Your data, your rules

Data protection

Universities stay in charge of their students' and staff's data. This page explains how Oxonia supports that across the countries we serve.

Who is responsible for what

Last updated: 10 October 2026.

When a university uses Oxonia, it decides why and how personal data about its students and staff is used. It is the controller. Oxonia Academy processes the data on its behalf and on its instructions. It is the processor. The data processing agreement sets this out in contract.

We are the controller for our own website, marketing, event leads and customer contacts, as our privacy notice explains.

Laws we design for

We serve universities under the UK GDPR and the Data Protection Act 2018, the EU GDPR, the Nigeria Data Protection Act 2023, Ghana's Data Protection Act 2012, Kenya's Data Protection Act 2019, South Africa's Protection of Personal Information Act, Malaysia's Personal Data Protection Act as amended in 2024, Turkey's KVKK, and the personal data protection laws of the UAE and Saudi Arabia. The regional privacy addenda explain what is different in each. The platform helps universities meet their duties; it does not replace their own legal advice.

Principles built into the platform

Only what is needed. Each product uses the data it needs to do its job.
Clear roles. People see only the records their role allows. See Roles and permissions.
People decide. Marks, minutes and policies are approved by a named person, not by AI alone.
Traceable. Important actions are recorded in audit logs.
Where data lives. Universities can choose in-country hosting where it is available. See Data residency.

People's rights

Students and staff have rights over their data, such as the right to see it, correct it and, in some cases, have it deleted. Requests usually go to the university first, as controller. Oxonia helps the university answer them, for example by finding and exporting a person's records. See Data requests and the student privacy notice.

AI and personal data

AI features process the content people give them, such as a lecture, an essay or an exam script, to produce drafts and answers. We do not use customer data to train AI models unless the university agrees in writing. The AI services we use are named on the sub-processors page, and the responsible AI policy sets out our commitments.

Sub-processors, transfers and contact

The companies that help us run the platform are listed on the sub-processors page, and we give 30 days' notice before adding one. Where data moves between countries, the data processing agreement sets out the safeguards, such as the UK IDTA and the EU standard contractual clauses.

Data protection questions: privacy@oxonia.ai. Students and staff should contact their own university first.

Data processing agreementWhen a university puts personal data about students and staff into Oxonia, it is the controller and we are its processor. This agreement sets out the rules we follow, as Article 28 of the UK and EU GDPR requires.Regional privacy addendaWe serve universities in many countries. These addenda add to our privacy notice and data processing agreement where local law gives extra rights or sets different rules.Sub-processorsLike most software services, Oxonia relies on other companies for some parts of the service. This page names them, says what they do and where, and explains how we tell universities about changes.