Personal Data, Conduct & Privacy Policies

Published 26/06/2026

1. About this privacy notice

The Rhodes Trust is the data controller for the personal data described in this notice.

The purpose of this privacy notice is to explain how the Rhodes Trust ("the Trust", "we", "our", "us") processes personal data contained within Rhodes Scholarship applications and how it will be used, distributed, stored, and destroyed. The Rhodes Trust includes the central offices at Rhodes House in Oxford, our National Secretaries, and our selection committees.

If you have questions about this notice or how we process your personal data, you can contact our Data Protection Officer using the details in Section 12.

2. What we do

We administer the selection process for the Rhodes Scholarship, in order to support selection the Rhodes Trust holds personal records on those who apply for the Rhodes Scholarship.  

The overarching purpose of collecting and processing your data is ensure that the selection process is fair and balanced, giving our selection committees the best possible starting point for choosing the best possible candidates. 

If at any point you have questions about our privacy notice, or how we are using your data, please contact us. 

3. The data we collect about you

We collect most information directly from you. We also collect information from your nominated referees and, where necessary, may verify information you provide using official documents submitted as part of your application. 

Certain information is required to assess eligibility and process your application. If you do not provide required information, we may be unable to consider your application. 

The data we collect about you include: 

• Biographical information, which may include: 

  • Contact details and residential address.

  • Education and employment history (including scanned / digital exam transcripts and degree certificates)

  • Scans of identification and nationality / residency documents (e.g. passport, birth certificate, certificate of legal permanent residency)

  • Personal data (date of birth, gender, nationality, birthplace, residency timeline)

  • Nationality of parents / guardians 

• Rhodes personal statement (essay) plus study intentions.

• Photograph

• Endorsements and references (including endorser and referee contact details)

• Outreach monitoring data, which may include:

  • educational background of parents

  • private vs. public education

  • owned / rented family home

  • ethnicity

  • religion

  • differing abilities 

  • English as first language

• Sensitive personal data, which may include:

  • health information, including any medical conditions - we may use health information provided by you so we can make reasonable adjustments to improve the service we are able to offer you and to look after your wellbeing while studying in Oxford.

  • race or ethnicity and religious beliefs – we use these types of data to monitor the effectiveness of our outreach. You are not required to give this information and may choose not to do so. 

  • we do not generally seek to obtain other categories of sensitive data however, they may sometimes be inferred from other data we hold, for example, your relationships, job titles, support of specific causes, or interests. We may obtain these types of data if give them to us in your application. 

4. How we use your personal data

We use personal data to achieve the following purposes:

• to assist our administrative review of applications. This may include checking objective and document-based eligibility criteria using automated tools, including AI-supported systems.

• to inform the Scholar selection process.

• to contact you, if necessary, during the application and selection processes

• to obtain feedback from your nominated referees

• to compile application statistics

• to improve our applications processes and systems where you consent for us to use your application data for these purposes

• to inform our outreach efforts.

5. When and how we share your data

We share personal data only when it is necessary to administer applications and run the selection process.

Your application data is primarily held on our application system (Embark) in the USA.

Where we use AI or automated processing supplied by third parties, we ensure data is shared only where necessary and under contract, and we limit outputs to document‑verifiable eligibility checks or aggregated insights. We do not delegate final selection decisions to automated systems.

The National Secretary, selection committee members, shortlisting assistants, and administrators from each constituency have access to the applications made to their constituencies. They will access that data via the application system and may download it locally to support the selection processes.

Third parties will only process your personal data on our instructions and where they have agreed to treat your data confidentially and to keep it secure. We only permit them to process your personal data for specified purposes and we will always seek to share the minimum amount of information necessary to fulfil the purpose.

Categories of recipients may include application platform providers, IT service providers, document verification providers, and other service providers acting on our instructions.

We do not allow our third-party service providers to use your personal data for their own purposes nor to keep your data after the processing is complete. All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies.

We may share special category data (for example, ethnicity or disability information) with third parties only where you have given explicit consent or where another lawful basis and with additional safeguards are in place.

6. Our legal basis for processing your data

We will only process your personal data where the law allows us to do so.

We rely on the following legal bases for each of our processing activities:

Contract / Pre-contract

We rely on the contract legal basis for the purposes of the processing and assessment of your application, as these steps are taken at your request, as given by the clear and affirmative action of you submitting your application, before entering into a contract, i.e. successful candidates being offered a Rhodes Scholarship.

Legitimate Interests

We rely on the basis of our legitimate interest in operating the Rhodes Scholarship programme and for our broader charitable purposes to maintain records relating to scholarship selection processes, for quality assurance and to improve our selection processes, for statistical reporting and for fraud protection and the investigation of complaints.

For eligibility checks we rely on our legitimate interest in operating and improving the scholarship programme. Where we use automated/AI-supported checks to assess document-based eligibility criteria (for example passport or residency documents) these checks produce factual outputs used for administrative screening only - they do not make final selection decisions.

We have considered the impact on privacy and conclude that these activities are necessary and proportionate because they support fair administration and continuous improvement.

Consent

We rely on consent to process your personal data in limited circumstances such as; administering outreach monitoring or other application surveys, using your application data to test future system or process changes and during the publication and publicity of successful Rhodes Scholar applicants.

Special category data (for example ethnicity, disability status, sexual orientation) is only collected where you choose to provide it for example where you have chosen to share that information as part of your application or as part of diversity monitoring.

We process this data only with your explicit consent (Article 9 GDPR), and you can withdraw that consent at any time. Not providing special category data will not normally prevent you from applying, but may affect our ability to monitor equality of opportunity or make necessary adjustments.

If you withdraw consent, we will stop any processing that relies solely on consent, but some processing may continue if another lawful basis applies or where stopping would prevent us from meeting our obligations.

If you withdraw your consent, or withdraw your application in any other way, we may keep parts or all of your application data.

7. Change of purpose

We will only use your personal data for the purposes we collected it for, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your data for a new purpose, we will notify you and explain the legal basis which allows us to do so.

8. International transfers

We may share your data with the National Secretary, selection committee members, shortlisting assistants and administrators in the constituency to which you applied. This may involve a transfer of your data outside of the UK and the European Economic Area (EEA).

Your application data is primarily held on our application system (Embark) in the USA. Other IT service providers are based with the UK or EEA.

Where personal data is transferred internationally, we rely on appropriate safeguards recognised under UK data protection law, such as adequacy regulations or approved contractual transfer mechanisms.

9. Data security

The Rhodes Trust takes the security of your data seriously. We have appropriate technical and organisational measures in place to protect your personal data from loss, misuse, or unauthorised access. Access to your personal data is limited to those who need it for legitimate purposes and who are subject to confidentiality obligations They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

10. How long we keep your data

We keep your personal data only for as long as is necessary to fulfil the purpose for which it was collected and no longer. We retain data in accordance with our retention schedule and periodically review retained records.

The data contained within Rhodes Scholarship applications will be retained by the Rhodes Trust for a period of seven years after the end of the application round in which the application was created (this is the potential length of eligibility of a candidate for a scholarship). Following seven years the data will be permanently deleted with only non-identifying summary statistics remaining.

For successful Rhodes Scholarship applications, the applications will be retained by the Rhodes Trust, digitally and physically, indefinitely. The applications will be removed from the Embark application platform after seven years.

11. Your legal rights (inc. consequences of not providing data)

You have a number of rights over the personal data we hold about you. You can use these rights to check, correct or limit how we use your information.

You have the following rights:

• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.

• Request correction of your personal data. This enables you to ask us to correct any inaccurate or incomplete information that we hold about you.

• Request erasure of your data. This enables you to ask us to delete or remove your data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below). We may not be able to comply if we have another lawful basis for keeping the data.

• Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example if you want to establish its accuracy or the reason for processing it.

• Object to processing of your data where we are processing it to meet our legitimate interests (or those of a third party). You also have the right to object where we are processing your data for direct marketing purposes.

• Withdraw consent: withdraw any consent you have given; this will stop future processing that relies on consent.

• Right to complain to the Information Commissioner’s Office (ICO), information about how to make a complaint is available on the ICO’s website at www.ico.org.uk.

Where automated checks are used to verify document‑based eligibility you have rights relating to automated decisions:

• to request human review,

• to contest outcomes,

• and to obtain an explanation of how the decision was made and the logic involved.

If you wish to exercise any of these rights please contact us at data.protection@rhodeshouse.ox.ac.uk. We will respond to your request within one month. If we need more time, we will tell you and explain why. We may ask for proof of identity before fulfilling a request.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop.

Withdrawing consent or asking us to delete or restrict data may mean we cannot carry out certain activities (for example we may be unable to process your application, verify eligibility, or consider you for selection). If you ask us to restrict processing, we may retain the data but not use it for selection activities until the restriction is lifted.

If you have concerns about how we have handled your personal data, please contact us in the first instance using the details provided in this notice. We will investigate your concerns and seek to resolve them in accordance with our data protection complaints procedure.

If you remain dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK regulator for data protection matters. Information about how to make a complaint is available on the ICO’s website at www.ico.org.uk.

12. Contact us

If you have any questions about this privacy notice or about your personal data, or if you wish to exercise any of your rights as outlined above, please contact us using the details below, quote your name, and if you are a Rhodes Scholar, your Rhodes identifier – (‘Election country/region’, ‘College’ & ‘Election year’):

Data Protection Officer
The Rhodes Trust
Rhodes House
South Parks Road
Oxford, OX1 3RG
United Kingdom

Email: data.protection@rhodeshouse.ox.ac.uk

The Rhodes Trust holds personal records on all Rhodes Scholars from the point at which Scholars are selected (for scholarship application data, please see the separate privacy policy). We keep aspects of these records for varying lengths of time, both electronically and physically. Our principles are simple – we will be transparent about the data we are collecting, where we source those data, how we use the information we hold about you, and the choices you can make.

We collect and process your data for a variety of reasons, not least to maintain a complete and historical record over time. We also collect information necessary for us to assist you in your journey to Oxford, during your time in Oxford, and beyond. We use the information we hold about you to try to ensure that you have an enriching and rewarding time in Oxford and to assist with behind-the-scenes administration on your behalf. It also enables us to ensure that when we approach you for reasons other than necessary academic matters, these interactions are respectful, professional, and relevant to you, and are not unwelcome.

If at any point you have questions about this privacy notice, or how we are using your data, please contact us.

1.About this privacy notice

The purpose of this privacy notice is to explain how the Rhodes Trust ("the Trust", "we", "our", "us") holds and uses personal data about Scholars Elect and Scholars in Residence ("you"), and how we use it for the purposes of academic administration and improving the Scholar experience. The Rhodes Trust includes both the offices at Rhodes House in Oxford and our international offices, the latter including National Secretaries, selectors, selection committees, and alumni associations.

2.What we do

The Rhodes Trust endeavours to ensure that your Scholarship experience is as rewarding as possible,to assist you while you are in Oxford, and to facilitate with establishing and developing lifelong relationships amongst Rhodes Scholars of all generations. We are here to help you stay connected with each other and with the news and events that are important to you.

3.The data we collect about you

We collect information about you from a variety of sources including directly from you via correspondence, the Rhodes online portal and annual surveys / updates, from the Scholarship and University application forms, from the University’s Student Information Systems, the National Secretaries, recognised Alumni Associations, publicly available sources and/or from third parties providing us with services or acting on our behalf.We may hold and process the following types of personal data about you:

- Biographical information, which may include:

• name, title, date of birth, gender, marital status, spouse, partner and family details (for example next of kin emergency contact details)

• where you live and other contact details

• education history

• your Coming Up biography

• your plans for Study at the University of Oxford and your University application forms, progress and outcomes

• your academic progress at Oxford University (or any other institution at which you have studied under the Rhodes Scholarship), and research specialism(s)

• extra –curricular interests, pursuits and achievements whilst at Oxford and elsewhere

• employment details, career history, professional activities

• photographs of you - either provided by you, by other Scholars, or taken during events at Rhodes House

• links to your public social media presence e.g. LinkedIn, Twitter, website or blog

• future plans beyond Oxford; Going Down biographies

• any additional information held within the University and Scholarship application forms, including scans of identification and nationality/residency documents, certificates and transcripts, your Rhodes personal statement, endorsements, references.

- Details of our ongoing relationship with you and your engagement with us, which may include:

• feedback on your experience in Oxford, including course, college, accommodation, and Rhodes House

• research grant and Warden’s Discretionary Fund applications

• records of your personal interactions with us (e.g. correspondence, notes of meetings or conversations)your communication preferences; records of communications you have received from us, including copies of letters, emails or appeal literature sent, and of fundraising activities in which you have been included (e.g. annual fund mailings, telephone fundraising campaigns)

• your attendance (and that of your guests) on visits to, or at Rhodes Trust events, including details of any payments made, and photographs, audio and video recordings in which you may be included

• a record of offers of voluntary support you have made, e.g. offers of expertise, advice, mentoring and of volunteer work that you have undertaken on behalf of the Rhodes Trust

• financial needs (during your time in Oxford) and bank details for stipend (and other)payments

• membership of social media groups e.g. Twitter, LinkedIn

• your relationship to relevant trusts, foundations and corporates, e.g. membership on board of Trustees

• feedback on your experience provided by you explicitly for the purpose of reporting back to our major donors

• data obtained through cookies and similar technologies. These help us understand how you interact with our website (see our separate cookie policy).

- Sensitive personal data, which may include:

• physical and mental health information (usually divulged by you), including any medical conditions. We may use health information provided by you so we can make reasonable adjustments to improve the service we are able to offer you and to support your wellbeing while attending Oxford.

• Although we do not collect these for our own purposes, the following attributes may be inferred from data we do hold: race or ethnicity, religious beliefs, sexual orientation, political convictions. (NB the outreach data completed in the Scholarship and University application forms are not linked back to individuals). Such information may be inferred from other data we hold, for example, your relationships, volunteer roles, membership of certain Scholar groups, job titles, donations to specific causes or interests. We may obtain these types of data if you have made them public or if you give them to us, for example when writing a blog post for our website or when you register for an event.

4.How we use your personal data

Your personal data are used in the following ways:

• to assist with your applications to the University of Oxford

• at your request we share with the University references that were submitted as part of your Scholarship application. We will also need to use your personal data to have conversations with members of the collegiate University to progress your applications.

• with your permission, we publish a photograph and bio (usually written by yourself) on the Rhodes House website.

• with your permission, we may use photographs of you in public-facing material – e.g. on the website, in printed material, or in social media posts

• we will contact you about events and opportunities that may interest you

• in liaison with you, we may deem it necessary to use your health information to orchestrate additional care for you while you are in Oxford; this may include conversations with relevant members of the collegiate university

• we may connect you to Scholars Elect / current Scholars / Senior Scholars in order to facilitate the sharing of experience and guidance necessary for university applications and the making of future plans. If you do not wish your data to be used in any of the ways listed above, or have any questions, please contact us on data.protection@rhodeshouse.ox.ac.uk.

5.When and how we share your data

We will, from time to time, share your personal data with the Rhodes Scholarship National Secretaries (and offices) and Selection Committee members, recognised Rhodes Alumni Associations or with third parties working on our behalf (for example the Rhodes digital platform provider), whether inside the EEA or outside. We will only do this in appropriate circumstances, by secure means, and with the relevant data sharing agreements in place. We do not, and will never, sell your data.

Third parties will only process your personal data on our instructions and where they have agreed to treat your data confidentially and to keep it secure – in line with the General Data Protection Regulation. We only permit them to process your personal data for specified purposes on behalf of the Rhodes Trust. We do not allow our third-party service providers to use your personal data for their own purposes nor to keep your data after work agreed with the Trust is complete or beyond agreed retention timelines. All of our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies.

Whenever your information is shared, we will always seek to share the minimum amount of information necessary to fulfil the purpose.Your data may also be shared in the following ways:

• Where we have a legitimate interest to do so for purposes listed within this privacy notice. Where we use legitimate interest as the basis for our processing we will carefully consider each of the ways we process your data to ensure that we carry out our activities with a focus on your interests, and in the most efficient and effective way.

• Where we need to undertake the services that we provide to you. Information processed for this purpose includes, but is not limited to, the information you provide when you apply for the Rhodes Scholarship, register for an event, or to enable us to process a donation.

• Where we are required to comply with our legal obligations for example with respect to The Charity Commission or the Information Commissioner’s Office in relation to audits or official investigations.

• Where your consent is required, for example where sensitive personal data is recorded. For any processing that requires your prior consent, you can withdraw your consent at any timeand the Trust will cease the activity.

7.Change of purpose

We will only process your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you or ask permission, as relevant, if the former, we will explain the legal basis which allows us to do so. Please note that we may process your data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Once you are no longer in residence in Oxford this Privacy Notice will be superseded by a separate privacy notice for Alumni, Donors and Supporters, this notice can be found here.

8.International transfers

The Rhodes Trust operates internationally. Most of the personal data we process for current Scholars and Scholars Elect stays in the UK although some users from the Rhodes Trust, including Rhodes Trust staff within our international offices (including National Secretaries and Selection Committee members), may access your personal data held in our IT systems and platforms, including those from outside the European Economic Area (EEA). We may also share data with recognised Alumni Associations, consultants, service providers and others working on our behalf outside the EEA. In all cases we will make sure transfers are made securely, subject to appropriate safeguards.

9.Data security

The Rhodes Trust takes the security of your data very seriously and we have appropriate security measures in place to prevent your personal data from being accidentally lost or misused. Access to your personal data is limited to those employees, contractors, volunteers and other third parties who have a need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

10.How long we keep your data

The Rhodes Trust considers its relationship with Rhodes Scholars, donors and supporters to be life-long and we will retain much of your data indefinitely unless you request otherwise. When we no longer need to retain personal information, we ensure it is securely disposed of. We will also keep anonymised statistical data indefinitely. Some Scholar data is only retained temporarily; please contact the Scholar Affairs Office for further information on our retention policy(scholar.affairs@rhodeshouse.ox.ac.uk).

11.Your legal rights

Under certain circumstances, you have the right to:

Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.

Request erasure of your data. This enables you to ask us to delete or remove your data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).

Object to processing of your data where we are processing it to meet our legitimate interests (or those of a third party). You also have the right to object where we are processing your data for direct marketing purposes.

Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example if you want to establish its accuracy or the reason for processing it.

Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a statutory or contractual requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop. However, where you have consented to the processing, you can withdraw your consent at any time by emailing data.protection@rhodeshouse.ox.ac.uk. In this event, we will stop the processing as soon as we can. If you choose to withdraw consent it will not invalidate past processing.If you want to exercise any of the rights described above or are dissatisfied with the way we have used your information, please contact us at data.protection@rhodeshouse.ox.ac.uk. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of the GDPR (General Data Protection Regulation 2018). Please note that we may keep a record of your communications to help us resolve any issues which you raise.If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office at the ICO website: https://ico.org.uk/.

12.Contact us

If you have any questions about this privacy notice or about your personal data, or if you want to provide updates to your data or exercise any of your rights as outlined above, please use the details below, and quote your name and, if you are a Rhodes Scholar, your Rhodes identifier – (‘Election country/region’, ‘College’ & ‘Election year’):

The Rhodes Trust
Rhodes House, South Parks Road
Oxford, OX1 3RG, United Kingdom

Email: data.protection@rhodeshouse.ox.ac.uk

We reserve the right to update this privacy notice at any time. Any changes to this privacy notice will be posted to this page.

The Rhodes Trust collects and processes personal data relating to its employees, contractors and temporary workers. We keep aspects of these records for varying lengths of time, both electronically and physically. Our principles are simple – we will be transparent about the data we are collecting, how we use the information we hold about you.

We collect and process your data for a variety of reasons, if you apply to work for us as an employee or contractor and to manage the employment relationship.

If at any point you have questions about this privacy notice, or how we are using your data, please contact us.

1. About this privacy notice

The purpose of this privacy notice is to explain how the Rhodes Trust ("the Trust", "we", "our", "us") holds and uses personal data about our workforce and any applicants for roles with us ("you"), and how we use it for the purposes of meeting our legal obligations and in connection with our broader working relationship with you. 

The Rhodes Trust includes both the offices at Rhodes House in Oxford and our international offices, and across these offices (and related programmes) Rhodes Trust will also engage contractors, casual workers, interns and volunteers (including selectors for its programmes) as well as employees. This notice applies to all such individuals, whether or not employed by the Rhodes Trust, but does not itself confer any status of employment.

2. The data we collect about you

We collect information about you from a variety of sources. For example, data is collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit and payroll forms); from correspondence with you; or through interviews, meetings or other assessments.

In some cases, the organisation collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies, information obtained from social media monitoring and information from criminal records checks permitted by law. We may hold and process the following types of personal data about you:

• Personal contact details (such as your name, address and contact details, including email address and telephone number, date of birth, gender, marital status and dependents, next of kin and emergency contact information);
• the terms and conditions of your employment;
• recruitment information (including copies of identity documentation, right to work documentation, psychometric testing, references and other information included in a CV or cover letter or as part of the application process),
• employment records (including job titles, qualifications, skills, work history including start and end dates with the organisation, working hours, training records and professional memberships)
• information about your remuneration, including entitlement to benefits such as pensions or insurance cover;
• details of your bank account and national insurance number;
• information about your nationality and entitlement to work in the UK;
• information about your criminal record and other vetting or background checks;
• details of your schedule (days of work and working hours), and attendance at work periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence.
• information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
• CCTV footage, and other information obtained through electronic means such information about your use of our information and communications systems and your photograph (either provided by you, by other employees, or taken during events at Rhodes House)
• details relating to when you access Rhodes Trust buildings and facilities using our access control systems and;
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

Sensitive personal data:

We may also need to process information you provide or that we fairly obtain about your criminal convictions and offences (including alleged offences), your health (including any medical condition, health and sickness records), race, ethnic origin, religious beliefs, sexual orientation, political opinions and trade union memberships (“Special Category Data”).

3. How we use your personal data

The Trust needs to process data to enter into an employment contract (or other terms of engagement) with you and to exercise its rights and meet its obligations under that contract. For example, it needs to process your data to provide you with an offer or contract, to pay you in accordance with your contractual entitlement, and to administer benefit, pension and insurance entitlements.

In some cases, the organisation needs to process data to ensure that it is complying with its legal obligations. For example, we are required to check an employee's entitlement to work in the UK, to deduct tax, to comply with health and safety laws, to enable employees to take periods of leave to which they are entitled, and to consult with employee representatives if redundancies are proposed or a business transfer is to take place. 

For certain positions, including volunteers and selectors in certain roles, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake the role in question. It may also be necessary to process criminal records data in the context of disciplinary or grievance proceedings, for example to investigate and take appropriate action if you are suspected of committing an offence (whether at or outside work).

We may also need to process your data to:

• run recruitment and promotion processes;
• maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
• ensure employees (and others subject to them, such as selectors) are complying with relevant policies and procedures;
• operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
• operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
• obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
• operate and keep a record of other types of leave (including maternity, paternity, adoption, parental leave, shared parental leave, and parental bereavement leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
• ensure effective general HR and business administration;
• conduct employee engagement surveys;
• provide references on request for current or former employees;
• respond to and defend against legal claims;
• ensure the safeguarding of children and vulnerable adults, where applicable; and
• maintain and promote equality in the workplace.

Internal and external communications

We also use your personal data in the following ways:

• to publish a photograph on the Rhodes internal systems;
• with your permission, we may use photographs of you in public-facing material – e.g. on the website, in printed material, or in social media posts; and
• we will contact you about events and opportunities that may interest you (where relevant to your employment, or otherwise in accordance with your preferences) and any scholar materials and communications we deem necessary.

Some special categories of personal data, such as information about health or medical conditions, or racial or ethnic origin, is processed to carry out employment law obligations (such as those in relation to employees with disabilities, for health and safety purposes and to ensure that employees have the right to work in the UK). 

Where the organisation processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this may also be done for other reasons of substantial public interest as permitted by the Data Protection Act 2018. For example:

• for the purposes of equal opportunities monitoring (you can ask us to stop processing this data at any time);
• in connection with safeguarding or disciplinary functions, processes, and/or investigations.

As noted above, the organisation may process criminal records data to assess your suitability for employment both when you are recruited (through appropriate criminal records checks) and, where necessary and so permitted by law, in the course of your employment.

If you do not wish your data to be used in any of the ways listed above, or have any questions, please contact us on data.protection@rhodeshouse.ox.ac.uk. However, please be aware that we may need to continue processing your data in any event.

4. When and how we share your data

Your information will be shared internally, including with members of the HR and Finance team (including payroll), your line manager, senior managers in the business and IT or estates staff if access to the data is necessary for performance of their roles.

The Rhodes Trust shares your data with third parties to obtain pre-employment references from other employers, obtain employment background checks from third-party providers, obtain psychometrics assessments by third party providers, obtain necessary criminal records checks, or report suspected offences to the appropriate authorities. The Trust may also share your data with third parties for the purposes of enforcing its legal rights. The Trust may also share your data with third parties in the context of a sale of some or all of its business. In those circumstances the data will be subject to appropriate confidentiality arrangements. 

We also share your data with third parties that process data on our behalf in connection with payroll, the provision of benefits, management of HR records, delivery of equipment, furniture or gifts and the provision of occupational health services. Where your work for us is carried out in the context of a programme in partnership with third parties, it may be necessary to share your data with such parties in connection with your role.

We are required to share salary data for a small number of key employees in line with US IRS tax reporting requirements. 

In all Countries of employment, we will also share your data with the relevant Country tax, revenue service or government authority.

Whenever your information is shared, we will always seek to share the minimum amount of information necessary to fulfil the purpose.

International transfers

The Rhodes Trust operates internationally. Most of the personal data we process for our current workforce stays in the UK although some users from the Rhodes Trust, including Rhodes Trust staff within our international offices or in connection with our international programs, may access your personal data held in our IT systems and platforms, including those from outside the European Economic Area (EEA). We may also share data with recognised service providers and others working on our behalf outside the EEA. Sometimes this will be done is necessary for the performance of a contract with you or to implement pre-contractual measures following a request by you. In all cases we will make sure transfers are made securely, and subject to any appropriate safeguards as required by law.

If you work for us in a country outside the UK, we will transfer personal data between that country and the UK. Depending on the country, the use of personal data may also be subject to additional rules and regulations.

If your work for us (whether as an employee or volunteer, contractor, selector etc.) is carried out in connection with one of our international programmes or fellowships – such as The Atlantic Institute, Schmidt Science Fellows or Rise – your personal data may also need to be shared with our partner organisations internationally, either as part of the governance and/or selection process for those programmes or as part of shared IT systems. Again, we will make sure transfers are made securely, and subject to appropriate safeguards.

5. Our legal basis for processing your data

We will only process your personal data where the law allows us to do so. Most commonly we rely on the following legal bases for processing your personal data:

• Where it is necessary to perform a contract, we have entered into with you (the legal basis of “performance of a contract”), for example to pay you; 
• Where we need to comply with a legal obligation (the legal basis of “compliance with a legal obligation”), for example to check that you are legally entitled to work in the UK and to provide you with your legal employment rights;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (the legal basis of “legitimate interests”), for example to review and better understand employee retention and attrition rates. 
• Where it is needed in the public interest (the legal basis of “public interest” or “substantial public interest”), such as for equal opportunities monitoring and reporting or for safeguarding purposes;
• Where it is needed in relation to legal claims (the legal basis of “the establishment, exercise or defence of legal claims”), for example at an employment tribunal.
• Where we are required to comply with our legal and regulatory obligations for example with respect to The Charity Commission or the Information Commissioner’s Office in relation to audits, official investigations, or to meet our reporting obligations with tax, revenue and government authorities. There may be limited circumstances where your consent is required, including in certain cases where sensitive personal data is recorded or in respect of marketing uses. For any processing that requires your prior consent, you can withdraw your consent at any time and the Trust will cease the activity.

6. Data security

The Rhodes Trust takes the security of your data very seriously and we have appropriate security measures in place to prevent your personal data from being accidentally lost or misused. Access to your personal data is limited to those employees and other third parties who have a need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Where the Trust engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

7. How long we keep your data

We retain your personal data including any Special Category Data while you work for the Rhodes Trust and, after you cease working for the Rhodes Trust, for as long as is necessary to fulfil our contractual obligations to you, for applicable legal, accounting, or reporting requirements and to providing you with information at your request (such as references).
The periods for which your data is held after the end of employment are set out in the HR retention periods. When, we no longer need to retain personal information, we ensure it is securely disposed of. We will also keep anonymised statistical data indefinitely. 

Please contact the HR department for further information on our retention policy (hr@rhodeshouse.ox.ac.uk).

8. Your legal rights

Under certain circumstances, you have the right to:

• Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
• Request erasure of your data. This enables you to ask us to delete or remove your data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
• Object to processing of your data where we are processing it to meet our legitimate interests (or those of a third party). You also have the right to object where we are processing your data for direct marketing purposes.
• Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example if you want to establish its accuracy or the reason for processing it.
• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, where there is a contractual, legal or statutory requirement for us to process your data and it would not be possible to fulfil our legal obligations if we were to stop. 

However, where you have consented to the processing, you can withdraw your consent at any time by emailing hr@rhodeshouse.ox.ac.uk.

In this event, we will stop the processing as soon as we can. If you choose to withdraw consent it will not invalidate past processing.

9. Contact us

If you have any questions about this privacy notice or about your personal data, or if you want to provide updates to your data or exercise any of your rights as outlined above, please use the details below, and quote your name and, if you are an employee, your employee identifier:

The Rhodes Trust
Rhodes House, South Parks Road
Oxford, OX1 3RG, United Kingdom

Email: data.protection@rhodeshouse.ox.ac.uk

If you have any concerns about how we are processing your personal data, and for further information about your rights, please see the Information Commissioner’s website at https://ico.org.uk/.

We reserve the right to update this privacy notice at any time. Any changes to this privacy notice will be posted to this page.

Published 01/07/2026

1. About this privacy notice

The Rhodes Trust is the data controller for the personal data described in this notice.

This privacy notice explains what personal information the Rhodes Trust (the Trust, we, us) collects and how we collect and use personal data in connection with our archives. This notice also explains the lawful basis on which we process personal data, how long we keep it and your legal rights. It applies to living people whose information appears in the Archive (such as current and former staff, Scholars and applicants, trustees, national secretaries and alumni), and people who contribute to and/or use the Archive (such as donors and researchers).

If you have questions about this notice or how we process your personal data, you can contact our Data Protection Officer using the details in Section 12.

2. What we do

The Rhodes Trust Archive collects and preserves material relating to the history and development of the Rhodes Trust and supports its use for research. It is an irreplaceable and unique collection of records, generated or received by the Trust and is a vital resource for understanding and sharing the history and legacy of the Trust, Scholarships and Rhodes House. To fulfil this purpose the Archive:

• Accepts new records into the collection (through donations and internal transfer) and records where and who these records come from.

• Preserves archival material by storing hard‑copy records in a secure archival repository and uses digital preservation software to store digital archival records.

• Provides access to archival material on site, or through digital copies, for internal and external research.

• Responds to enquiries to enable access to relevant records for research.

• Records permissions to access, copy and publish material from the Archive to ensure legal compliance.

3. The data we collect

We hold and collect the personal information of two main groups of data subjects:

• People featured in archival records (such as current and former staff, Scholars and applicants, trustees, national secretaries and alumni)

• People who contribute to and/or use the Archive (such as donors and researchers).

For data subjects featured in the Archive we hold information such as biographical and demographic details, academic and career records, financial and philanthropic information, photos and images, personal and family details and occasionally sensitive information and special category data (such as health, political opinions, ethnicity, religious beliefs, sexual orientation) when present in historical documents.

For data subjects who contribute to and/or use the Archive we hold contact details (including name, email address, phone number and postal address) alongside details of your enquiry, research topic, archive access requests, permissions, declarations and donations.

We obtain this information from the material donated or transferred to the Archive, Rhodes Trust business records, the individual or organisation providing these records - including scholars and former employees, and from access, copying and publishing request forms provided to enquirers and researchers.

The Archive does not normally collect special category information directly from individuals for archive purposes. Such information may already exist within historical records transferred to or donated to the Archive.

4. How we use your personal data (purposes)

We use personal data in the following ways:

• We permanently preserve physical and digital items within the Archive, which can include sensitive personal information, so it remains usable for future generations.

• When records are added to the Archive, their source, ownership and context are recorded so materials can be identified and trusted.

• We record and use enquiry details to respond to requests, provide access or copies to authorised users, and enable historical and scholarly work.

• We record requests to publish archival material and any permissions given or withheld to manage copyright, privacy and conditions of use.

• We keep accurate records to manage the Archive, fulfil contractual or legal obligations, protect the collection and support secure, accountable administration.

5. When and how we share your data

We only share personal data where it is necessary for the purposes described in this notice and where we are permitted or required to do so under data protection law.

• Our archives can be consulted by internal and external researchers when they request access to material. External access is granted under agreed conditions (for example: supervised reading room access, material-level restrictions, copying and publication agreements) and may require proof of identity and/or a research purpose.

• We may also share limited information with trusted archive storage providers who securely store and retrieve archive material on our behalf.

• The personal details of donors and researchers are accessible to the internal team within the Trust for the purpose of managing the Archive and handling enquiries.

• Third party service providers (such as offsite hard-copy storage, digital storage providers, and conservation and preservation specialists are required to take appropriate security measures to protect personal data in line with our policies and are only permitted to process such data for specific purposes in accordance with our instructions.

6. Our legal basis for processing your data

We rely on the following lawful bases to process personal data relating to our archives:

Personal data forming part of archival collections is preserved as compatible further processing for archiving purposes in the public interest under Article 5(1)(b), supported by Article 89 UK GDPR and Schedule 1/Data Protection Act 2018 where special category data is involved. The original Article 6 lawful basis on which the records were collected continues to apply.

Contract

Where you enter into an agreement with us (for example, a donation agreement, an access or copying agreement, or a request to publish archival material), we process the personal data necessary to perform that contract. For example, if you ask to publish material from our Archive, we will use your contact details and information about the proposed publication to consider and respond to your request.

Special category data

Some archival records contain special category personal data that forms part of the historical record. Where we process this information, we do so only where permitted by data protection law for archiving in the public interest and historical research purposes (Article 9 UK GDPR), and we apply appropriate safeguards to protect individuals’ rights and freedoms, including access controls and other measures where appropriate.

7. Change of purpose

We will only use your personal data for the purposes we collected it for, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your data for a new purpose, we will notify you and explain the legal basis.

8. International transfers

The Rhodes Trust does not routinely transfer personal data outside the UK in connection with the operation of the Archive. Our service providers that process personal data on our behalf for archive management and preservation are based in the UK or European Economic Area.

Researchers may request access to archival material from outside the UK. Where personal data is disclosed to researchers based overseas, we will only do so where appropriate and in accordance with data protection law. Where required, we will ensure that appropriate safeguards are in place before making any restricted international transfer of personal data.

9. Data security

The Rhodes Trust takes the security of your personal data seriously. We have appropriate technical and organisational measures in place to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include appropriate access controls, technical methods, secure storage arrangements, and procedures designed to ensure that only authorised individuals can access personal data where it is necessary for their role.

Access to archival material containing personal data is managed according to the nature and sensitivity of the records. Where appropriate, access may be subject to restrictions, supervised consultation, redaction or other measures to protect the rights and freedoms of individuals while supporting the preservation of the Archive and legitimate research.

We also require third-party service providers who process personal data on our behalf to implement appropriate security measures and to process personal data only in accordance with our instructions.

10. How long we keep your data (retention periods)

We keep personal data only for as long as it is needed for the purposes described in this notice. Different categories of material are retained for different periods:

Archival collections

Records that form part of the Rhodes Trust Archive are preserved because they have enduring historical, evidential or research value. Where personal data forms part of these archival collections, it is likely to be retained permanently for archiving in the public interest and historical research purposes.

Archive administration

Records created to administer the Archive are retained for shorter periods in accordance with the Trust’s retention schedule. For example:

• Enquiry, access and copying records are retained for 2 years and then anonymised or securely destroyed.

• Requests to publish archival material are retained for 5 years and then securely destroyed.

11. Your legal rights (inc. consequences of not providing data)

You have a number of rights over the personal data we hold about you. You can use these rights to check, correct or limit how we use your information.

You have the following rights:

• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.

• Request correction of your personal data. This enables you to ask us to correct any inaccurate or incomplete information that we hold about you.

• Request erasure of your data. This enables you to ask us to delete or remove your data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below). We may not be able to comply if we have another lawful basis for keeping the data.

• Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example if you want to establish its accuracy or the reason for processing it.

• Object to processing of your data where we are processing it to meet our legitimate interests (or those of a third party). You also have the right to object where we are processing your data for direct marketing purposes.

• Withdraw consent: withdraw any consent you have given; this will stop future processing that relies on consent. This only applies where we rely on your consent to process your data.

• Right to complain to the Information Commissioner’s Office (ICO), information about how to make a complaint is available on the ICO’s website at www.ico.org.uk.

If you wish to exercise any of these rights please contact us at data.protection@rhodeshouse.ox.ac.uk. We will respond to your request within one month. If we need more time, we will tell you and explain why. We may ask for proof of identity before fulfilling a request.

Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, for example, some rights may be limited where information is processed solely for archiving in the public interest or historical research in accordance with data protection legislation.

If you do not provide information we reasonably need, we may be unable to accept or process archival material, respond to enquiries, manage permissions to publish, store or preserve records, or make archives available. If you ask us to delete or restrict data, that may limit our ability to carry out these activities.

If you have concerns about how we have handled your personal data, please contact us in the first instance using the details provided in this notice. We will investigate your concerns and seek to resolve them in accordance with our data protection complaints procedure.

If you remain dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK regulator for data protection matters. Information about how to make a complaint is available on the ICO’s website at www.ico.org.uk.

12. Contact us

If you have any questions about this privacy notice or about your personal data, or if you wish to exercise any of your rights as outlined above, please contact us using the details below:

Data Protection Officer
The Rhodes Trust
Rhodes House
South Parks Road
Oxford, OX1 3RG
United Kingdom

Email: data.protection@rhodeshouse.ox.ac.uk

Rhodes House Ltd collects and processes personal data relating to its prospective customers, existing customers, event guests, and suppliers. We keep aspects of these records for varying lengths of time, both electronically and physically. Our principles are simple – we will be transparent about the data we are collecting and how we use the information we hold about you.

For more details, please click here to visit our Venue Hire website.

The Modern slavery and human trafficking – Policy Statement is available here.

Scholar Code of Conduct is available here.

The Volunteer Code of Conduct is available here.

A printable version of the Volunteer Code of Conduct is available here.

Guidelines for Dealing with Conflicts of Interest are available here.

The Volunteer Disciplinary Policy and Complaints Procedure is available here.

The Glossary for Rhodes Conduct Policies is available here.

Below sets out the Website Data and Cookie Policy of the Rhodes Trust.

Cookie Data

When we provide services, we want to make them easy, useful and reliable. Where services are delivered on the internet, this sometimes involves placing small amounts of information on your computer or mobile phone. These small text files are known as cookies. The type of cookies placed by the Rhodes Trust website collect information about how visitors use the website, for instance which pages visitors go to most often, and if they get error messages from web pages. These cookies do not collect information that identifies a visitor. All information these cookies collect is aggregated and therefore is anonymous. The information is only used to improve how our website works.

By using the Rhodes Trust website, you agree that we can place these types of cookies on your device. You can find more information about cookies at: www.aboutcookies.org or www.youronlinechoices.eu.

Google Analytics sets cookies to help us accurately estimate the number of visitors to the website and volumes of usage. This to ensure that the service is available when you want it and fast. For more information about Google Analytics, visit the Google Analytics website.

If you do not wish to accept cookies onto your device you can disable them by adjusting the settings on your browser. Please be advised that this will affect the functionality of the websites you visit. This Cookies policy only covers the Rhodes Trust website at https://www.rhodeshouse.ox.ac.uk/. It does not cover links within this site to other websites.

Google Analytics

Google Analytics sets cookies to help us accurately estimate the number of visitors to the website and volumes of usage. This to ensure that the service is available when you want it and fast. Below is a list of the cookies downloaded to your device from our website through our use of Google Analytics.

Name: _utma

Typical content: randomly generated number

Expires: 2 years

Name: _utmb

Typical content: randomly generated number

Expires: 30 minutes

Name: _utmc

Typical content: randomly generated number

Expires: when user exits browser

Name: _utmz

Typical content: randomly generated number + info on how the site was reached (e.g. directly or via a link, organic search or paid search)

Expires: 6 months

For more information about Google Analytics, visit the Google Analytics website.

If you believe the Rhodes Trust has handled your personal information incorrectly, you can make a data protection complaint to us.

A data protection complaint may relate to how we have collected, used, shared, stored, retained, corrected or deleted personal information, or how we have handled a request you made about your data rights.

You do not need to refer to data protection law or use legal language when making a complaint. You only need to tell us what has happened and why you are dissatisfied.

How to make a complaint

You can submit a data protection complaint by emailing data.protection@rhodeshouse.ox.ac.uk.

You can also raise a complaint with us through other reasonable channels, including in writing, in person, by phone or through another contact route used by the Rhodes Trust. If your complaint reaches a different team first, we will route it to the appropriate staff for handling.

Please provide enough information for us to understand your concern and contact you about it. This may include your name, contact details, the nature of your complaint, relevant dates or correspondence, and the outcome you are seeking.

What happens next

Once we receive your complaint, we will review it and look into the issues you have raised. We will acknowledge receipt of your complaint as soon as possible and within 30 days of receiving it.

We will investigate your complaint without undue delay and, where appropriate, keep you informed of progress. Once our investigation is complete, we will let you know the outcome as soon as possible.

If you remain dissatisfied after we have considered your complaint, you have the right to complain to the Information Commissioner’s Office (ICO).

Other privacy rights

If you want to exercise your data protection rights, such as requesting access to your personal information or asking us to correct inaccurate data, please see our wider privacy information and data rights guidance.