Oxford United in the Community – Website Privacy Notice 

1. Introduction

Oxford United in the Community understands that your privacy is important. This notice
explains how we collect, use and protect personal data when you visit our website,
contact us through it, sign up for updates, make a donation, register interest in our work,
or use linked online services connected to our website.
We are committed to using personal data lawfully, fairly and transparently, and to
protecting the rights of the people who interact with us online.
This notice applies to your use of the Oxford United in the Community website. It should
be read alongside any more specific privacy information we provide where you register
for programmes, make a donation, sign up for an event, apply to volunteer, or otherwise
engage with us through a separate process.

2. Who we are

Oxford United in the Community is a registered charity in England and Wales, charity
number 1125173.
Registered office: The Kassam Stadium, Grenoble Road, Oxford, OX4 4XP
For data protection purposes, Oxford United in the Community is the data controller for
the personal data covered by this notice.
ICO registration number: ZA125792
If you have any questions about this notice or about how we use your personal data,
please contact:
Email: [email protected]
Telephone: 01865 337515
Post: Oxford United in the Community, The Kassam Stadium, Grenoble Road, Oxford,
OX4 4XP
For the attention of the Data Protection Lead.

3. What this notice covers

This notice explains:
• how we collect personal data through our website;
• what types of personal data we collect;
• how and why we use it;
• our lawful bases for doing so;
• who we share it with;
• how long we keep it;
• whether it is transferred outside the UK; and
• your rights.
This notice applies only to Oxford United in the Community’s own website and website
related processing. Our website may contain links to third-party platforms and services,
including donation, booking, email subscription or event registration providers. Those
services have their own privacy information, and we encourage you to read it before
submitting your data.

4. Personal data we may collect

Depending on how you use our website, we may collect the following categories of
personal data:
• Identity data, such as your name and, where relevant, your child’s name if you
are completing a programme-related form.
• Contact data, such as your email address, postal address and telephone
number.
• Correspondence data, such as information you provide when you send us an
enquiry or otherwise contact us.
• Transaction or engagement data, such as information relating to donations,
bookings, registrations or newsletter subscriptions, where those actions begin on
or through our website.
• Technical and usage data, such as IP-related information, browser type, device
information, approximate location, pages viewed and cookie or similar
technology identifiers.
We do not generally intend to collect special category personal data through ordinary
website browsing or basic contact forms. However, some linked registration or
programme processes may require additional information, for example where health,
disability, accessibility or safeguarding-related information is necessary. Where that
happens, we will provide more specific privacy information relevant to that activity.

5. How we collect your data

We collect personal data in the following ways:
• when you browse and use our website;
• when you complete a contact form or otherwise send us a message;
• when you sign up for newsletters or updates;
• when you follow links from our site to make a donation, register for a programme
or event, or make a booking through a third-party provider;
• when you tell us that you are interested in volunteering, governance or other
involvement with the charity; and
• through cookies and similar technologies, where these are used on the site.

6. How we use your personal data

We use personal data collected through the website for the following purposes:
• to operate, maintain and improve the website;
• to respond to enquiries and messages;
• to administer registrations, bookings, donations or requests that begin through
the website;
• to send newsletters or updates where you have asked to receive them or where
we are otherwise permitted to do so;
• to understand how people use the website and improve the user experience;
• to protect the website and our systems from misuse or security threats; and
• to comply with legal or regulatory obligations.

7. Our lawful bases

Under the UK GDPR, we must have a lawful basis for processing your personal data.
Depending on the activity, we rely on one or more of the following:
• Consent, for example where you choose to receive newsletters or where non
essential cookies are used and you agree to them.
• Contract, for example where you ask us to provide a service, process a booking,
or administer a donation or registration.
• Legal obligation, where we need to process information to comply with legal or
regulatory requirements.
• Legitimate interests, where we use data in a proportionate way for legitimate
charity purposes, such as responding to enquiries, administering the website,
preventing
misuse, understanding engagement or improving our
communications, provided this does not override your rights and freedoms.
The ICO expects privacy notices to explain clearly what information is collected, why it is
used, and the lawful basis relied on.

8. Marketing and newsletters

If you choose to sign up for our newsletter or other updates, we may use your contact
details to send you information about Oxford United in the Community, including news,
events, fundraising, campaigns, programmes and other updates.
Where consent is required, we will ask for it. You can unsubscribe or opt out at any time
using the unsubscribe link in the email or by contacting us directly.
We do not send unlawful marketing or spam. Where we carry out email or similar
electronic marketing, we will do so in line with data protection law and the Privacy and
Electronic Communications Regulations.

9. Children’s information

Because some of our activities involve children and young people, we recognise that
children’s personal data requires particular care.
Where website journeys relate to children’s activities, registrations or enquiries, we will
take care to ensure that the information collected is appropriate, relevant and handled
with the necessary safeguards. In many cases, information will be provided by a parent
or carer rather than by a child directly.
Where a specific service or registration process involves children’s information, we may
provide additional privacy information relevant to that service.

10. Who we share your data with

We may share personal data with trusted third parties where this is necessary for the
operation of our website or connected services, or where you choose to use those
services through our website.
This may include website hosts or developers, email distribution providers, analytics
providers, donation platforms, booking systems and similar service providers.
Where a third party processes data on our behalf, we will take steps to ensure there is an
appropriate contractual and security framework in place.
Where a third party acts as a separate controller for its own service, for example a
donation or booking platform, its own privacy notice will also apply.
The current website-facing providers and linked services should be checked regularly so
that the notice always reflects the systems actually in use.

11. International transfers

Some website-related providers may process personal data outside the UK.
Where that happens, we will take steps to ensure your personal data continues to be
protected in line with UK data protection law. This may include relying on UK adequacy
regulations, approved contractual safeguards, or another lawful transfer mechanism.
We will not rely on a simplistic adequacy-only approach if another lawful transfer
mechanism is the correct one in practice. The ICO’s current guidance makes clear that
overseas processing can be lawful through adequacy, safeguards or limited exceptions,
depending on the circumstances.

12. Cookies and similar technologies

Our website uses cookies and similar technologies.
Some of these are strictly necessary for the operation of the site. Others may be used
for analytics, user preferences, performance monitoring or similar purposes.
Where consent is required for non-essential cookies or similar technologies, we will
request this through an appropriate cookie mechanism before they are set. You can
manage your preferences through the cookie settings available on the site and through
your browser settings.
We recommend that the cookie list used on the website is reviewed regularly so that this
notice matches the cookies and similar technologies actually in use.
The ICO’s current guidance is that PECR applies to cookies and similar technologies, and
that organisations should be clear about what they use and when consent is required.
The ICO has also updated draft guidance to reflect the changes made by the Data (Use
and Access) Act 2025.

13. How long we keep your data

We will keep website-related personal data only for as long as it is reasonably needed for
the purpose for which it was collected, and in line with our retention arrangements.
Different retention periods may apply depending on the type of information. For example,
enquiry data, newsletter records, website analytics, booking information and donation
related records may be retained for different periods depending on operational, legal,
regulatory or financial requirements.
Where data is no longer needed, we will delete or anonymise it securely where
appropriate.

14. How we protect your data

We take appropriate technical and organisational measures to protect personal data
collected through the website.
These measures may include access controls, secure systems, restricted permissions,
contractual controls with service providers, and procedures for handling suspected
personal data breaches.
No website or online service can be guaranteed to be completely secure, but we take
reasonable and proportionate steps to reduce risk.

15. Your rights

You have rights under data protection law, which may include the right to:
• be informed about how your data is used;
• access the personal data we hold about you;
• have inaccurate data corrected;
• ask for data to be deleted in some circumstances;
• ask us to restrict processing in some circumstances;
• object to processing in some circumstances;
• receive certain data in a portable format where this applies; and
• withdraw consent at any time where consent is the lawful basis.
If you want to exercise any of your rights, please contact us using the details above.

16. Complaints

If you have a concern about how we have handled your personal data, please contact us
first so that we can look into it.
We will take privacy concerns and complaints seriously and aim to deal with them fairly
and without undue delay.
You also have the right to complain to the Information Commissioner’s Office if you
remain dissatisfied.

17. Changes to this notice

We may update this privacy notice from time to time to reflect changes in law, guidance,
our website, our systems or the way we use personal data.
The latest version will always be available on our website, and the date of the latest
update will appear at the top of the notice.