OxRES is committed to protecting and respecting your privacy.

This Privacy Notice sets out how OxRES collects, uses, maintains and discloses Personal Data, including any information provided through our website(s) (the "Website").

Your privacy is of the utmost importance to us. Please read this Privacy Notice carefully to understand our views and practices regarding your Personal Data and how we will treat it.

Whenever you provide Personal Data, we are legally obliged to use it in accordance with the laws concerning the protection of Personal Data.

WHO WE ARE

OXFORD REAL ESTATE SOCIETY is a company incorporated and registered in England and Wales with company number 10584247 whose registered office address is 15-17 Church Street, Stourbridge, West Midlands, England, DY8 1LU ("OxRES").

For the purposes of the Data Protection Act 1998, the General Data Protection Regulations and any other applicable data protection and privacy laws and regulations ("Data Protection Legislation"), OxRES will be the 'data controller' for all Personal Data that we determine the means and purpose of processing. By "Personal Data" we refer to information collected or held by OxRES, that identifies and relates to you as an individual.

INFORMATION WE MAY COLLECT

We will be required to collect Personal Data about you in the following circumstances.

When you register with us as a member

When you register as a member of OxRES, we require Personal Data to create a membership account for you and provide you with our service offerings. This information will often include, your name, email address, professional details such as your current place of employment and role and which Oxford University college, degree and matriculation year you were part of.

We may collect additional information you volunteer to us in contacting our committee members regarding any elements of the membership service. We will only retain the Personal Data pertinent to delivering your services.

We will retain your Personal Data for as long as you are a member of OxRES and will delete this data on termination of your membership or receipt of any objections you make under the terms detailed in "Your rights under data protection law", where we do not have an alternative legal ground or overriding reason to continue processing your Personal Data.

When you have signed up to our mailing list:

If you have opted in to our mailing list, we will handle your Personal Data (your name, email address, professional position and Oxford University details detailed in the section above) to provide you with marketing communications and newsletters regarding our society in line with any preferences you have told us about.

When we send you marketing emails, we rely on your consent to contact you for marketing purposes. Every email we send to you for marketing purposes will also contain instructions on how to unsubscribe from receiving them.

You are not under any obligation to provide us with your Personal Data for marketing purposes.

You can tell us that you do not want your Personal Data to be processed in this way at any time by contacting us at info@oxres.org or, where relevant, by following the unsubscribe link shown in every marketing communication you receive from us. We will retain your data for as long as we have your consent and delete your Personal Data used for marketing purposes, as soon as you withdraw your consent or unsubscribe from our newsletters and marketing information.

When you register for our events:

If you choose to register as a delegate at one of our OxRES events we will need to collect your name, email address, professional details such as your current place of employment and role and which Oxford University college, degree and matriculation year you were part of.

We use this information to run the particular event that you have signed up to attend. We will hold your data for as long as you have consented to us doing so. You can withdraw this consent at any time as detailed in the sub-section headed "Right to withdraw consent".

When you visit our website:

We may also collect technical information about you when you visit the Website. This information may include the Internet protocol (IP) address used to connect your computer to the Internet, your browser type and version, time zone setting, operating system and platform, browser plug-in types and version, the full URL clickstream to, through and from the Website, page response times, download errors, length of visits to certain pages, page interaction (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page.

The collected information is used to provide an overview of how people are accessing and using the Website. It is not used for any additional purpose, such as to profile those who access the Website.

What we don't collect:

Card payment details taken for membership fees are processed and managed via Stripe. Further details regarding Stripe can be found at https://stripe.com/gb. Card payment details for OxRES events are taken by Eventbrite, further details regarding Eventbrite can be found at https://www.eventbrite.co.uk/ .OxRES do not hold any card detail information as part of the Personal Data we handle on your behalf.

LEGAL BASIS OF PROCESSING

We will only process your information for as long as we have a relevant legal basis to do so. Unless stated above in "Information we may collect" this is in order to provide you with the contractual services you have requested from OxRES or if you have provided us with adequate consent to process your information for other purposes.

If we choose to process your information under the legal basis of legitimate interests, we will always inform you of our legitimate business interest and your right to object.

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at info@oxres.org.

PROTECTING YOUR INFORMATION

We are committed to ensuring that your information is secure and we have procedures in place to try and prevent any unauthorised access or disclosures and to safeguard and keep secure the information that we collect online.

All the Personal Data collected by us and stored electronically is held on a secure server in the EEA only. Where required, this information is encrypted for additional security. We use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorise access to Personal Data only for those committee members who require it to carry out the society's functions.

However, you should be aware that providing information over the internet can never be guaranteed as being completely safe and if you choose to send such information to us via the internet, you do so at your own risk.

TRANSFER OF DATA OUTSIDE OF THE EU

We shall not transfer any Personal Data to any country outside of the European Economic Area unless we ensure that such Personal Data is subject to an adequate level of protection and appropriate legal safeguards in accordance with Data Protection Legislation.
Stripe, Stunning and Eventbrite are contracted as processors by OxRES and process and store information on servers outside of the EU. This transfer is safeguarded via the EU-U.S Privacy Shield Framework. For more information please see https://stripe.com/gb/privacy and https://www.eventbrite.co.uk/support/articles/en_US/Troubleshooting/eventbrite-privacy-policy?lg=en_GB

SHARING YOUR INFORMATION WITH OTHERS

Please be assured that we will not share your information for any other reason unless we are required by law or permitted to do so under this Privacy Notice. The main circumstances in which we will be permitted or required to disclose this is by law will be by court order, to government bodies and law enforcement agencies. We may also use carefully selected sub-processors to help us collect, store or manage your information. This will always be managed under the terms of a written data processing agreement.

YOUR RIGHT TO OBJECT UNDER DATA PROTECTION LAWS

You have the right to object to us handling your Personal Data when:
" we are handling your Personal Data based on our legitimate interests. If you ask us to stop handling your Personal Data in this way, we will stop unless we can show you that we have compelling grounds as to why our use of your Personal Data should continue; or
" we use your Personal Data for marketing purposes. If you ask us to stop handling your Personal Data on this basis, we will stop.

YOUR RIGHTS UNDER DATA PROTECTION LAW

You can exercise the following rights to your data by contacting us at info@oxres.org. We will only take instructions from you or your legal representative to effect or to alter a policy and we will protect your privacy when you contact us by asking specific and relevant questions to make sure we are speaking to you or your legal representative and not to an unauthorised person.

Right of access
You are entitled to receive confirmation as to whether your Personal Data is being processed by us, as well as various other information relating to our use of your Personal Data. You also have the right to a copy of the Personal Data which we are handling regarding you.

Right to rectification
You have the right to require us to rectify any inaccurate Personal Data we hold about you. You also have the right to have incomplete Personal Data we hold about you completed, by providing a supplementary statement to us.

Right to restriction
You can restrict our processing of your Personal Data where:
" you think we hold inaccurate Personal Data about you;
" our handling of your Personal Data breaks the law, but you do not want us to delete it;
" we no longer need to process your Personal Data, but you want us to keep it for legal reasons; or
" we are handling your Personal Data because we have a legitimate interest you and are in the process of objecting to this use of your Personal Data.

Where you exercise your right to restrict us from using your Personal Data, we will then only process your Personal Data when you agree, except for storage purposes and to handle legal claims.

Right to data portability
You have the right to receive the Personal Data we hold about you in a structured, standard machine readable format and to send this to another organisation controlling your Personal Data.

Right to erasure
You have the right to require us to erase your Personal Data which we are handling in the following circumstances:
" we no longer need to use your Personal Data for the reasons we told you we collected it for;
" where we needed your consent to use your Personal Data and you have withdrawn your consent;
" you object to our use of your Personal Data and we have no compelling reason to carry on handling your Personal Data;
" our handling of your Personal Data has broken the law; or
" we must erase your Personal Data to comply with a law we are subject to.

Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your Personal Data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact info@oxres.org. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Right to complain
You have the right to issue a complaint directly with the Information Commissioners Office, the data protection supervisory authority for England and Wales (https://ico.org.uk/concerns/).

CHANGES TO THIS PRIVACY NOTICE

We may change this Privacy Notice at any time to ensure it always accurately reflects the way we collect, use and safeguard your Personal Data.

Please check this notice from time to time to ensure you are aware of any updates we may have made to our Personal Data handling practices. The date of the changes will be listed in the 'Last updated' section below. We will endeavour to notify all of our current clients of any updates to this notice via email and we will post the relevant announcement on our website homepage.

We recommend that you print a copy of this page for your reference.

HOW CAN YOU MAKE A COMPLAINT?

Please note that if you are not satisfied with the processing of your Personal Data as set out in this Privacy Notice, please contact us at info@oxres.org.

You have the right to issue a complaint directly with the Information Commissioners Office, the data protection supervisory authority for England and Wales (https://ico.org.uk/concerns/).

CONTACTING US

Please contact us at info@oxres.org if you have any questions, comments or requests regarding this Privacy Notice.

Last updated May 2018