Privacy notice
Privacy notice
This notice explains how Oxonia Academy uses personal data, when we decide how it is used and when your university does, and the rights you have.
1. Who we are
Last updated: 10 October 2026.
In our legal documents, "Oxonia Academy", "Oxonia", "we" and "us" mean Oxford City Academy for Education and Development (OAED), of which Oxonia Academy is part. Its registered office is [Registered office address]. Oxonia Academy is part of Oxford City Academy for Education and Development (OAED), registered in England and Wales, company number 05216710, established 2004, Oxford.
Our data protection contact is privacy@oxonia.ai. [Data protection officer: name, or confirm that no DPO is appointed]. Our registration with the UK Information Commissioner's Office (ICO) is [ICO registration number]. Our representative in the European Union under Article 27 of the EU GDPR is [EU representative: name and address].
This notice is written to meet the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the EU GDPR. People in other countries we serve have extra rights, set out in our regional privacy addenda.
2. Our two roles
We play two different roles, and the role decides who you should ask about your data.
| Role | When it applies | Who decides how the data is used |
|---|---|---|
| Processor | Data about students, staff, examiners, Council members, researchers, guardians, sponsors and alumni that a university puts into Oxonia products, such as recordings, coursework, marks, minutes and fees | The university (the controller). We act only on its instructions, under our data processing agreement. |
| Controller | Visitors to oxonia.ai, people who book a demo or contact us, conference and event leads, the contacts who manage a university's contract, billing and support, and security records about our own systems | Oxonia Academy, under this notice |
If you are a student or member of staff, your university's own privacy notice is the main notice for you. Our student privacy notice explains how Oxonia products handle your data in plain words.
3. What we collect
- Website visits. Technical data such as your IP address, browser, device and the pages requested, kept in server logs. We do not use analytics or advertising cookies. See the cookie policy.
- Demo and contact requests. Your name, work email, role, university, country, the size of your institution, the suites you are interested in and anything you tell us.
- Conference and event leads. The details you give on our event form. See the conference and lead privacy notice.
- Questions to the site assistant. What you type into the Oxonia Ai chat on our website.
- Customer contacts. Names, roles and work contact details of people who manage a university's contract, billing, support and security.
- Billing. Invoices, payment records and purchase orders. Card details are handled by payment providers and we do not see full card numbers.
- Support and complaints. What you tell us when you ask for help or complain.
- Security records. Sign-in events, audit logs and abuse reports about our own systems.
We collect most of this from you. We may get customer contact details from your colleagues at your university, and limited public information about institutions from their websites. We do not ask for special category data, such as health information, on our website.
4. Why we use it and our lawful bases
| Purpose | Lawful basis (UK and EU GDPR) |
|---|---|
| Arranging and running demos, pilots and quotes | Steps at your request before a contract (Article 6(1)(b)), or our legitimate interests in answering enquiries (Article 6(1)(f)) |
| Providing, billing and supporting the Services for a university | Contract (Article 6(1)(b)) with the university, and our legitimate interests in managing the relationship with its contacts |
| Contacting conference and event leads about their enquiry | Consent (Article 6(1)(a)), which you can withdraw at any time |
| Sending news about Oxonia by email | Consent, or for work emails to existing customer contacts, our legitimate interests with a simple opt-out, as PECR allows |
| Answering questions in the site assistant | Legitimate interests in helping visitors understand our products |
| Keeping our website and Services secure, and preventing abuse | Legitimate interests, and legal obligation where security law applies |
| Accounts, tax and legal claims | Legal obligation (Article 6(1)(c)), and legitimate interests in defending claims |
| Handling your data rights requests and complaints | Legal obligation |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for that assessment, and you can object at any time.
5. Who we share it with
We share personal data only where needed:
- Service providers who host our systems, send email, deliver messages, process payments and power AI features, under contracts that bind them to our instructions. They are named on our sub-processors page.
- Other companies in the OAED group, where needed to run the business.
- Professional advisers, such as lawyers, auditors and insurers.
- Authorities, where the law requires it. We check every request and share only what is lawfully required.
- A buyer of all or part of our business, under confidentiality terms.
We do not sell personal data, and we do not share it for advertising.
6. International transfers
We are based in the UK and serve universities in the UK, the EU, Nigeria, Ghana, Kenya, South Africa, the Gulf, Malaysia and Turkey. Some of our service providers process data in other countries, including the United States.
When personal data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. When it leaves the European Economic Area, we rely on an EU adequacy decision or the EU standard contractual clauses (SCCs). We add further safeguards, such as encryption, where a transfer risk assessment calls for them. Other countries' transfer rules are covered in the regional privacy addenda. You can ask for a copy of the safeguards at privacy@oxonia.ai.
7. How long we keep it
| Data | How long |
|---|---|
| Demo, contact and conference enquiries | 24 months after our last contact, unless a contract follows |
| Email news subscribers | Until you unsubscribe, then only a suppression record so we do not email you again |
| Site assistant questions | Up to 30 days in logs, then only counts that do not identify you |
| Website server logs | 90 days |
| Support tickets | 36 months after the ticket is closed |
| Customer contract and billing records | The contract term plus 6 years |
| Data rights requests and complaints | 6 years after they are closed |
Data we process for a university is kept for as long as the university decides, and deleted as set out in the data processing agreement.
8. Your rights
Under UK and EU data protection law you have the right to:
- be told how your data is used (this notice);
- get a copy of your data (access);
- have inaccurate data corrected (rectification);
- have your data deleted in some cases (erasure);
- limit how we use it in some cases (restriction);
- get data you gave us in a reusable format, where we rely on consent or contract (portability);
- object to our use of it where we rely on legitimate interests, and object at any time to direct marketing;
- withdraw consent at any time, without affecting what we did before; and
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects.
To use any right, see Data requests or email privacy@oxonia.ai. We reply within one month, which can be extended by up to two more months for complex requests, and we will tell you if it is. It is free unless a request is clearly unfounded or excessive. We may ask you to confirm your identity.
If your request is about data a university put into Oxonia, we will pass it to the university, as the controller, and help it reply.
9. Automated decisions and AI
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. In Oxonia products, AI features draft and suggest. A named person at the university approves anything that becomes an official record, including marks, progression evidence, minutes and policies, and can change or reject the draft. See How AI drafts are approved and the responsible AI policy.
We do not use your personal data to train AI models. The site assistant on our website answers from our published product information and does not make decisions about you.
10. Children and students
Our website and our sales activity are for adults working in or with higher education, and are not aimed at children. Some students who use Oxonia through their university may be under 18. Their university decides how their data is used, and we support it in giving them the extra care the law expects, including the ICO's Age Appropriate Design Code where it applies. Students should read the student privacy notice.
11. Security
We protect personal data with measures that include encryption in transit and at rest, role-based access, two-step sign-in for administrators, audit logs and tested backups. No system is perfectly secure. If you think you have found a weakness, see Vulnerability disclosure. More detail is in the security overview.
12. Complaints
Please tell us first at privacy@oxonia.ai so we can try to put things right. You also have the right to complain to a data protection authority:
- United Kingdom: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint.
- European Union: the authority in the country where you live or work, or where the issue happened.
- Other countries: see the regional privacy addenda.
13. Changes and contact
We will update this notice when our use of personal data changes, and will tell customer contacts about significant changes. Privacy questions and requests: privacy@oxonia.ai. Post: Data Protection, Oxonia Academy, [Registered office address].
Related