Oxford Hub Website Privacy Notice

This privacy policy describes how we will collect and use your personal data. Please read it carefully, and if you have any questions, please contact us at [email protected].

The Oxford Hub is a charity registered in England under company number 1180505, whose registered address is 36 Little Clarendon Street, Oxford, OX1 2HU.  Our ICO registration number is ZA791061.  

What Data We Collect?

Whether you access our services, volunteer for us, or visit our website (https://oxfordhub.org/), we will process some information about you, such as

  • Identity data: name, title

  • Contact data: postal address, email address(es), telephone number, mobile phone number.

  • Financial data: donation amount (only when you’ve donated)

  • Organisation data: organisation name, job title, profession

  • Profile data: age group, gender, ethnicity

  • Health data: physical and mental health and wellbeing (for volunteers only) 

  • Technical data: IP address, browser type and version, operating system.


How We Use Your Data (and the legal basis for processing)

Most of the personal data we process is provided directly by you. Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing this information. The table below lists the processing purposes and the lawful basis.

Purpose for Processing

Legal Basis

To assess your suitability to be volunteer for us.

Legitimate Interests

Explicit Consent (sensitive data such as ethnicity and health)

To coordinate your volunteering activities

Legitimate Interests

To provide you with regular updates about our programmes, volunteering opportunities and partnership work through our newsletter.

Consent

To identify unique visitors to our website and to track their sessions on the site.

Consent

To process your donation.

Legitimate Interests

To support your fundraising activity.

Legitimate Interests

To respond to a referral request to one of our programmes.

Legitimate Interests

Explicit Consent (sensitive data such as ethnicity and health)

To process your request(s) to access one of our programmes.

Legitimate Interests

Explicit Consent (sensitive data such as ethnicity and health)

To record any accidents or near misses. 

Legal Obligation (Health & Safety at Work Act 1974)

We also receive personal information indirectly from the following sources:

  • Referrals from the local council and social services.

Who do we share your data with?

We will not share your personal information with any third parties.

Do we transfer your data outside of the United Kingdom?

Yes.  If you have signed up for our newsletter, your contact details are stored in MailChimp, a US-based email marketing platform.  All other information is stored in systems in the UK or the European Economic Area.  We only transfer data to countries where the UK’s Information Commissioner (ICO) has recognised the country as having an adequate data protection regime (e.g., EEA) or where there are appropriate safeguards, such as issuing the ICO’s UK Addendum to the EU’s standard contract clause.

How do we store your data?

The security of your data is important to us, and to protect your data, we take several necessary measures, including the following:

  • Limit access to your data to employees, volunteers, and trustees with a legitimate need to know and ensure that they are subject to confidentiality duties.

  • Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your data), including notifying you and the Information Commissioner’s Office where we are legally required.

  • Ensuring all appropriate levels of security for devices used by staff and volunteers (including multi-factor authentication, malware and virus software installed, and encrypting devices).

  • Ensuring all staff regularly attend data protection and cybersecurity training.

How long will we retain your data?

We will not keep your data any longer than necessary, and it will be kept for the following periods:

Type of Personal Data

Retention Period

Volunteer contact, identity and profile information.

2 years from the date you finished volunteering for us.

Donation and fundraising information.

6 years from the date of donation/fundraising activity.

Newsletter subscriber information (name and email address).

2 years from the date of last action (e.g., opened our newsletter).

Programme data (including referral requests and types of programmes accessed).

2 years from the date of last attendance.

Information relating to accidents or near misses.

5 years from the date of the accident or near miss.

Per our Retention and Data Disposal Policy, we will securely destroy your data.

What are your Rights?

Under data protection law, you have rights, including:

  • The Right of Access.  You have the right to ask us for copies of your personal information.

  • The Right to Rectification.  You have the right to ask us to rectify personal information you think is inaccurate.  You also have the right to ask us to complete information you think is incomplete.

  • The Right to be Forgotten.  You can ask us to erase your personal information in certain circumstances.

  • The Right to Restrict of Processing.  You have the right to ask us to restrict the processing of your personal data in certain circumstances.

  • The Right to Object.  You have the right to object to the processing of your personal data in certain circumstances.

  • The Right to Withdraw Consent.  If we rely on consent to process your personal data, you can withdraw that consent at any time.

  • The Right to Portability.  You have the right to ask that we transfer the personal data you gave us to another organisation or you in certain circumstances.

You are not required to pay any charge to exercise your rights.  If you make a request, we have one month to respond.

How to Complain

If you have any concerns about our use of your personal information, you can complain to us at [email protected].  You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.  Alternatively, you can phone their helpline at 0303 123 1113 or complete an online form via the ICO website (https://www.ico.org.uk).


Date last reviewed: 8th July 2024.