Privacy Notice

Data you provide to us

Enquiries: We collect information you provide when you make an enquiry to us by phone, email, or the Contact Us web form on our website and in our responses and subsequent correspondence. This information may include your name, contact details, age, nationality, country of residence, and details of your enquiry.

Course Applications: If you apply for a course online, we store the information you provide in your or your child’s application form and in correspondence. This may include any or all of the following:

• Name;
• Date of birth;
• Email address;
• Address for book delivery;
• Nationality;
• Interests and activities you provide as being relevant to planning your child’s studies;
• Preferred method of payment;
• Academic history where needed to confirm eligibility for a course;
• Confirmation of parental responsibility.

Where someone else is helping a student under 18 we store their name, contact email address and relationship to the child.

Under Article 9 Paragraph (g) of the UK GDPR for processing special category data, we may store special categories of sensitive data such as race, ethnicity, religious beliefs, or health, where provided to us as relevant to your or your child’s studies.

Under Condition 17 of Schedule 1 of the UK Data Protection Act 2018 and Article 9(2)(g) of the UK GDPR, we are permitted to process special category personal data, such as health-related data, for the purpose of providing confidential counselling, advice, support services, or other similar services under the following conditions:

1. Necessity for Confidential Services (Condition 17(1)(a))
The processing of personal data is necessary for the provision of:

• Confidential counselling, advice, or support services, or
• Another similar service that is provided confidentially (for example, safeguarding and psychological services, therapeutic support).

This condition ensures that sensitive data can be processed in a confidential and safe manner to provide critical support services to individuals.

2. Processing Without Consent (Condition 17(1)(b))
The processing can be carried out without the explicit consent of the data subject if one of the following applies:

(a) Consent cannot be given in the circumstances:

• For example, if an individual is unable to provide consent due to incapacity or a situation where it is difficult for the individual to make an informed decision (e.g., minors).

(b) The controller cannot reasonably be expected to obtain consent:

• This may occur in situations where it is impractical to obtain consent, for example, in urgent cases where immediate support is needed, or if seeking consent could delay or obstruct the provision of crucial services.

(c) Obtaining consent would prejudice the provision of the service:

• This may be the case if asking for consent could undermine the confidentiality or effectiveness of the service, such as in situations where a person may feel unable to freely consent due to fear of stigma or other concerns (e.g., therapy, crisis counselling).

3. Substantial Public Interest (Condition 17(1)(c))
The processing is necessary for reasons of substantial public interest. This condition typically applies where the processing:

• Contributes to the public health or safeguarding of individuals.
• Is required for preventing serious harm to the individual or others (e.g., for the mental well-being of students, employees, or community members).
• Relates to public safety or addresses other critical social interests.

This helps balance the individual’s rights with broader societal benefits, such as improving public health outcomes or safeguarding vulnerable individuals.

Learning Support: We collect the name, date of birth, and contact information of the person using the service, information about the type of advice they are seeking where provided, and our advice and correspondence. This may include special categories of data under article 9 of UK GDPR (please see above). We also collect the name and contact details of the person paying and the record of payment including date and amount.

University Advice Service: We collect the name, date of birth, and contact information of the person using the service, the name and contact details of the person paying and the record of payment including date and amount.

Marketing: We collect your name and contact details when you fill in an enquiry form, subscribe to our mailing lists, communities, or our blog. Please contact us if you find that your child under 13 has subscribed to our blog or mailing list without your consent and we will remove their details.

Website content: Comment or content you may submit such as essays, assignments, competition entries, feedback, and photographs that we may feature with your consent on our website or social media channels.

Data we collect from you

When you use our online services, such as visiting our website, completing our web forms, participating in our courses, and subscribing to our blog or mailing list, we collect technical information. This may include:

• Your IP address;
• Date and time of sign up or form submission;
• Unique device identifiers;
• Country location;
• Browser type;
• Operating system;
• Information about how visitors use on our website, blog, and courses.

We do not link data collected by our website to any other information we hold to identify any individual visitor. Our website uses cookies (small text files placed on your device). Please read our Cookies Policy for more information about how we use cookies.

Our website features embedded YouTube content and links that allow you to share our content with social media platforms such as Instagram, YouTube, Facebook, Pinterest, LinkedIn and Twitter. We do not have any control over how third-party sites collect data, and if you choose to follow these links, please read the privacy notices of the sites you link to.

How we share your data

We may disclose your personal information to other data controllers and with our trusted suppliers to provide our services to you.

To provide our courses: We share the name and email address of enrolled students and, where relevant their parents/guardians with our learning management system partner, Instructure, to create Student and Parent Observer accounts to fulfil our contract to you to provide courses. Instructure share information with us that is provided by students and parent observers during interactions with our courses on the learning management system including assignment submissions, grades and messages and participation statistics. Instructure is the joint data controller of the personal information that is collected when you interact with our courses. You can see their Privacy Policy here. Our Customer Relationship Management system, Open Apply, stores the contact information of our students and families; their Privacy Policy can be found here. 

To order books: We provide the contact details needed to our book suppliers to fulfil our contract to provide course books. Our book suppliers and couriers are the data controller of information provided to them. They provide further information about how they process your personal information in their privacy policies:

• Amazon
• Mallory 
• DHL
• Royal Mail
• Cambridge University Press    
• Oxford University Press
• Blackwells

To process payments: We collect credit card details and keep them only where requested to process payments via PayPal. We keep details of payments including name, date, course or service and amount. PayPal are the data controller of the information we provide to them. You can see their Privacy Policy here.

We use Stripe to process online payments. Stripe provide us with details of payments made including name, service, date, and amount. They do not share your billing information with us. Stripe are the data controller of information provided to them via our web forms. You can see their Privacy Policy here.

To provide our services: We work with third-party companies who support our website for payment processing, accounting, marketing, education and other services which may require them to access information about you. If a service provider needs to access our client’s personal information to perform services on our behalf, they do so under our instructions. We do not share your information with third parties for their own purposes.

How we use your data for marketing

We rely on legitimate interest as the legal basis for this processing. Our legitimate interest is to measure the performance of our marketing campaigns and to improve our marketing strategy. This helps us to better allocate resources and deliver more relevant content to you, our customers.

Google Ads

When you consent to our marketing emails, you may be added to our engaged audience group that can be shared with Google so that dedicated ads are shown to you (Google Ads remarketing). Google may place a cookie or similar tracking technology in your browser to display ads on Google Search, YouTube, or other websites in the Google Display Network.
 
What We Collect:

• Pages visited and actions taken
• Anonymised IP address
• Device and browser type

No sensitive personal data is collected.

We use Google Ads Enhanced Conversions to improve conversion tracking. When you complete certain actions (e.g. enquiries, sign-ups), we may securely share hashed first-party data (like email addresses) with Google for better ad performance. This allows us to improve the accuracy of conversion tracking when cookies are limited. This data is processed securely and in compliance with UK GDPR, and is subject to Google’s policies on data handling, encryption, and user consent under Consent Mode.

What We Collect: When you interact with our ads or complete a form on our website, we collect information such as your email address or phone number.

How It Works: Your personal data is hashed (turned into a code) and securely sent to Google. Google matches this code with its own data to track conversions. This process helps us understand how well our advertising campaigns are performing.

Data Protection: Your personal data is hashed before being shared with Google, which means it is not shared in a readable form. The data is only used to track conversions and is not used for any other purpose by Google.

How to opt out: You may opt out of your data being used for Google Ads Enhanced Conversions at any time by adjusting your cookie preferences through our Cookie Banner. You can also clear or reset cookies via your browser settings.
For more information about how Google uses your data, please visit Google’s Privacy & Terms.

LinkedIn Insight Tag

Our website uses the LinkedIn Insight Tag, a tool provided by LinkedIn Corporation, to help us understand how visitors interact with our content and to measure the effectiveness of our LinkedIn advertising efforts.

What We Collect: The LinkedIn Insight Tag collects and processes the following types of data when you visit our website: IP address, Device and browser characteristics, Timestamps of website visits, Page views and interactions

How It Works: The collected data allows us to: measure the performance of our LinkedIn advertising campaigns, gain insights into how users engage with our website and retarget website visitors with relevant content on LinkedIn.

Data Protection: This data is hashed (anonymised) and aggregated, meaning it does not personally identify individual users.

Legal Basis for Processing:

• Consent (Article 6(1)(a)) – We obtain your consent for the use of cookies and tracking technologies via our cookie consent banner.
• Legitimate Interests (Article 6(1)(f)) – We may analyse aggregated, non-identifiable data to enhance website performance and marketing strategies, ensuring minimal impact on user privacy.

LinkedIn members can manage their advertising preferences through their LinkedIn settings. For more details on LinkedIn’s data policies, visit LinkedIn's Privacy Policy.

Hotjar

We use Hotjar on our website(s) to better understand how our users interact with our services, our users’ needs, and to optimise our services and user experience. Hotjar allows us to visualise user interactions that help us better understand our users’ experience to improve our services by identifying issues and friction points. It is also a voice-of-customer and user insight technology service that enables us to improve our services with our user feedback (survey, or poll responses, session data).  

To provide these services, Hotjar uses first-party cookies and other technologies to collect personal data on our users’ behaviour, and their devices on our behalf. This may include personal data like online identifiers (e.g. device's IP address, user ID), identification data (e.g. name, email address, only if we explicitly collect it), technical data (e.g. device type and screen size, browser information), geographic location (country only), behavioural data (interactions with our website/app such as clicks, taps, scrolls), and any additional personal data that may explicitly submitted through Hotjar. Hotjar may reuse this personal data to develop and improve tools and services for us and our users.
For further details, please visit Hotjar’s Trust Portal and Privacy Policy.

Opting Out
If you do not wish your data to be used in this way, you have the right to opt-out. Please contact us at dataprivacy@wolseyhalloxford.org.uk to opt-out.

Recipients of personal data

We may disclose your personal information:

• If we are under a duty to do so to comply with any legal obligation;
• In order to enforce or apply our terms and other agreements;
• To protect our rights or property;
• To protect the safety of our clients including with healthcare, social and welfare advisors and with central and local government.

If we sell, transfer, or merge our business or assets in future and, as a result, share your data with other parties, they may use your data in the same way as set out in this notice. If your data becomes subject to a different privacy notice, we will contact you in advance.

Lawful basis for processing

The law on data protection sets out several different reasons for which a company may collect and process your personal data, including:

1. To fulfil our contractual obligation to you under Article 6(b) ‘performance of a contract’ in order to:
   • Provide our courses and services.
   • Process your payments. 
2. For our legitimate business interest under Article 6(f) ‘legitimate interest’:
   • Understand how our courses and services are used, so that we may develop and improve them.
   • Understand how our website is used, so as to optimise its performance.
   • Keep system logs for operation and maintenance purposes.
   • Keep our systems secure.
3. Under Article 6(a) ‘consent’:
   • Send marketing information by email, as requested with your consent, to promote our services.
4. Under Article 6(c) ‘legal obligation’:
   • Keep such records as we are required to do by Law.

Sensitive personal information such as religion, race, ethnicity, political beliefs or health information such as learning abilities is classed as Special Category Data under the GDPR. Our legal basis for processing is our legitimate interest which is to provide you with advice and guidance in relation to a course application or during the course of studies, or to use the Support for Learning services where you have provided this information for this limited purpose.

Under Article 9 Paragraph (g) of the UK GDPR for processing special category data, we may store special categories of sensitive data such as race, ethnicity, religious beliefs or health, where provided to us as relevant to your or your child’s studies. More specifically, under Article 9(2)(g) of the UK GDPR and Condition 17 of Schedule 1 of the UK Data Protection Act 2018, we may process special category personal data (such as health or well-being data) for reasons of substantial public interest, where the processing:

• (a) Is necessary to provide confidential support services – including mental health counselling, pastoral care, safeguarding support, or well-being interventions.
• (b) Must be carried out without the consent of the data subject for one of the reasons listed below.
• (c) Is necessary for reasons of substantial public interest, such as protecting the welfare of students and ensuring their safety.

Processing can take place without explicit consent from a student or their parent/guardian if one of the following applies:

1. The student is unable to give consent due to their circumstances (e.g., age, capacity, or vulnerability).
2. It is unreasonable to expect the organisation to obtain consent – for example, if seeking consent would create unnecessary delays or barriers to providing essential support.
3. Obtaining consent would undermine the service – for instance, if asking for consent might discourage a student from accessing mental health or safeguarding support.

To ensure student privacy and data security, we implement the following safeguards:

• Strict confidentiality: Only authorised staff involved in providing support services will have access to the data.
• Secure storage: Personal data is securely stored on protected systems, with access restricted to relevant personnel.
• Data minimisation: Only the necessary personal data is collected and processed.
• Purpose limitation: Data will only be used for the specific support service provided and will not be shared for unrelated purposes unless legally required.

Your rights

You have the following rights over the processing and use of your personal data. To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this privacy policy. If you have authorised a third party to submit a request on your behalf, we will ask them to show that they have your permission to act.

Withdrawing your consent: Where you have given us your consent to use your personal data, you have the right to withdraw your consent at any time by writing to us at the email address below. You may withdraw your consent to marketing emails by contacting us at the email address below and we must always comply with your request.

Access to your data: Please contact us at the email address below if you want us to tell you about any data we hold about you or to request a copy by making a Subject Access Request.

Correcting your data: Please contact us at the email address below if your data is incorrect, out of date or incomplete and we will take reasonable steps to correct it.

Restricting use of your data: You have the right to object to our use of your personal information where we are relying on our legitimate interest to process it. If you object, we must stop processing it unless we believe we have a legitimate overriding reason to do so. You have the right to ask us to delete your personal information. We may need to keep your data due to a legal obligation but may be able to restrict the use of your data so that it may only be used for legitimate reasons such as legal claims. In this situation, we would not use or share your information in other ways while it is restricted. If you want to object to how we use your data or ask us to delete it or restrict how we use it, please contact us at the email address below.

Portability: Where we are processing information that you have provided to us with your consent or to fulfil a contract with you, you have the right to ask us for a copy to be sent to you or another organisation in a format that can be easily reused. Please contact us to request this at the email address below.

Data retention

We retain personal information we have collected for as long as necessary to fulfil the purposes of providing the services you have purchased and for our legitimate business needs to respond to any questions or complaints and to maintain our business records as required by law. When we no longer have a legitimate business need to process your personal information, we will delete or anonymise it. If this is not possible (for example, because your personal information has been stored in backup archives) we will prevent any further processing and store it securely until deletion is possible. Our learning management system partner Instructure will keep all student and parent observer information they have processed for as long as we have an account with them and you may request a copy of this at any time; it may be deleted on request. Each data controller with whom we work will keep information according to their own retention schedules. You can check their privacy policies at the links provided above.

International transfers

We may transfer personal data that we collect from you to our third-party data processors in countries that are outside the European Economic Area (EEA) such as the USA or New Zealand. Your data will be stored securely and under the same protection as data processed within the EEA.

Withdrawal of consent and the right to lodge a complaint

If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. If you change your mind or have concerns about how we use your personal data, please contact us as soon as possible using the details provided below.

If you have any complaints or requests for further information regarding this privacy notice, please contact us by email, phone, or in writing, and we will make every effort to address your concerns quickly and fairly.

If you are not satisfied with our response or have ongoing concerns about how your data is being handled, you have the right to lodge a complaint with the Data Protection Authority in your country of residence.

For the UK, this is the Information Commissioner’s Office (ICO):
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Phone: 0303 123 1113 
Website: Information Commissioner’s Office