1. About this privacy notice
The purpose of this privacy notice is to explain how the University of Oxford ('the University', 'we', 'our', 'us') holds and uses personal data on external academics and researchers who will be working on collaborative research projects, on administrative support staff at other institutions who provide support to their academics and researchers, and on external contacts at funders ('you'). The personal data are collected and input into X5, the University’s costing and pricing tool and used for the purpose of costing externally funded research projects as part of grant application, contract negotiation and award set up processes.
The University of Oxford encompasses the University's central and international offices (North America, China and Japan), academic departments, gardens, libraries, and museums. Please see the University's privacy notices relating to other activities and relationships.
2. Information we collect
We, the University, collect information directly from you or from administrative support teams at other institutions during the grant application and contract negotiation processes.
The amount of data we collect and hold depends on the type of research project, whether it is collaborative with external institutions and whether additional contact information is needed from an external funder. We may hold the following types of personal data about you:
Name, title, contact details (both telephone and/or email addresses).
3. How we use your data
An X5 costing is created for all externally funded research projects and different costing types may be created during the life-cycle of a research project. Where the research project is collaborative and involving co-applicants from other institutions, we will record the co-applicants’ names and titles and their project costs. We may record their contact details. This will allow us to see individual project costs per institution and the total combined project costs. These data are needed for input into online grant application forms or to form the basis of a contract negotiation. We may also hold data on administrative staff at the other institutions where they are supporting the co-applicants and involved in the costing process for their institutions. Data may be held on administrative contacts at funders where they have been contacted for help and advice on the specific grant application or contract negotiation. When a collaborative award has been made, or a contract successfully negotiated and where Oxford is responsible for disbursing funds to the other institutions, the name and title of the co-applicant and their budget are transferred to the Oracle Financials system either via the X5–Oracle R12 interface or manually input from an X5 output by the Research Accounts team in the Finance Division, who are responsible for award set-up and management on Oracle Financials.
We also use the data on external collaborators for operational and management reporting.
4. When and how we share your data
We do not share the data within the collegiate University or with third parties.
5. How we protect your data
The University takes precautions to safeguard your personal information against loss, theft and misuse, unauthorised access, disclosure and destruction through the use of appropriate administrative, physical and technical security measures.
Our costing and pricing tool X5 is hosted on infrastructure within the University's network and is protected by logical access controls. Access is limited to individuals who need to see and use the data to carry out their duties, and access rights are restricted according to individual job roles in order to ensure that users only see information that is relevant to them. All X5 users who create costings are asked to read and sign the X5 individual user agreement that sets out the terms and conditions of access to the system.
6. How long we keep your data
We will only retain your data for as long as we need it to fulfil our purposes. Data will be anonymised according to the X5 data anonymisation schedule. We keep anonymised data indefinitely, but you cannot be identified from such data.
7. The legal process for processing your data
We will only use your personal data where the law allows us to do so. Most commonly we rely on the following legal base for processing your personal data:
Where we have a legitimate interest to do so for purposes listed within this privacy notice. Where we use legitimate interest as the basis for our processing we have carefully considered each of the ways we process your data to ensure that we carry out our activities with a focus on the interests of you, and in the most efficient and effective way.
8. Your legal rights and choices in connection with your data
Under certain circumstances, by law you have the right to:
- Request access to your personal data (commonly known as a 'subject access request'). This enables you to receive a copy of your data and to check that we are lawfully processing it.
- Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
- Request erasure of your data. This enables you to ask us to delete or remove your data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
- Object to processing of your data where we are processing it to meet our public interest tasks or legitimate interests and there is something about your particular situation which makes you want to object to processing on this ground.
- Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your data to another party.
If you want to exercise any of the rights described above or are dissatisfied with the way we have used your information, please contact the University's Information Compliance Team at data.protection@admin.ox.ac.uk. The same email address may be used to contact the University's Data Protection Officer. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of GDPR. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office on the ICO website.
9. How to contact us
If you have any questions about this privacy notice or about your personal data, or if you want to provide updates to your data or exercise any of your rights as outlined above, please contact us at one of the following address:
X5 Support Team, IT Services
University Offices, Wellington Square
Oxford, OX1 2JD, United Kingdom
X5helpdesk@it.ox.ac.uk
+44 (0)1865 280089
