Privacy Notice

Data you provide to us

Enquiries: We collect information you provide when you contact us by phone, email, or via our website forms and in any subsequent correspondence. This may include your name, contact details, age, nationality, country of residence, and details of your enquiry.

Course Applications: If you apply for a course, we collect and store the information provided in the application form and related communications. This may include:

• Name;
• Date of birth;
• Email address;
• Address for book delivery;
• Nationality and country of residence;
• Interests or activities related to the student’s studies;
• Preferred method of payment;
• Academic history where required to assess eligibility;
• Confirmation of parental responsibility.

Where a student is under 18, we may also collect the name, contact details and relationship of a parent, guardian or other supporting adult.

Special category data

In limited circumstances, we may process special category personal data, such as information relating to health, ethnicity, religion or learning support needs, where this is relevant to the provision of our services and has been provided to us. We do so in accordance with Article 9(2)(g) UK GDPR and Schedule 1 of the Data Protection Act 2018, including Condition 17 (confidential support services), where necessary to provide confidential support, advice or related services, or for reasons of substantial public interest. Access to this information is restricted to authorised staff with a legitimate need to know.

Learning Support and Wellbeing Information: We collect the name, date of birth, and contact information of the individual using the service, together with information about the type of support or advice they are seeking where provided, and our related correspondence. This may include special categories of data under article 9 of UK GDPR (please see above). We also collect the name and contact details of the person responsible for payment, along with a record of payments made (including date and amount).

University Advice Service: We collect the name, date of birth, and contact information of the individual using the service, together with relevant correspondence. We also collect the name and contact details of the person responsible for payment, along with a record of payments made (including date and amount).

Marketing: We collect your name, contact details and information relevant to your enquiry when you submit an enquiry form, subscribe to our communications, mailing lists, or parent communities, or otherwise request information about our services. Please contact us if you find that your child under 13 has subscribed to our communications without appropriate consent and we will remove their details.

Website content: We may collect content that you choose to submit, such as essays, assignments, competition entries, feedback, or photographs, where this is shared for publication on our website or social media channels. Where required, we will obtain appropriate consent (including parental consent for children), and individuals can withdraw their consent at any time.

Data we collect from you

When you use our online services, such as visiting our website, completing our web forms, participating in our courses, and subscribing to our blog or mailing list, we collect certain technical information. This may include:

• Your IP address;
• Date and time of visits, signups or form submission;
• Unique device identifiers and cookies;
• Country location;
• Browser type;
• Operating system;
• Information about how visitors use our website, newsletters, and courses.

We use this information to operate, maintain and improve our website and services, and to understand how users interact with our content.

Our website uses cookies (small text files placed on your device). Please read our Cookie Policy for more information about how we use cookies and similar technologies, and how you can manage your preferences.

Our website may feature embedded YouTube content and links that allow you to share our content with social media platforms such as Instagram, Facebook, LinkedIn, X and Trustpilot. If you choose to interact with these services, they may collect information about you in accordance with their own privacy notices. We do not have any control over how these third parties use your data.

How we share your data

We may share your personal information with trusted suppliers (acting as our data processors) who support us in providing our services. A list of our approved subprocessors is available here: https://wolseyhalloxford.org.uk/policies/subprocessors

To provide our courses: We share the name and email address of enrolled students and, where relevant their parents/guardians with our learning management system provider, Instructure, in order to create Student and Observer accounts and deliver our courses.
Through the use of the learning management system, Instructure processes personal data generated during participation in our courses, including assignment submissions, grades, messages, and participation statistics.

Instructure acts as an independent data controller in relation to personal data processed within its platform.

Further information is available in Instructure’s Privacy Notice.

We use a Customer Relationship Management (CRM) system provided by HubSpot to manage communications with prospective and current students and their families, including enquiries and admissions-related communications. This may involve storing contact details, records of communications, and limited information about interactions with our website or emails (for example, email opens or link clicks). HubSpot acts as a data processor on our behalf and processes personal data only in accordance with our instructions. Further information is available in HubSpot’s Privacy Policy.

To order books: We provide the contact details necessary to our book suppliers and delivery partners to fulfil our contract to provide course materials. This may include providers such as Mallory International and Amazon and delivery partners such as DHL and UPS. These organisations act as independent data controllers in relation to the information they receive and process. They provide further information about how they use personal data in their own privacy notices. Please refer to our Subprocessors list for further details.

To process payments: We use Stripe to process online payments. Stripe provides us with details of payments made, service, date and amount. It processes your payments directly and does not share full billing information with us. Stripe acts as an independent data controller of information provided to them via our web forms. You can see their privacy policy here.

We also use financial and accounting systems, including Xero, NetSuite, and Wise, to manage financial records, invoices, and payments. These providers process personal data on our behalf or as required to provide their services.

To provide our services: We work with third-party companies who support our website for payment processing, accounting, marketing, education and other services. These providers may require access to personal data to perform their services. This includes providers of server-side tracking and data routing services, which securely transmit website and marketing data to platforms on our behalf.

Where a service provider processes personal data on our behalf, they do so under our instructions and are subject to appropriate contractual safeguards. We do not share your information with third parties for their own purposes.

How we use your data for marketing

We use cookies and similar technologies, with your consent, to support our marketing activities, understand how our website is used and to show relevant advertising on platforms such as Google, LinkedIn, Meta and TikTok.

We use these technologies to understand how our website and campaigns perform, to improve our services, and to show relevant adverts to people who have shown an interest in our courses.

We may also send you marketing communications by email where you have requested this or provided your consent. These communications are managed using our CRM system, HubSpot. You can unsubscribe at any time using the link provided in our emails or by contacting us directly.

The types of data collected across these technologies may include:

• Pages visited and actions taken
• Device and browser information
• IP address (shortened or masked)
• Marketing and campaign identifiers
• Email address or phone number (only where you submit them and only in hashed form for conversion tracking)

We use a server-side tracking service provided by Stape to manage how data is transmitted from our website to third-party platforms. Further details are set out below. Our legal bases for this processing are:

• Consent (Article 6(1)(a)) for the use of cookies and marketing and tracking technologies
• Legitimate interests (Article 6(1)(f)) for analysing aggregated or pseudonymised performance and analytics data to improve our services and marketing

Where cookies or similar technologies are used, we rely on your consent in accordance with applicable laws (including the Privacy and Electronic Communications Regulations- PECR). Legitimate interests apply only to the analysis of data after it has been collected using cookies or similar technologies with your consent.

Google Ads

We use Google Ads to measure the effectiveness of our advertising and to show relevant adverts to people who have visited our website or shown an interest in our courses.
Depending on your cookie preferences and how you interact with our website, this may include:

Pages visited and actions taken

• Device and browser information
• IP address (shortened or masked)
• Email address or phone number (only where you submit them and only in hashed form for conversion tracking)

We use features such as remarketing and Enhanced Conversions to understand how enquiries and sign-ups relate to our advertising. Where personal data is used for Enhanced Conversions, it is hashed before being shared with Google, meaning it is not shared in a readable form.

Legal basis: Consent (Article 6(1)(a)) for cookies and tracking technologies.

LinkedIn Insight Tag

We use the LinkedIn Insight Tag to understand how visitors interact with our website and to measure the effectiveness of our LinkedIn advertising.

Depending on your cookie preferences, this may involve collecting:

• Pages visited and interactions
• Device and browser information
• IP address (shortened or masked)
• Timestamps of website visits

This information is used to measure the performance of our LinkedIn campaigns and, where enabled, to show relevant adverts to people who have visited our website.

The data is processed in an aggregated or pseudonymised form and may still constitute personal data under applicable data protection law for reporting and advertising purposes.

Legal basis:
•    Consent (Article 6(1)(a)) for the use of cookies and tracking technologies
•    Legitimate interests (Article 6(1)(f)) for analysing aggregated or pseudonymised website and campaign performance data, where this analysis is carried out on data collected with your consent.

LinkedIn members can manage their advertising preferences through their LinkedIn account settings. 

Hotjar

We use Hotjar to understand how visitors use our website and to help us improve its design, usability, and performance.

Depending on your cookie preferences, this may involve collecting:

• Pages visited and interactions (such as clicks, taps and scrolling)
• Device and browser information
• Screen size and technical settings
• IP address (shortened or masked)
• Country-level location

This information is used to identify patterns in how our website is used, helping us to improve functionality and user experience. Where surveys or feedback tools are used, any information you choose to provide is processed only for that purpose.

Hotjar acts as a data processor on our behalf and processes personal data only in accordance with our instructions.

Legal basis:

• Consent (Article 6(1)(a)) for the use of cookies and tracking technologies
• Legitimate interests (Article 6(1)(f)) for analysing aggregated or pseudonymised usage data to improve our services, where this analysis is carried out on data collected with your consent.

Meta Custom Audiences

We use Meta Custom Audiences to show relevant adverts on Facebook and Instagram to people who have previously interacted with us, for example by making an enquiry or signing up for a course. Depending on your cookie preferences and how you interact with us, this may involve using:

• Email address or phone number (only where you have provided it)
• Website and campaign interaction data

This information is hashed before being shared, meaning it is converted into a secure code and is not shared in a readable form. Meta uses this to check whether you have an account on its platforms and, if so, to show you relevant adverts about our services.
Meta acts as an independent data controller and, in relation to certain processing activities (such as the use of Custom Audiences), may act as a joint controller with us. In these cases, we and Meta have shared responsibilities for the processing of your personal data.

Further information is available in Meta’s privacy notice.

Legal bases:

• Consent (Article 6(1)(a)) for the use of cookies and marketing and tracking technologies.
• Legitimate interests (Article 6(1)(f)) for analysing aggregated or pseudonymised performance data to improve our services and marketing, where this analysis is carried out on data collected with your consent.

TikTok Pixel

We use the TikTok Pixel to measure the effectiveness of our advertising and to show relevant adverts to people who have interacted with our website. Depending on your cookie preferences and how you interact with our website, this may involve collecting:

• Pages visited and actions taken
• Device and browser information
• IP address (shortened or masked)
• Marketing and campaign identifiers

Where you submit your details (for example through an enquiry form), this may also include limited contact information such as your email address or phone number, which is shared in hashed form for conversion tracking.

This information is used to understand how users interact with our website, to measure the performance of our advertising campaigns, and to show relevant adverts on TikTok.
TikTok acts as an independent data controller in relation to the data it processes. Further information is available in TikTok’s own privacy notice.

Legal basis:

• Consent (Article 6(1)(a)) for the use of cookies and marketing and tracking technologies

Server-side tracking (Stape)

We use a server-side tracking service provided by Stape to securely manage how data from our website is sent to advertising and analytics platforms such as Google Ads, Meta and LinkedIn. This means data is routed through a server-side environment configured and managed by us before being forwarded to third-party platforms, rather than being sent directly from your browser.

This approach improves security, reduces data loss from ad blockers, and allows us to limit the data that is shared. This processing takes place only where you have provided your consent through our cookie consent mechanism.

Stape acts as a data processor on our behalf and processes personal data only in accordance with our instructions. It does not use your personal data for its own purposes.
Where data is transferred outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and, where applicable, adequacy regulations.

Accessing our courses via third-party providers

If you are studying with Wolsey Hall Oxford through a third-party organisation or education provider (the “Education Provider”), that organisation remains the data controller for your personal information and instructs us on how it should be used to deliver your course. Wolsey Hall Oxford acts as a data processor on behalf of the Education Provider. We process your personal data in accordance with their instructions and our agreement with them. Where your Education Provider has established a lawful basis (for example, consent or performance of a contract) to share your information with us, we do not need to seek additional consent every time we process your data for the agreed educational services. The lawful basis for this processing is typically the Education Provider’s contract with you (Article 6(1)(b) UK GDPR) or, where applicable, your consent. We rely on that lawful basis when we process your information on their behalf.

Recipients of personal data

We may disclose your personal information:

• where necessary to comply with a legal obligation
• to enforce or apply our terms and other agreements
• to protect our rights or property
• to protect the safety of our clients, including by sharing information with healthcare professionals, social or welfare advisors and central or local government.

If we sell, transfer, or merge our business or assets in future and, as a result, share your data with other parties, they may use your data in the same way as set out in this notice. If your data becomes subject to a different privacy notice, we will contact you in advance.

Lawful basis for processing

The law on data protection sets out several different reasons for which a company may collect and process your personal data, including:

1. Under Article 6(1)(b) ‘performance of a contract’:
   • Provide our courses and services.
   • Process your payments.
2. Under Article 6(1)(f) ‘legitimate interests’:
   • Understand how our courses and services are used, so that we may develop and improve them.
   • Understand how our website is used, to optimise its performance.
   • Keep system logs for operation and maintenance purposes.
   • Keep our systems secure.
3. Under Article 6(1)(a) ‘consent’:
   • Send marketing information by email, as requested with your consent, to promote our services.
4. Under Article 6(1)(c) ‘legal obligation’:
   • Keep such records as we are required to do by law.

Special category data

Sensitive personal information (for example information relating to health, ethnicity, religion or learning support needs) is classed as special category data under UK GDPR.

Where we process special category data, we do so in accordance with Article 9(2)(g) UK GDPR and Schedule 1 of the Data Protection Act 2018, including Condition 17 (confidential support services), where necessary to support students, provide learning support services, or ensure their wellbeing and safeguarding.

Access to this information is restricted to authorised staff with a legitimate need to know, and appropriate safeguards are in place to ensure confidentiality and security.

Your rights

You have the following rights over the processing and use of your personal data. To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request. If you have authorised a third party to submit a request on your behalf, we will ask them to show that they have your permission to act.

Withdrawing your consent: Where you have given us your consent to use your personal data, you have the right to withdraw your consent at any time. You may withdraw your consent to marketing emails, and we will always comply with your request.

Access to your data: You have the right to request access to the personal data we hold about you and to receive a copy of that information (a “Subject Access Request”).

Correcting your data: You have the right to request that we correct personal data that is inaccurate or incomplete.

Restricting use of your data: You have the right to object to our use of your personal data where we are relying on legitimate interests as the lawful basis. If you object, we will stop processing your data unless we have compelling legitimate grounds to continue. You also have the right to request the erasure of your personal data. In some circumstances, we may be required to retain your personal data to comply with legal obligations. However, we may restrict how your data is used, for example where it is required only for legal claims.

Portability: Where we are processing information that you have provided to us based on your consent or for the performance of a contract, you have the right to request a copy to be sent to you or another organisation in a format that can be easily reused.

To exercise any of the rights above, please contact us using the details set out below.

Data retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including providing our services, and for our legitimate business needs, such as responding to queries or complaints and maintaining records in
accordance with legal and regulatory requirements. Retention periods vary depending on the type of data and the purpose for which it is processed.

When we no longer have a legitimate business need to process your personal information, we will delete or anonymise it. If this is not possible (for example, because your personal information has been stored in backup archives) we will securely store it and prevent further use until deletion is possible.

Our learning management system partner, Instructure, retains student and parent observer data in accordance with its own retention practices. You may request access to this data at any time, and deletion may be requested where appropriate.

Other organisations that act as independent data controllers will retain personal data in accordance with their own retention policies, as set out in their privacy notices.

International transfers

We may transfer personal data to our third-party service providers in countries that are outside the UK, including the United States and other countries where our providers operate.

Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place to protect your personal data in accordance with UK data protection law.

These safeguards may include the use of Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or transfers to organisations that participate in recognised frameworks such as the UK Extension to the EU–US Data Privacy Framework, where applicable.

Further information about these safeguards is available on request.

Withdrawal of consent and the right to lodge a complaint

If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. If you have any concerns about how we use your personal data, please contact us using the details provided below. We will make every effort to address any concerns or complaints promptly and fairly.

If you are not satisfied with our response or have ongoing concerns about how your data is being handled, you have the right to lodge a complaint with the relevant Data Protection Authority. In the UK, this is the Information Commissioner’s Office (ICO):
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Phone: 0303 123 1113 
Website: Information Commissioner’s Office