Website privacy notice

Purpose of this notice

This privacy notice explains how St Antony’s College (“the College”, “we”, “us”) processes personal data about individuals who visit and interact with the College’s website (www.sant.ox.ac.uk). It is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Readers of this notice are advised that the College maintains a separate Cookie Notice, which it may be helpful to read in combination with this notice.

Who we are

St Antony’s College is a registered charity (number 1141293) and a constituent college of the University of Oxford. The College is the data controller for personal data collected through our website. Our ICO registration number is Z6986441.

If you have any questions about this notice or how your data is handled you may contact:

Data Protection Officer
Email: dpo@sant.ox.ac.uk
Address: St Antony’s College, 62 Woodstock Road, Oxford, OX2 6JF

Categories of personal data we collect

We may collect and process the following personal data about you when you visit or interact with the College’s website:

• Name and contact details (when provided via forms)
• Submitted content (e.g., job titles, life updates, maintenance requests)
• Academic or professional information
• Special category data (e.g., in the Equal Opportunities Monitoring Form)
• Email address and consent preferences
• IP address and browser/device information
• Technical diagnostic information (e.g., error logs, access records)
• Login identifiers for administrative users (e.g., name, email, timestamp)

Purposes for processing

We process your personal data for the following purposes:

• To administer and respond to submissions made through web forms, for example;
  • Event registration
  • Maintenance requests
  • Alumni engagement (e.g., The Antonian magazine)
  • HR monitoring (Equal Opportunities)
  • Library purchases
• To maintain, secure, and troubleshoot the website (including technical and diagnostic logs)
• To support internal analytics and performance monitoring
  • If you consent to analytics cookies, we use Google Analytics to collect data on how visitors use the site. This may include:
  • Anonymised IP address
  • Device and browser characteristics
  • Pages visited and interaction patterns
• To manage administrator login credentials (via SSO for staff only)

Lawful basis for processing

The College relies on the following lawful bases:

• Article 6(1)(a) – Consent: For form submissions and analytics cookies, where consent is requested or Article 6(1)(f) – Legitimate interests where consent is not requested.
• Article 9(2)(a) – Explicit consent: For any special category data voluntarily submitted via forms.
• Article 6(1)(f) – Legitimate interests: For maintaining the security, performance, and integrity of the website (technical & diagnostic logs).
• Article 6(1)(a) – Consent: For website analytics & performance monitoring.See our Cookie Notice for more information

Sharing your information

We do not sell your data or allow others to use it for marketing purposes. We only share it where necessary with the following:

• MeThree Ltd: Our contracted website developer, who acts as a data processor. MeThree are not permitted to process personal information other than in accordance with the instruction of the College. The College only permits information to be processed to the extent that it is necessary for the correct functioning of the website, e.g. ensuring form submissions are received by the College.
• CloudAbove: a sub-processor who provides website hosting services under contract with MeThree. CloudAbove are contractually bound to the same, or more restrictive data processing terms as MeThree. They provide the technical infrastructure upon which submitted personal information may temporarily reside and are not permitted to process this information for any other purpose.
• Google LLC: Analytics provider where cookies are enabled by consent.

Access to form submissions may temporarily exist within WordPress for administrative users. The retention period for data held on this platform is set the minimum necessary to ensure any received information is successfully transferred to the College.

Data retention

• Submitted form data is typically emailed to College departments and may be retained in the website dashboard temporarily.
• Sensitive data (e.g., equal opportunities responses) is retained only as long as required and then securely deleted.
• Technical logs and IP addresses are stored on the server and retained for a limited period for diagnostic and security purposes.
• Google Analytics data is retained for 14 months.

Your data protection rights

As a data subject, you have the following rights under UK data protection law:

• To request access to your personal data
• To request correction of inaccurate data
• To object to or restrict processing in certain circumstances
• To request erasure of your data where there is no legal basis for retention
• To withdraw your consent at any time
• To lodge a complaint with the Information Commissioner’s Office (ICO)

You can exercise these rights by contacting the College’s Data Protection Officer at: dpo@sant.ox.ac.uk

Updates to this notice

We may update this privacy notice from time to time. The latest version will always be available on the College website.

Version no:	1.2	Prepared by:	Communications Manager	Last review:	June 2025
Effective date:	12/6/25	Approved by:	Approved by: Assistant Data Protection Officer	Next review:	June 2027