Privacy notice
This notice explains what personal data the Oxford University Quantum Information Society (OUQIS) collects, why we collect it, how long we keep it, and what you can ask us to do about it. It is written to be read, not to be survived.
Last updated: 15 August 2026 · Version 1.0
Who we are
OUQIS is a student-run society at the University of Oxford. We are a data controller for the personal data described below, which means we decide why and how it is used.
We are not a department of the University of Oxford, and this notice does not cover anything the University does with your data.
For anything to do with your data, contact us at quantuminformationsociety@gmail.com, marking your message for the attention of the committee member responsible for data protection.
To be completed before publication: UK GDPR Article 13(1)(a) requires the controller's identity and contact details. An email address alone is thin for a controller; add the society's correspondence address (normally care of Oxford SU, 4 Worcester Street, Oxford OX1 2BX, if the committee confirms that is correct) and name the committee role accountable for data protection.
What we collect, and why
There are four places we might hold something about you. Only two of them involve us storing anything.
| Where | What we collect | Why | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Newsletter sign-up | Your email address; your name if you give it; the exact consent wording you agreed to, its version, and the date and time you agreed | To send you the OUQIS newsletter: talks, quantum news and opportunities, usually weekly in term | Consent (UK GDPR Art 6(1)(a)); PECR reg 22 for the emails themselves | Until you unsubscribe. We then keep a record that you unsubscribed, and the consent record, for 12 months, so we can evidence that consent was given and acted on. After that, deleted. |
| Contact form | Your name, email address, the topic you chose, and your message | To read and reply to your enquiry | Legitimate interests (Art 6(1)(f)). Running a society means answering the people who write to it. You would reasonably expect this, and it has no meaningful impact on your privacy. | 24 months from your last message in the thread, then deleted. Longer only if the exchange becomes an ongoing arrangement (for example a speaker booking), in which case it is kept for the duration of that arrangement plus 12 months. |
| The free course | Your progress through the missions, your quiz scores, and any name you type on the certificate | So the course remembers where you were | None needed. This never leaves your device. See below. | Until you clear your browser storage. We cannot delete it for you, because we never have it. |
| Speakers and committee members | Name, role, department or affiliation, and where you have agreed to it, a photograph and the title of your talk | To publish who spoke and who runs the society | Consent for photographs; legitimate interests for the public record of who spoke and when, which is ordinary academic practice | Indefinitely, as a historical record of the society's programme. Photographs are removed on request. |
Course progress in more detail
The Quantum Courier Service course stores your progress in your own browser, using
localStorage. It is never transmitted to us, and we have no way of seeing it.
We do not know who takes the course, how far anyone gets, or what anyone scores. There is no
sign-up and no account.
Because that storage is strictly necessary to provide a service you explicitly asked for, it is exempt from the consent requirement in regulation 6 of PECR. We are telling you about it anyway, because you should know what is on your machine.
Clearing your browser's site data for this site will erase your progress permanently. We cannot recover it.
Is any of this compulsory?
No. You are not required to give us anything. You can read every page of this site, take the entire course start to finish, and attend our talks without giving us your name or any other detail. The newsletter and the contact form are the only places we ask, and both are voluntary. Nothing is withheld from you if you decline.
Who else sees it
We do not sell, rent or share your data with anyone for their own purposes. We do not do advertising and we do not run advertising trackers.
Your data does pass through these organisations, acting on our instructions:
- Google. Both the newsletter form and the contact form submit to a Google Apps Script, and the resulting records are held in Google's services. Google therefore processes your name, email address and message.
- Netlify. This site is hosted by Netlify, which processes server logs including IP addresses as a normal part of serving web pages.
To be completed before publication: two things here need a human decision,
both flagged in section 3.4 of the audit. (1) The forms currently submit to an Apps Script
that is almost certainly bound to a personal @gmail.com account. If so there is
no Article 28 processor contract in place, and this section cannot honestly claim there is.
Moving to Google Workspace on a society-owned domain fixes it. (2) The
international transfers paragraph below states the mechanism relied on;
whoever signs this off must confirm it is actually the mechanism that applies to the
account in use.
Where your data goes
Google and Netlify both process data outside the UK, including in the United States. Where that happens, the transfer relies on the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it.
Cookies and similar technologies
This site sets no advertising or analytics cookies. The only local storage we use is the course progress described above, which is strictly necessary and therefore consent-exempt. There is no cookie banner because there is nothing to consent to.
If we later add analytics, we will use a cookieless, privacy-preserving service that does not track individuals across sites, and we will say so here before it goes live.
Your rights
Under UK GDPR you have the right to:
- Be told what we hold about you and why. That is this notice.
- Get a copy of your data (a subject access request).
- Have it corrected if it is wrong or incomplete.
- Have it erased in the circumstances where that right applies.
- Restrict how we use it while a dispute about it is resolved.
- Portability: receive data you gave us in a machine-readable form, or have it sent elsewhere.
- Object to processing based on legitimate interests. Where we rely on legitimate interests for the contact form, you can object at any time and we will stop unless we have compelling grounds not to.
- Not be subject to automated decision-making. We do not do any. There is no profiling and no automated decisions with legal or similarly significant effects.
To exercise any of these, email quantuminformationsociety@gmail.com. We will respond within one month. There is no charge.
Withdrawing consent
Where we rely on your consent, meaning the newsletter and photographs, you can withdraw it at any time, and it is as easy to withdraw as it was to give. Use the unsubscribe link in any newsletter, or email us and say so. Withdrawing consent does not make anything we did beforehand unlawful, but we will stop straight away.
Complaints
If you think we have handled your data badly, please tell us first, because we would rather fix it. But you have the right to complain directly to the UK's data protection regulator, the Information Commissioner's Office, and you do not have to come to us first:
- Online: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Children and young people
The course is written to be usable by anyone, including teenagers, and we are glad when school students take it. It requires no sign-up and stores nothing about them on our side, so taking the course involves no collection of children's data at all.
The newsletter is a different matter. In the UK, a child aged 13 or over can consent to an online service on their own behalf. If you are under 13, please ask a parent or guardian to subscribe on your behalf rather than signing up yourself. If we learn that we hold a subscription for a child under 13 without that consent, we will delete it.
Changes to this notice
If we change this notice we will update the date and version at the top of the page. If a change materially affects how we use data you have already given us (a new purpose, a new recipient, or a longer retention period) we will tell newsletter subscribers by email before it takes effect, and we will not apply it retrospectively without asking you.
Previous versions are available on request.