Privacy Notice

1. WHAT IS THE PURPOSE OF THIS NOTICE?

The University of Oxford is committed to protecting the privacy and security of your personal information (‘personal data’).  

This privacy policy describes how we collect and use your personal data during your participation in UnityBC) in accordance with the UK General Data Protection Regulation (GDPR).  

It is important that you read this policy, together with any other privacy policy we may provide on specific occasions when we are collecting or processing information about you, so that you are aware of how and why we are using your information. We may update this policy at any time. 

2. GLOSSARY 

Where we refer in this policy to your ‘personal data’, we mean any recorded information that is about you and from which you can be identified. It does not include data where your identity has been removed (anonymous data). 

Where we refer to the ‘processing’ of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure or retention.  

3. WHO IS USING YOUR PERSONAL DATA? 

The University of Oxford (the University’s legal title is the Chancellor, Masters and Scholars of the University of Oxford) is the “data controller” for the information that we obtain from you or others as part of UnityBC. This means that we decide how to use it and are responsible for looking after it in accordance with the UK GDPR.  

Access to your data will be provided to designated members of our staff who need to view it as part of their work in carrying out the purposes set out in section 5. We also share it with the third parties described in section 6.  

4. THE TYPES OF DATA WE HOLD ABOUT YOU AND HOW WE OBTAINED IT 

We collect all information directly from you, when you complete the consent form and questionnaire via REDCap. This information includes your name and email address as well as your family background, health, recent breast cancer diagnosis and views on taking part in research.  

5. HOW THE UNIVERSITY USES YOUR DATA 

We will use the information you have given us on the UnityBC questionnaire to  

• assess the feasibility of establishing a diverse national cohort of women with breast cancer. 

• investigate the acceptability of participating in health research among women from different backgrounds.  

The legal basis for the processing of your personal data for UnityBC is that it is ‘a task in the public interest’ (Article 6(1)(e) UK GDPR). In addition, a required condition under the UK GDPR to process your special category (sensitive) personal data is met as it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 9(2)(j) UK GDPR).  

We will only process your personal data for the purposes for which we collected it. We do not use your personal data for any form automated decision making or public profiling.  

Please note that we may process your data without your knowledge or consent, in compliance with the above rules, where this required or permitted by the law.  

6. WHO HAS ACCESS TO YOUR DATA? 

Access to your data within the University will be provided to those who need to view it as part of their work in carrying out the purposes described above.  

In order to perform our research and other legal responsibilities or purposes, we may, from time to time, need to share your information with the following:  

• collaborating research organisations working with us 

• external organisations providing services to us, and 

• external regulatory bodies.  

All our third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.  

7. TRANSFER OF YOUR DATA OUTSIDE OF THE EUROPEAN ECONOMIC AREA (EEA) 

Your data is stored on our secure servers and/or in our premises within the UK. It will not be transferred to anyone outside the UK.  

8. RETENTION PERIOD 

All research data and records will be stored securely on servers within the Medical Sciences Division and Nuffield Department of Population Health at the University of Oxford. These data and records will be stored for up to 5 years after the last participant enters the study. We may also retain personal data for further research for which a legal basis exists, but this will always be done in accordance with data protection laws. 

9. SECURITY 

Your data will be held securely in accordance with the University’s policies and procedures. Further information is available on the University’s Information Security webpages.  

10. YOUR RIGHTS 

Data protection regulation provides you with control over your personal data and how it is used. When your information is being used in research, however, some of those rights may be limited in order for the research to be reliable and accurate. Further information about your rights with respect to your personal data is available on the Oxford University Compliance webpages.  

If you want to exercise any of the rights described above or are dissatisfied with the way we have used your information, please contact the University’s Information Compliance Team. The same address can be used to contact the University’s Data Protection Officer. If you remain dissatisfied, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). A complaint to the ICO can be made by visiting their website or by calling their helpline on 0303 123 1113.  

11. CHANGES TO THIS POLICY 

We reserve the right to update this privacy notice at any time, and will seek to inform you of substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.