OxFirst Privacy Notice (UK)


Last updated: 3 January 2026

OxFirst (“OxFirst”, “we”, “us”) respects your privacy. This Privacy Notice explains how we collect, use, share, and protect personal data when you interact with us.

This notice is intended to meet the transparency requirements under the UK GDPR and Data Protection Act 2018 (as updated from time to time). GOV.UK+1
Note: the ICO has stated some guidance is under review following the Data (Use and Access) Act 2025. ICO+1

1) Who we are (data controller) and how to contact us

OxFirst is the data controller for the personal data described in this Privacy Notice.

  • Controller: OxFirst
  • Registered address: [Insert address, England & Wales]
  • Privacy contact email: info@oxfirst.com (use subject: “Privacy Request”)

2) Scope

This Privacy Notice applies to personal data processed by OxFirst in connection with:

  • our communications and relationship management;
  • our products and services;
  • events, webinars, and activities;
  • relationships with clients, partners, volunteers, contractors, and other contacts.

3) Personal data we collect

We may collect the following categories of personal data (depending on your relationship with us):

  • Identity and contact data: name, email address, phone number, postal address, job title, employer/organisation.
  • Event and participation data: registrations and attendance.
  • Transaction and record data: invoices, billing details, payment confirmations, and purchase records.
  • Communications data: emails/messages you send us, requests for support, feedback or survey responses.
  • Content you provide: information you upload or provide to us (e.g., forms, documents, submissions).

4) How we collect personal data

We collect personal data:

  • directly from you (e.g., forms, registrations, purchases, emails); and/or
  • from your organisation where it provides your professional contact details in the context of services or events.

5) How we use your personal data (purposes and lawful bases)

We only process personal data where we have a lawful basis under the UK GDPR, including:

  • Contract (to provide services or event participation you requested),
  • Legitimate interests (to communicate with you, run our services/events, and keep operations secure),
  • Consent (where you choose to opt in),
  • Legal obligation (e.g., tax/accounting, responding to lawful requests). ICO

Main purposes

  1. To deliver services and process transactions (manage orders, invoicing, records).
    B. To respond to enquiries and provide support.
    C. To administer events and activities (confirmations, logistics, updates).
    D. To improve our services and activities (using feedback you provide).
    E. To protect security and prevent misuse (reasonable technical/organisational measures).

6) When we share personal data

We do not sell personal data.

We may share personal data only where necessary, for example:

  • Professional advisers (legal/accounting/audit), where needed.
  • Authorities where required by law or to respond to valid legal requests.

Events and co-sponsors

If an event is hosted or co-sponsored with another organisation, OxFirst does not share attendee lists with co-sponsors.

Please note: third parties at an event (e.g., sponsors/exhibitors) may ask you directly for your details at booths or during sessions. Providing your information to them is optional and subject to their own privacy practices.

Corporate transactions

If OxFirst is involved in a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

7) International transfers

We do not routinely transfer personal data outside the UK. If a transfer is ever needed, we will ensure appropriate safeguards are used in line with UK data protection law. Legislation.gov.uk

8) Cookies and similar technologies

We do not operate a cookie banner/tool and we do not use cookies for advertising or behavioural tracking through a consent mechanism.

If our website uses cookies at all, they are intended to be strictly necessary for basic site functionality. You can control cookies via your browser settings. If we introduce analytics or other non-essential cookies in future, we will update this notice and implement an appropriate notice/consent approach where required. ICO

9) How long we keep personal data (retention)

We keep personal data only for as long as necessary for the purposes described in this notice, including:

  • providing services and support;
  • maintaining business records;
  • complying with legal, tax, and accounting obligations;
  • resolving disputes and enforcing agreements.

Retention periods vary by data type and purpose. You can request more detail by emailing info@oxfirst.com.

10) Your rights and choices (UK)

Depending on your circumstances, you may have rights to:

  • access your personal data,
  • correct inaccurate data,
  • request deletion,
  • restrict or object to processing,
  • data portability,
  • withdraw consent (where we rely on consent). ICO

To exercise your rights, email info@oxfirst.com with “Privacy Request” in the subject line and describe your request.

11) Children’s data

OxFirst does not knowingly collect personal data from children in the context of online services aimed at children. Under UK GDPR rules on online services, children under 13 cannot provide their own consent for information society services where consent is relied upon. ICO+1
If you believe we have collected children’s personal data in error, please contact us and we will take appropriate steps to delete it.

12) Security

We use organisational and technical measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

13) Changes to this Privacy Notice

We may update this Privacy Notice from time to time. If we make material changes, we will post a notice on our website and/or notify you by email where appropriate.

14) Complaints (UK)

If you have concerns, please contact us first at info@oxfirst.com so we can try to resolve them.

You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO). The GOV.UK guidance lists ICO contact details (including Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF and the ICO helpline number). GOV.UK+1