Privacy and Cookie Policy for the Careers Service and Internship Office

The Careers Service and Internship Office at the University of Oxford is committed to respecting and protecting your privacy. This policy describes how we collect and use personal information about you if you use our services, participate in our programmes or visit our website, in accordance with the General Data Protection Regulation (GDPR). Our website contains links to various third party websites. Please note that these websites have their own privacy policies for which we do not accept any responsibility or liability. Please check these policies before you submit any personal data to these websites.

Who is using your data

The Careers Service and Internship Office at the University of Oxford is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy policy.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. We may update this policy at any time.

By visiting our website and using our services, you are accepting and consenting to the practices described in this policy.

Types of data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity element has been removed, did not exist (anonymous data) or the person is deceased.

We will collect, store, and use personal data when you correspond with us; subscribe to, or participate in, our programmes and services; register with our Virtual Fairs Platform*; use or enquire about our services and programmes; subscribe to newsletters and careers information; register on CareerConnect**; participate in discussion boards or other social media functions on our website; book places and/or participate in career-related events; enter a competition, promotion or survey; or when you report a problem with our website or service. We also collect personally identifiable information when you visit or register on the password-protected website (CareerConnect).

*Virtual Fairs Platform, is a system that enables students, employers and staff members to create profiles, upload information (such as but not limited to CVs, job opportunities, marketing content), present, and communicate.

**CareerConnect is a system that enables students, researchers and alumni, to use a range of career development services offered by the Careers Service and Internship Office. The system allows users to book appointment; browse opportunities, events, study and apply for opportunities; and setup a personalised dashboard for receiving notifications and communications from the Careers Service and Internship Office and third parties. The system also allows third parties (namely employers) to book events, advertise their own events, opportunities, and other career-related activities.

We may process the following “special category” of sensitive personal data:

Information about your health, including any disability and / or medical condition.

Data we collect about you

Contact information such as name, organisation, job title, college, email address, phone number, your organisation’s sector or details of the career sector/s you are interested in or work in, and details of which our services you have engaged with.
Any other identifiable information you share with the Careers Service via email, or chat applications. Such as CV’s, typed conversations during one-to-one consultations.
Careers Advisers may write notes following any careers consultation. Access to those notes is strictly limited to the Career Service staff who have legitimate interest in them for the purpose of carrying out their contractual obligations.
Information on how you have engaged with the Careers Service (e.g. participated in a Careers event, hosted an intern etc.)
A number of fill-in forms are provided on the Career Service’s website. Each form contains a link to our privacy policy.
If you visit our website, we will automatically collect certain technical information, for example, the type of device (and its unique device identifier) you use to access our website, the Internet protocol (IP) address used to connect your device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, mobile network information and platform.
We will automatically collect information about your visit to our website including the full Uniform Resource Locators (URL), clickstream to, through and from the website (including date and time), pages you viewed, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
When you visit our website we may also automatically collect technical information about your visit from your computer.

How we use your personal data

We will only use your personal data as the law allows. Most commonly, we will use your personal information in the following circumstances:

Where we need to fulfil the contract we have entered into with you (to provide you with products and services you have requested).
To customise the content you see on our website based on any preferences you have set on CareerConnect.
Where we need to contact you about careers information specific to your interests.
Where we have a legitimate interest to do so, for example to ensure that we understand who uses our website and how our website is used and to improve our website and ensure it is secure.
With your consent, we may send you information by email about the services and opportunities that may be of interest to you. Where consent is required for our use of your personal data, by ticking the appropriate consent box or otherwise communicating your consent (for example, by email or by providing us with non-mandatory information), you consent to our use of that personal data as set out in this policy. You can always withdraw your consent and we will stop any processing of your personal data with your consent. However, this will not affect the lawfulness of any processing carried out before your withdrawal of consent and you may no longer be able to use the website and services in the same way you did before.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Special Category data and Criminal Conviction data

Special category data and criminal conviction data require a higher level of protection than personal data. Listed below are examples of processing activities that we regularly undertake in respect of these types of data. In addition to the activities listed below, it may sometimes be necessary to process this sort of information for exceptional reasons, for example, because it is necessary to protect your vital interests (including in relation to health and safety) or those of another person or for safeguarding purposes.

Health (Including disability)

We will process data about your health where it is necessary to make reasonable adjustments for disability and / or to monitor equal opportunities. This includes our CareerConnect** Platform to make adjustments for appointments, programmes and events. We may also inadvertently process health data through your communication with the Careers Service via email and or other communication platforms. Via third party applications such as our Virtual Fair platform*.

Sharing your data

From time to time, we may share data within the university and with third parties working on our behalf. We will only do this in appropriate circumstances, by secure means and with the relevant data sharing agreements in place.

Sharing your data within the University of Oxford

We may share your data with colleges and departments that make up the collegiate university. We will only do this when necessary, to fulfil the universities commitments to you. Such as:

The Alumni Office

Sharing your data with third parties

We may share your personal data with GDPR-compliant third parties who provide services on our behalf, such as:

Group GTI - CareerConnect Service
Survey software – such as Weblearn, target feedback (Group GTI)
Virtual Fairs Platforms – such as Graduateland

We may also share your personal data with third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our website terms of use or to protect the rights, property or safety of our website, our users, and others.

Where information is shared with third parties, we will seek to share the minimum amount of information necessary to fulfil the purpose. All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Where third parties share information with sub processors to complete work on their behalf, we ask third parties to disclose the sub processors and what information they process. We will strive to make sure that sub processors are GDPR compliant, and that your information is secure throughout the processing workflow.

Where we store your personal data

We may store data collected manually or electronically. The data is stored on our secure servers and/or in our premises within the UK. Data is also transferred to our platforms such as our virtual fairs platform (in the EEA) and our careers management system (in the UK).

Where sub processors complete work on behalf of third parties, your data may be transferred to sub processors' platforms. These may well be outside the UK or the EEA. By submitting your personal data, you agree to this transfer and storing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Retaining your personal data

We will only retain your personal information for the minimum period required as set out below. We will only retain your personal information to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Student & Research staff information: + 3 years after last known interaction.
Student & Research staff careers intentions: end of relationship + 6 years.
Destination of Leavers from Higher Education survey (DLHE) / Graduate Outcomes: end of student relationship + 6 years.
Internship Placements: Indefinitely unless a deletion request is submitted, or when the company informs the Careers Service that a recruiter has left their employment.
Job Opportunities: Indefinitely unless a deletion request is submitted by the company or when the company informs the Careers Service that a recruiter has left their employment.

How we protect your data

The University of Oxford takes precautions to safeguard your personal information against loss, theft and misuse, unauthorised access, disclosure and destruction through the use of appropriate administrative, physical and technical security measures.

Our careers management system, CareerConnect: Is hosted and run by Group GTI on their infrastructure and is protected by access controls and log in restrictions. Access is limited to individuals who need to see and use the data to carry out their duties, and access rights are restricted according to individual job roles in order to ensure that user only see information that is relevant to them. All CareerConnect operators receive appropriate training before being granted access.
Our Virtual Fair Platform, GraduateLand: Is hosted and run by Graduateland on their hosted infrastructure and is protected by access controls and log in restrictions. Access is limited to individuals who need to see and use the data to carry out their duties, and access rights are restricted according to individual job roles to ensure that users only see information that is relevant to them. All Graduateland operators receive appropriate training before being granted access.

Transfers of your data outside of the European Economic Area (EEA)

Although most of the information we collect, store and process stays within the UK and the EEA, some information may be transferred to countries outside of the European Economic Area (EEA). This may occur if for example one of our suppliers servers are located in a country outside of the EEA. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data transmitted to the third party website and any transmission is at your own risk.

Transfers outside of the EEA will only take place if one of the following applies:

The country receiving the data is considered by the EU to provide an adequate level of data protection.
The organisation receiving the data is covered by an arrangement recognised by the EU as providing an adequate standard of data protection; e.g. transfers to companies that are certified under the EU-U.S. Privacy Shield.
The transfer is governed by approved contractual clauses.
The transfer has your consent.
The transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract.
The transfer is necessary for the performance of a contract with another person, which is in your interests.
The transfer is necessary in order to protect your vital interests or of those of other persons, where you or other persons are incapable of giving consent.
The transfer is necessary for the exercise of legal claims.
The transfer is necessary for important reasons of public interest.

Your rights

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact data.protection@admin.ox.ac.uk.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop. However, where you have consented to the processing (for example where you have asked us to contact you for marketing purposes) you can withdraw your consent at any time. If you choose to withdraw consent it will not invalidate past processing and it may impact our ability to provide particular additional services to you.

If you are not happy with the way that we have handled your personal data, please contact us. You also have the right to make a complaint to the Information Commissioner’s Office.

Cookies

The Careers Service website uses "cookies". A cookie is a small file of letters and numbers that we place on your computer or mobile device if you agree. These cookies allow us to distinguish you from other users of our website, which helps us to provide you with a good experience when you browse our website and enables us to improve our website.

Types of cookies we use

We use the following types of cookies:

Strictly necessary cookies: these are essential to enable you to move around the websites and use their features. Without these cookies, the services you have asked for, such as registering for an account, cannot be provided
Performance cookies: these cookies collect information about how visitors use a website, for instance which pages visitors go to most often. We use this information to improve our websites and to aid us in investigating problems raised by visitors. These cookies do not collect information that identifies a visitor
Functionality cookies: these cookies allow the website to remember choices you make and provide more personal features. For instance, a functional cookie can be used to remember the volume level you prefer to use when watching videos on our websites. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites
Targeting cookies: these cookies are used to deliver adverts more relevant to you and your interests. They collect information about your browsing habits. Targeting cookies are linked to services provided by third parties, such as 'like' and 'share' buttons and advertisements. We use targeting cookies to send third parties information on your visit so that they can make their advertising more relevant to you when you visit their websites

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them please visit www.allaboutcookies.org/.

Specific cookies we use

Cookies may be set either by the www.careers.ox.ac.uk or by a third party website. The tables below identify the cookies we use and explain the purposes for which they are used:

Google Analytics: These cookies are used to collect information about how visitors use our website. We use the information to compile reports and to help us improve the website. The cookies collect information in an anonymous form, including the number of visitors to the website, where visitors have come to the website from and the pages they visited.
Single Sign On: These cookies are used to direct you to the correct services on secure services. These work in conjunction with access control lists to allow or deny access dependant on your status. These are used by Group GTI and University websites for this function.

Changes to this policy

Any changes we may make to our Privacy and Cookie Policy in the future will be included in this policy document. Please check back frequently to see any updates or changes.

Contact

If you wish to raise any queries or concerns about this policy, please contact us at:

The Careers Service and Internship Office

hello@careers.ox.ac.uk

56 Banbury Rd

Oxford OX2 6PA

United Kingdom