Privacy notice
How we handle your information
Who is responsible for your data
The Oxford Saudi Society, an independent student society, is the data controller for the personal information described in this notice. For any question about your data, or to use any of your rights, contact the committee at hello@oxsss.org.
What we collect
When you apply for membership: your name, email, the membership type and your status, and the details that go with that status — such as your university, college or department, your Oxford SSO username if you choose to give it, your hospital, employer, role or specialty, or how you describe your connection to Oxford — and your mobile number if you choose to give it. If you choose the free Saudi Oxford Community Membership, or ask to be assessed for it, we record that you have stated that you are a Saudi national; nobody else is asked about nationality. When you subscribe to the mailing list: your email address, your name if you give it, and the topics you choose. When you register to volunteer: your name, email, the areas you choose and where you prefer to volunteer, and your mobile number if you give it. When you register for an event: your name and email, and any dietary or access requirements you choose to tell us. When you sign in, a single cookie keeps you signed in; we use no advertising or tracking cookies.
Proof of nationality for free membership
The Saudi Oxford Community Membership is free for Saudi nationals with an educational, clinical, research or professional connection to Oxford, so after you apply the committee’s secretary may email you to ask for one document — the photo page of a passport, a national ID or a scholarship confirmation — purely to check eligibility. The request comes from an address ending in @oxsss.org; send the document only in reply to that email, and never before you are asked. Only the committee members who carry out the check see it, and the email and its attachment are deleted as soon as the check is done. We keep only the result of the check — never the document or its number.
The community directory
Appearing in the community directory is entirely optional, and the committee adds each profile only with that person's explicit consent. Everything shown in a profile — name, bio, photo and any email or number — is published openly on this site, and you can ask for it to be changed or removed at any time by emailing us.
The ideas board
The ideas board is run on Canny, an independent provider. To post, vote or comment you sign in with Canny (Google or email), and Canny processes your name, email and what you write under its own privacy policy. Reading needs no sign-in. The committee sees contributors' names and emails inside Canny only to run the board.
Why we use it, and our lawful bases
We use your information only to run the Society: to administer membership, organise events and — if you opted in — tell you what is happening. We do not sell your data or share it with anyone for marketing. Membership fees are arranged directly with the treasurer; this website does not take card payments.
Under UK data protection law (the UK GDPR) we rely on the following lawful bases. Membership — processing is necessary for our agreement with you as an applicant or member, and for our legitimate interest in running the Society and checking eligibility, including the nationality check for free membership. Event registrations — our legitimate interest in organising the events you ask to attend or hear about. The mailing list, volunteer registration and the public directory — your consent, which you can withdraw at any time. Dietary and accessibility information — your explicit consent, given when you choose to tell us; it is used only for that event. Financial records — our legal obligations, where they apply.
Who processes it for us
We use a small number of service providers, who handle data only on our instructions: Netlify (website hosting, the forms and the membership and events database), GitHub (the website's content files), Resend (sending our emails) and Google Workspace (the committee's mailboxes). Canny runs the ideas board as a separate service that you sign in to yourself. Inside the Society, your information can be seen only by authorised committee members.
Where it is kept, and transfers outside the UK
Membership applications and event registrations are stored in the Society's website system. The website is hosted on Netlify, and its content files are managed on GitHub. These providers, and the others named above, are based in or store data in the United States and other countries outside the UK. Where your data leaves the UK, it is protected by safeguards recognised in UK law — an adequacy decision such as the UK–US data bridge where the provider is certified, or the provider's standard contractual clauses.
How long
Membership records are retained during membership and deleted 12 months after membership ends. Event registration records are deleted 30 days after the event. Dietary and accessibility information is deleted within 7 days after the event.
Nationality-verification documents are deleted immediately after verification. Financial transaction records are retained for six years from the end of the relevant financial year where legally required. Records required for an ongoing legal claim or legal obligation may be retained for as long as necessary.
A mailing-list subscription is kept until you unsubscribe, and a volunteer registration until you withdraw it; you can do either yourself, at any time, from My account.
Your rights
You can ask for a copy of your data, have it corrected or deleted, ask us to restrict or stop using it, and withdraw any consent you have given, at any time. Email hello@oxsss.org and we will reply within one month.
How to complain
If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call the ICO helpline on 0303 123 1113.
Last updated: 10 November 2026.