitimate overriding reason to do so. You have the right to ask us to delete your personal information. We may need to keep your data due to a legal obligation but may be able to restrict the use of your data so that it may only be used for legitimate reasons such as legal claims. In this situation, we would not use or share your information in other ways while it is restricted. If you want to object to how we use your data or ask us to delete it or restrict how we use it, please contact us at the email address below.
Portability: Where we are processing information that you have provided to us with your consent or to fulfil a contract with you, you have the right to ask us for a copy to be sent to you or another organisation in a format that can be easily reused. Please contact us to request this at the email address below.
DATA RETENTION
We retain personal information we have collected for as long as necessary to fulfil the purposes of providing the services you have purchased and for our legitimate business needs to respond to any questions or complaints and to maintain our business records as required by law. When we no longer have a legitimate business need to process your personal information, we will delete or anonymise it. If this is not possible (for example, because your personal information has been stored in backup archives) we will prevent any further processing and store it securely until deletion is possible. Our learning management system partner Instructure will keep all student and parent observer information they have processed for as long as we have an account with them and you may request a copy of this at any time; it may be deleted on request. Each data controller with whom we work will keep information according to their own retention schedules. You can check their privacy policies at the links provided above.
INTERNATIONAL TRANSFERS
We may transfer personal data that we collect from you to our third-party data processors in countries that are outside the European Economic Area (EEA) such as the USA or New Zealand. Your data will be stored securely and under the same protection as data processed within the EEA.
UPDATING THIS POLICY
We will review this policy to make any changes required to comply with legal or other requirements and will publish all changes on our website. This policy applies from 22 May 2018. It was last updated on 16 November 2023.
WITHDRAWAL OF CONSENT AND THE RIGHT TO LODGE A COMPLAINT
Where we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting us as soon as possible (see below for our contact information).
If you have any complaints regarding this policy notice or requests for further information, please write to us by email and we will work with you to resolve, quickly and fairly any complaint you may have. You may also phone us or write to us. If you have any complaints that we are not able to answer or if you have any concerns about the way that your data is being handled, you should contact the Data Privacy Supervisory Authority for the country in which you reside.
For the UK this is the Information Commissioner’s Office:
Phone: 0303 123 1113
Website: Information Commissioner’s Office
CONTACT US
Our contact information for any questions or complaints:
Email: [email protected]
Phone: 0800 622 6599 (UK) / Int: +44 (0) 1865 988 307
Address: Wolsey Hall Oxford International Ltd, Midland House, West Way, Oxford, OX2 0PH