Privacy Policy

Privacy Notice for Oxford Brookes – Hamilton Brookes

LAST UPDATED: 21/11/2025

1. Who we are

Oxford Brookes – Hamilton Brookes (formerly Hamilton Trust) is part of Oxford Brookes University and delivers curriculum and learning resources, training, and support services to schools, teachers, and pupils throughout the UK education sector. The Data Controller for all personal data collected and processed in connection with these services is Oxford Brookes University (ICO registration Z6569324). Hamilton Brookes operates as an integral part of the University, not as a separate company.

2. What information we collect

We collect only the personal data necessary to provide educational resources and digital services, manage accounts, respond to queries, and support our users. This includes:

• Name, email address, contact details (for registration, support, account management)
• School/employer details (where relevant)
• Usernames, login information, activity logs (for online platforms)
• Records of communications (service requests, feedback or technical support)
• Usage data and preferences (to manage and improve our educational content)
• Where applicable, safeguarding or special needs data as provided by schools or teachers, processed solely to deliver tailored educational support

We do not collect financial, credit reference, or marketing profiling information.

3. Why we use your data (Purpose and legal basis)

Personal data are processed for the following purposes:

• Provision of educational and support services
• Administration of user accounts and subscriptions
• Monitoring, improving, and ensuring the security of our digital platforms
• Compliance with legal and regulatory obligations (including safeguarding)
• Communication with schools, teachers, and users regarding service updates

Our main legal bases are:

• The performance of a task in the public interest (education)
• Contract (where services are provided directly to individual users)
• Legal obligation (for safeguarding or regulatory compliance)
• Consent (for non-essential cookies or optional email communications)

4. Who we share your data with

We only share personal data with:

• Oxford Brookes University staff and contracted service providers who support the delivery and administration of Hamilton Brookes services
• Government bodies and regulators as required by law (for example, for safeguarding or audit)
• IT suppliers (for example, hosting educational platforms), operating under data processor agreements that ensure GDPR compliance

We never sell or share your personal data with third parties for marketing purposes.

5. International transfers

We aim to store and process data within the UK or European Economic Area (EEA) wherever possible. If data must be transferred outside the UK/EEA (e.g., for cloud hosting services), this will only take place where appropriate UK International Data Transfer Agreements or adequacy regulations are in place.

6. How long we keep your data

Data retention is determined by the minimum period necessary for us to provide educational services, comply with legal and financial obligations, and address disputes or safeguarding concerns. Examples:

• User account and login data: Retained for the life of the account and deleted within 24 months of closure or inactivity
• Support queries and incident logs: Retained for up to 2 years from closure
• Safeguarding records: Retained as required by statutory guidance

For further details, see the Oxford Brookes Data Retention Schedule.

7. Your data protection rights

Under data protection law, you have the following rights:

• To access your personal data and receive a copy
• To have inaccuracies corrected
• To request erasure or restriction of data processing under certain circumstances
• To object to processing where the University relies on public task/legitimate interests
• To withdraw consent at any time (where consent is the lawful basis)

Requests can be made by contacting the Oxford Brookes University Data Protection Officer directly at [email protected]. Response within one month is standard, with no fee unless requests are manifestly unfounded or excessive.

8. Cookies

The Hamilton Brookes website uses only essential cookies for site operation and user login. Optional analytics or functionality cookies (if any) are deployed only with your active consent. A detailed cookie policy can be found in Appendix A. Third-party cookies or trackers are not used for advertising or profiling.

9. Contact details and complaints

For any questions or to exercise your rights, contact:

Oxford Brookes Data Protection Officer
[email protected]
Gipsy Lane, Headington, Oxford, OX3 0BP, UK

If you are not satisfied with the University's response, you have the right to contact the Information Commissioner's Office (www.ico.org.uk).