Privacy Notice: Applicants for Office, Membership and Employment

Wolfson College is committed to protecting the privacy and security of personal data.

1. Overview

This notice explains what personal data Wolfson College holds about applicants for office, senior membership and employment, how we use it internally, how we share it, how long we keep it and what your legal rights are in relation to it. 

This notice also explains the basis on which you are required or requested to provide some personal data to us.  For personal data that we generate about you, or that we receive from others, it explains the source of that data.

There are some instances where we process your personal data on the basis of your consent.  This notice sets out the categories and purposes of data where your consent is needed.

Wolfson College has also published separate notices, which are applicable to other groups and activities.  Those notices may also apply to you, depending on your circumstances, and it is important that you read this privacy notice together with other applicable privacy notices:

  1. Current students
  2. Alumni and Donors (including what financial information we hold about our alumni and how we use it when considering fundraising initiatives)
  3. Archives (which explains what data we hold in our archive)
  4. Security, maintenance and health and safety (including how we use CCTV)
  5. Website and cookies (including how we monitor use of our website)
  6. IT systems (including how we monitor internet usage)

2. What is your Personal Data, and how does the law regulate our use of it?

“Personal data” is information relating to you as a living, identifiable individual.  We refer to this as “your data”.

Data protection law requires Wolfson College, as controller for your data:

3. Wolfson College’s Contact Details

If you need to contact us about your data, please contact the College’s data protection officer (

4. What Personal Data we hold about you and how we use it

We may hold and use a range of data about you at different stages of our relationship with you.  We might receive this data from you; we might create it ourselves, or we might receive it from someone else (for example, if someone provides us with a reference about you).

Categories of data that we collect, store and use include (but are not limited to):

5. The Lawful Basis on Which We Process Your Data

The law requires that we provide you with information about the lawful basis on which we process your personal data, and for what purpose(s).

Most commonly, we will process your data on the following lawful grounds:

We may also use your personal information, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests.  In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent.

How we apply further protection in the case of “Special Categories” of personal data

“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information.

The Special Categories of personal data consist of data revealing:

They also consist of the processing of:

We may process special categories of personal information in the following circumstances:

We have in place appropriate policy documents and/or other safeguards which we are required by law to maintain when processing such data.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

Criminal convictions and allegations of criminal activity

Further legal controls apply to data relating to criminal convictions and allegations of criminal activity.  We may process such data on the same grounds as those identified for “special categories” referred to above.

Details of our processing activities, including our lawful basis for processing

Details of the lawful bases we rely on for the processing of the categories of data that we hold in relation to applicants for office, senior membership and employment at Wolfson College are set out in our Record of Processing Activity*. Details of retention periods, plus details of parties to whom we transfer data, and on what basis, are available to download.* 

6. Data that you provide to us and the possible consequences of you not providing it

Most data that you provide to us is processed by us in order that we, and you, can comply with obligations imposed by law. For example:

Your failure to provide such data may mean that you are unable to take up the relevant role.

Other data that you give to us is provided on a wholly voluntary basis; you have a choice whether to do so. Examples include:

7. Other Sources of your Data

Apart from the data that you provide to us, we may also process data about you from a range of sources. These include:

Our Record of Processing Activity indicates the sources of each of the various categories of data that we process.

8. How We Share Your Data

We do not, and will not, sell your data to third parties.  We will only share it with third parties if we are allowed or required to do so by law.

Examples of bodies to whom we are required by law to disclose certain data include, but are not limited to:

Home Office;  UK Visas and ImmigrationTo fulfil our obligations as a visa sponsor
Disclosure and Barring Service (DBS)Required for certain posts to assess an applicant’s suitability for positions of trust or where the post works with vulnerable people or children.

Examples of bodies to whom we may voluntarily disclose data, in appropriate circumstances, include but are not limited to:

Other Colleges and/or PPH’s within the University of OxfordWhere you apply for a role shared between different parts of the collegiate university, we may need to share relevant data for the proper functioning of relevant contracts and services.
Higher Education Statistics Agency (HESA)Some information, usually in pseudonymised form, will be sent to the HESA for statistical analysis and to allow government agencies to carry out their statutory functions.
Third party service providersTo facilitate activities of Wolfson College. Any transfer will be subject to an appropriate, formal agreement between us and the processor.

Where information is shared with third parties, we will seek to share the minimum amount of information necessary to fulfil the purpose. 

All our third party service providers are required to take appropriate security measures to protect your personal information in line with our policies, and are only permitted to process your personal data for specific purposes in accordance with our instructions.  We do not allow our third party providers to use your personal data for their own purposes.

More extensive information on the categories of recipients of your data is set out in a table.*

The law provides various further safeguards where data is transferred outside of the EU.

When you are resident outside the EU in a country where there is no “adequacy decision” by the European Commission, and an alternative safeguard is not available, we may still transfer data to you which is necessary for performance of your contract with us.

Otherwise, we will not transfer your data outside the European Union without first notifying you of our intentions and of the safeguards that apply to your data.

9. How Long We keep Your Data

We retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal, accounting or reporting requirements.  

Details of expected retention periods for the different categories of your personal information that we hold are set out in our Record of Processing Activity.*

Retention periods may increase as a result of legislative changes, e.g. an increase in limitation periods for legal claims would mean that we are required to retain certain categories of personal data for longer. Any such changes will be reflected in updated versions of our Record of Processing Activity.

Please note that we may keep anonymised statistical data indefinitely, but you cannot be identified from such data.

10. Your Legal Rights over your Data

Subject to certain conditions and exception set out in UK data protection law, you have:

If you wish to exercise any of your rights in relation to your data as processed by us please contact our Data Protection Officer at Some of your rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

Further guidance on your rights is available from the Information Commissioner’s Office. You have the right to complain to the UK’s supervisory office for data protection, the Information Commissioner’s Office at if you believe that your data has been processed unlawfully.

11. Future Changes to this Privacy Notice

We may need to update this notice from time to time; for example, if the law or regulatory requirements change, if technology changes or to make the University’s operations and procedures more efficient. If the change is material, we will give you not less than two months’ notice of the change so that you can exercise your rights, if appropriate, before the change comes into effect. We will notify you of the change by email.