The Data Protection Act 1998 (DPA) regulates the processing of personal data. Personal data is any information relating to a living individual, and 'processing' is any activity carried out involving personal data, including holding and storing it. On 25th May 2018 the DPA was superseded in the UK by the General Data Protection Regulation (GDPR), which provides individuals with enhanced rights, and imposes increased responsibilities on organisations processing personal data. This policy applies under both the DPA and GDPR.
This policy is effective from 25 May 2018.
- Oxford School of Drama may obtain, hold and process the personal data of applicants, students and graduates including personal details, family and social circumstances, education and training records, financial details, and services provided. It may obtain, hold and process the sensitive personal data (the term used by the DPA) and special category data (the term used by GDPR) of applicants, students and graduates including ethnic origin and physical and mental health.
- Personal and special category data held by the School relating to applicants, students and graduates is obtained directly from applicants, students and graduates or from a third party organisation involved in the services provided by the School that has obtained the information in the first instance, for example, the Student Loan Company.
- The School holds the personal and special category data of its applicants, students and graduates in order to implement and manage all of the processes relating to potential students, students and graduates, including admission application, teaching, assessment, funding obligations and any student support services. The data is collected and processed by the School as it is necessary for the performance of its contract and/or legal obligations with accrediting and funding organisations, for example the Education and Skills Funding Agency. Any processing will be proportionate and relate to the provision of services by the School. When this data is used for monitoring and reporting purposes it will be anonymised if possible.
- The School may disclose student’s personal and special category data to external agencies to which it has obligations such as Ofsted, the Education and Skills Funding Agency, Trinity College, London and the Student Loan Company.
The School also uses students and graduates personal data as follows:
- To provide progress reports to sponsors of students, including trusts and foundations;
- To provide references for students or graduates, always with the consent of the student;
- To provide suggestions for casting or other work from industry professionals;
- To publish the names of students in production programmes and the graduating showcase programme;
- To disclose information about students and graduates for the purpose of promoting the School, but only if that information is already in the public domain or otherwise with the consent of the student or graduate;
- To disclose information to external organisations for safeguarding purposes.
Individuals who personal data and special category data is held by the School have the following rights regarding their data:
- The right to request access to their personal data held by the School;
- The right to have inaccurate or incomplete data rectified;
- The right to erasure of personal data – this will only apply where there is no legitimate reason for the School to continue to process the personal data. There will usually be a requirement for the School to keep a basic record indefinitely;
- The right to data portability – students and graduates have the right to request some elements of their data in order to provide it to other organisations;
- The right to lodge a complaint with the Information Commissioner’s Office; further details can be found at www.ico.org.uk
All requests to exercise these rights should be made to the Data Protection Manager, Oxford School of Drama, Sansomes Farm Studios, Woodstock, OXON, OX20 1ER.
Retention of data
All personal data on audition applicants who are not offered a place will be deleted at the end of the academic year for which the application was made.
Students and Graduates
A basic student record for individual students will be kept permanently by the School. More detailed records, including personal and special category data will be held by the School for 10 years after graduation year.
Any processing for archiving or statistical purposes shall be proportionate and respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect.
Our secure socket layer software (SSL) is the industry standard and among the best software available today for secure commerce transactions. It encrypts all personal information including credit card numbers, names and addresses. This encryption has the objective of ensuring that nothing can be read as it travels over the Internet to our chosen fully PCI DSS compliant payment service providers https://worldpay.com/ for processing.
Oxford School of Drama will report any unlawful data breach of its database to all relevant persons and authorities within 72 hours of the breach if it is apparent that personal data stored in an identifiable manner has been stolen.
Oxford School of Drama is the data controller for all personal data that it holds. If you are unhappy with the School’s handling of your personal data, or if you believe that the requirements of the GDPR may not be fully complied with by the School, please contact the Data Protection Officer.
If you have any queries please contact the:
Data Protection Manager
Oxford School of Drama
Sansomes Farm Studios