The Cultural Programme: Privacy Statement

We are committed to protecting your personal information and being transparent about what information we hold about you and your rights to amend or delete information we hold on you.

Using personal information allows us to develop a better understanding of our customers and in turn to provide you with relevant and timely information about the work that we do. It also helps us to engage with potential donors and supporters and to carry out audience research.

The purpose of this policy is to give you a clear explanation about how and why we collect and use the information we obtain from you directly and from third parties.

We use your information in accordance with all applicable laws concerning the protection of personal information. This policy explains:

• What information we may collect about you.
• How we may use that information.
• In what situations we may disclose your details to third parties.
• Our use of cookies to improve your use of our website.
• Information about how we keep your personal information secure, how we maintain it and your rights to be able to access it.
• Your rights to amend or be deleted from our system.

If you have any queries about this policy or wish for your data to be deleted from our system, please email: culturalprogramme@ox.ac.uk

INFORMATION COLLECTION

We collect various forms of information in several ways:

Information you give us
When you register on our website, join our e-list, submit an application for a project or open call, buy tickets or donate we will store personal information you give us such as your name, email address, postal code, telephone number, date of birth, financial details and credit card details.

Information about your interactions with us
When you visit our website, we collect information about how you interact with our content and adverts. When we send you a mailing, we store a record of this, and in the case of emails we keep a record of which ones you have opened and which ones you have clicked on.

Information from third parties
We occasionally receive information about you from third parties. For example, we may use third party research companies to provide general information about you, compiled using publicly available data.

Sensitive personal data
Data Protection law recognises that certain categories of personal information are more sensitive such as health information, race, religious beliefs and political opinions. We do not usually collect this information unless there is a reason for doing so.

We will only use your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent to use it for that new purpose.

LEGAL BASIS

There are three bases under which we may process your data:

Contract purposes. When you make a purchase from us, donate to us or are contracted by us for a project or programme of work, you are entering into a contract with us. To perform this contract, we need to process and store your data. For example, we may need to contact you by email or telephone in the case of a cancelled event or in the case of a problem with your payments.

Legitimate business interests. In certain situations, we collect and process your personal information for purposes that are in our legitimate business interest. However, we only do this if there is no overriding prejudice to you by using your personal information this way. We describe situations below where we may use this basis for processing.

With your explicit consent. For any situations where the bases above are not appropriate we will ask for your explicit consent before using your personal information in that specific situation.

MARKETING COMMUNICATIONS

We aim to communicate with you about the work that we do in ways that you find relevant, timely and respectful. To do this we use data that we have stored about you such as events you may have booked in the past and well as any preferences you may have told us about

We ask for consent to contact you via post and email. In the case of postal mailings, you may object to receiving these at any time by using the contact details at the end of this policy. In the case of email, we will provide you with an option to unsubscribe in every email that we send you.

We may also contact you by phone about our work but will always get consent from you before doing this. Please bear in mind that this does not apply to telephone calls that we may need to make about a contract, project or open call.

OTHER PROCESSING ACTIVITIES

In addition to marketing communications, we may also process personal information in the following ways that are within our legitimate organisation interests.

We may analyse data we hold about you to ensure the content and timing of communications we send you are as relevant as possible
We may analyse data we hold about you to identify and prevent fraud

To improve our website, we may analyse information about how you use it and how to access the contact and interact with it
We may use profiling techniques or third party wealth screening and insights companies to provide us with information about you that will help us communicate in a relevant way with you when we are approach your about potential philanthropic support.

In all the above cases we will always keep your rights and interests at the forefront to ensure they are not overridden by your own interests or fundamental rights and freedoms. You have the right to object to any of this processing at any time. Please bear in mind that if you object this may affect our ability to carry our tasks that are of your benefit.

THIRD PARTIES

There are certain circumstance under which we may disclose your personal information to third parties. These are:

• To our service providers who process data on our behalf and on our instructions (for example a ticketing system software provider) In these cases we require that these third parties follow our instructions and with data protection laws, for example around security of personal data.
• Where we are under a duty to disclose your personal information to comply with any legal obligation.
• To specific named companies whose performance you have attended or project partners. In these cases, we will ask for your explicit consent before doing so

We may share your data with third parties who supply services on our behalf, such as those who help us to run the website. All our third-party service providers must take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.

Third party websites
Our site contains links to and from various third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Who has access to your data?
Access to your data within the University will be provided to those who need to view it as part of their work in carrying out the purposes described above. This will be restricted to a limited number of individuals in the cultural programme team, steering groups, selection panels and contracted freelance employees.

We may share your data with companies who provide services to us, such as a company hosting an application form. These companies must take security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and per our instructions.

The University does not routinely share your personal data with third parties. If you have applied for a project, partnership or joint venture then the University may need to share your data with partners – we will inform you if this is the case. Where data sharing does take place, this is subject to a data sharing agreement between the University and the relevant partners.

We may store data collected via our website manually or electronically. The data is stored on the University of Oxford secure servers and/or in our premises within the UK.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data transmitted to the website and any transmission is at your own risk.

COOKIES

A cookie is a small file of letters and numbers that we place on your computer, or mobile device, if you agree. These cookies allow us to distinguish you from other website users, which helps us to provide you with a good experience and to continually improve our websites. They are widely used to allow a website to function (to keep track of your basket for example) as well as provide website operators with information on how the site is being used.

Cookies help improve your visit to our website. We use the following types of cookies:

• Strictly necessary cookies – these are essential in to enable you to move around the websites and use their features. Without these cookies the services you have asked for, such as registering for an account, cannot be provided.
• Performance cookies – these cookies collect information about how visitors use a website, for instance which pages visitors go to most often. We use this information to improve our websites and to aid us in investigating problems raised by visitors. These cookies do not collect information that identifies a visitor.
• Functionality cookies – these cookies allow the website to remember choices you make and provide more personal features. For instance, a functional cookie can be used to remember the volume level you prefer to use when watching videos on our websites. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites.
• Targeting cookies – these cookies are used to deliver adverts more relevant to you and your interests. They collect information about your browsing habits. Targeting cookies are linked to services provided by third parties, such as ‘like’ and ‘share’ buttons and advertisements. We use targeting cookies to send third parties’ information on your visit so that they can make their advertising more relevant to you when you visit their websites.

Your debit/Credit card information

If you use your credit or debit card to buy from us or to donate, we will ensure that this is carried out securely and following the Payment Card Industry Data Security Standard

STORAGE

We store your personal information indefinitely such that for any later purchases you make we can link them back to a single unique record that we hold for you on our system. If you would like to remove your record, please contact us.

Security of personal information
We will put in place safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We will ensure that any third parties we use for processing your information do the same.

We will not transfer, process or store your data anywhere outside of the European Economic Area

YOUR RIGHTS TO PERSONAL INFORMATION

Under certain circumstances, by law you have the right to:

• Request access to your data (commonly known as a “subject access request”). This enables you to receive a copy of your data and to check that we are lawfully processing it.
• Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
• Request erasure of your data. This enables you to ask us to delete or remove your data under certain circumstances, for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
• Object to processing of your data where we are relying on our legitimate interests (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your data to another party.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop.

If you need to contact us about the data we hold on you, please email:
Culturalprogramme@ox.ac.uk