PRIVACY POLICY

OXFORD SPACE SYSTEMS PRIVACY POLICY

Oxford Space Systems (“we”, “our” or “us”) is committed to protecting your personal data. This privacy policy informs how we collect, use and protect your personal information, tells you about your privacy rights and how the law protects you. We handle personal data in accordance with the UK GDPR and the Data Protection Act 2018.

If you have any queries about this privacy policy or how we handle your personal information, please get in touch with us by contacting our team: explore@oxford.space

Data Protection Principles

We will comply with data protection law, meaning that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way incompatible with those purposes.
• Accurate and kept up to date.
• Adequate, relevant to the purposes for which it is collected and not excessive.
• Kept only as long as necessary for the purposes we have explained.
• Kept safely and securely.
• Not transferred to other countries without adequate protection.

Personal Information

‘Personal information’ shall mean information relating to living persons, including name, date of birth, telephone number, addresses, office of work or other personal data, which enables a certain individual to be identified and information that when used with other information can be easily referenced allowing the identification of an individual.

How we collect your information

We collect your personal information when you:

• Enter your details on our website to download our brochures in the products pages
• Complete forms, for example when signing up to our newsletter
• Apply for vacancies through our careers site
• Order a product, enter into a contract, or establish a supplier relationship with us
• Visit our premises (for example, as a visitor or investor)

The type of personal information we collect from you

We may collect, use, store or transfer different kinds of personal data about you.

• Name, Surname
• Email address (personal / professional), country and company
• Recruitment information (e.g., CV, certificates, equality & diversity data).
• Marketing & communications data: your preferences in receiving marketing from us and your communication preferences.
• Telephone number (landline and mobile) and role information, where you provide these as a customer, supplier, investor or visitor
• Car registration details and CCTV footage, where you visit our premises

How we will use your information

Oxford Space Systems will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.

• To communicate with you in relation to our products
• For customer services purposes including providing products information to you, for technical support or other similar purposes and to establish and maintain customer accounts.
• To enforce our contractual terms with your or for the exercise or defence of legal claims and to protect our rights.
• For marketing and promotional purposes including communications through email or equivalent electronic means. For example, we may use your personal data such as your email address to send you newsletters and/or updates or to otherwise contact you about products or information we think may interest you.
• For research and development purposes including improving our websites, applications, services and for other research or analytical purposes dedicated to improving our products, services, operations or processes
• To assess your suitability for a vacancy you have applied for
• To analyse equality & diversity data to assess how our recruitment campaigns are attracting a diverse range of applicants
• To communicate with you about your investment or potential investment, where you are an investor
• For security purposes and to comply with health and safety obligations, including where you visit our premises
• Where we need to comply with a legal obligation

Provision of Personal Information to Third Parties

Oxford Space Systems shall not, except in the cases set out below, provide any personal information to a third party without the prior consent of the individual to whom the personal information relates.

If Oxford Space Systems provides personal information to a third party, it will require that the third party takes appropriate security measures to protect your personal information. We do not allow such third parties to use your personal information for their own purposes and permit them to process it only for specified purposes and in accordance with our instructions. The third-parties who may receive your personal data are:

• Authorised persons working for or on behalf of Oxford Space Systems
• Our agents, service providers (e.g., IT maintenance, payroll providers, pension providers, cloud services (SaaS) and cloud hosting) and advisers
• Other authorised third parties in connection with any auditing, reorganisation, financing or sale, business transfer, corporate separation of Oxford Space Systems business or assets.
• Other third parties who are identified as our partners in relation to any missions or programmes in relation to which your personal data has been provided.

We may also need to share your personal information with a regulator or to otherwise comply with the law.

Third party links

Our website may include links to other websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or practices. When you leave our website, we encourage you to read the privacy notice of all websites you visit.

How we store and secure your personal information

All data stored on the company’s servers will be held in a secure manner and processed for fair and lawful purposes in line with the business’ needs. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal information to those who have a business need to know, and they are subject to a duty of confidentiality. We have procedures to deal with any suspected data security breach and will notify you and any applicable regulator where we are legally required to do so.

Transferring your data outside the UK

Personal data may be transferred to and processed in countries outside the United Kingdom where our third-party service providers (such as IT systems, cloud hosting, payroll or cloud service (SaaS) providers) operate internationally. Where this occurs, we ensure appropriate safeguards are in place to protect your personal data in accordance with UK data protection law. These safeguards may include:

• Transfers to countries recognised by the UK Government as providing an adequate level of data protection;
• Transfers to organisations certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”), where applicable;
• The use of International Data Transfer Agreements (IDTAs); and
• The UK Addendum to the EU Standard Contractual Clauses (SCCs).

These measures ensure that personal data receives a level of protection comparable to that provided under UK law. Further information about international data transfers and the safeguards we use can be obtained by contacting us using the details in this Privacy Policy.

How long we keep your information

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements. To determine the appropriate retention period we consider the amount, nature and sensitivity of the data, the purposes for which we process it, and the applicable legal requirements. For example: Recruitment data is kept for 12 months from closure of the relevant job opportunity; CCTV footage is retained for approximately 30 days.

CCTV

If you visit our premises, we operate external and internal CCTV cameras for security purposes. Footage is recorded and retained for approximately 30 days and may be used for investigative purposes if an incident occurs. Access to recorded footage is limited to authorised personnel.

Your legal rights

As an individual whose personal data is processed by Oxford Space Systems, you have the following rights:

• The right to be informed about how we use your personal data, which is what this privacy policy is for.
• The right to access the personal data we hold about you, known as a “data subject access request”. This enables you to receive a copy of the personal data we hold about you and to check that we are using your information in accordance with data protection law.
• The right to request correction of the personal data we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• The right to object to direct marketing – either use the unsubscribe option or contact us directly.
• The right to object to processing for certain types of processing, including direct marketing
• The right to request erasure your personal data. This enables you to ask us to delete or remove personal data where there is no reason for us continuing to process it.
• The right to data portability.
• The right to have your data restricted or blocked from processing.
• The right to withdraw your consent to our processing of your personal data. If you have given consent to anything we do with your information and we are relying on that consent as a legal basis for processing your information, you can withdraw consent at any time. Withdrawing consent will not make our use unlawful of any processing whilst consent had been apparent.
• Lodge a complaint about the processing of your data. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

If, at any time, you want to verify, update or amend your personal data please email explore@oxford.space. You will not have to pay a fee to exercise your rights, although we may charge a reasonable fee, or refuse to comply, if a request is clearly unfounded or excessive. We may need to request specific information from you to confirm your identity before acting on a request.

Updates to Privacy Policy

We may revise or update this Privacy Policy from time to time. Any changes to this Privacy Policy will become effective upon posting of the revised Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. If we make changes which we believe are significant, we will inform you through the Website to the extent possible and seek your consent where applicable.