Privacy Policy

Last updated: 27 March 2026; Version: V2

1. Introduction & Ethical Approval

This Privacy Policy explains how researchers at the Leverhulme Centre for Demographic Science (LCDS) at the University of Oxford ("we", "our", "us") collect, use, and protect your personal data when you participate in The National Conversation survey. We are committed to protecting your privacy and ensuring your data is handled in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Ethical Approval: This research project has been independently reviewed and approved by the University of Oxford’s Central University Research Ethics Committee (CUREC) (ID 2799856).

Data Controller: The University of Oxford is the "Data Controller" for this project. This means we are responsible for deciding how we hold and use personal data about you.

2. What Data We Collect

When you interact with and participate in our survey, we collect the following categories of data:

• Survey Responses: Your answers to multiple-choice and open-ended text questions.
• Voice Notes (Optional): Audio recordings if you choose to answer certain questions using our voice note feature.
• Contact Information (Optional): Your name and email address, collected only at the very end of the survey if you explicitly opt-in to receive project updates.
• Technical Metadata: Information about your interaction with the survey, including:
  • Timestamps (when you started, submitted, and when the server processed the data).
  • A cryptographically "hashed" (anonymized) IP address.
  • Country code (e.g., "GB").
  • Browser and device family (e.g., Edge, Mobile).
• Referral and Analytics Data (Subject to Consent): The website URL that directed you to our survey (e.g., a news article or community partner site) and related behavioural analytics data captured via Google Analytics 4 (GA4).

3. How and Why We Use Your Data (Legal Basis)

Under the UK GDPR, we must have a lawful basis to process your personal data.

A. Task in the Public Interest (Article 6(1)(e)) As a university conducting academic research, our primary lawful basis for processing your survey responses and metadata is that it is necessary for the performance of a task carried out in the public interest. We use this data to conduct academic research and analyse societal trends.

B. Explicit Consent (Article 6(1)(a) & Article 9(2)(a)) We rely on your explicit, freely given consent for the following:

• Voice Notes: Because your voice is unique and potentially identifiable, we will ask for your explicit consent before you record a voice note, and again to confirm whether we and our specific partners may reuse or broadcast these recordings.
• Mailing List: We rely on your consent to store your name and email to send you research updates.
• Referral Tracking & Analytics: We rely on your consent (managed via our Cookie & Tracking Banner) to deploy Google Tag Manager (GTM) and Google Analytics 4 (GA4) to track the referral domain that brought you to the survey to understand participation bias.

C. Legitimate Interests (Article 6(1)(f)) We process technical metadata (like your hashed IP and timestamps) to prevent spam, detect fraudulent submissions, and ensure the security of our university servers.

4. How We Share Your Data

We do not sell your data, nor do we share it with third parties for advertising or marketing purposes. Information is only shared under strict conditions:

• Our Partners (Aggregate Data): We share entirely anonymized, aggregate referral numbers (e.g., "500 participants came from the news story X") with media and community partners to help them understand their audience's engagement with the research.
• Our Partners (Voice Notes): Only if you provide explicit, granular consent, we may share your specific voice notes with these partners for use in related project communications or broadcasts.
• Essential Service Providers (Data Processors): To make the survey function, we use trusted third-party cloud providers acting under strict data processing agreements:
  • AWS Location Service: To process mapping and geographic data securely.
  • Postcodes.io: An open-source API to validate your postcode. (Note: Using these features means your IP address is temporarily transmitted to these processors strictly for the purpose of the request).
• Analytics Providers: If you consent to analytical tracking, your referral data is processed by Google LLC via Google Analytics 4.

5. International Data Transfers

Because we use Google Analytics 4 to process referral data, the analytics information collected about your visit may be transferred to, and stored on, Google's global network of servers located outside of the United Kingdom (such as in the United States). When this happens, we rely on UK GDPR-approved restricted transfer mechanisms, such as the UK International Data Transfer Addendum and Google's standard contractual clauses, to ensure your data remains legally protected.

6. Data Storage and Retention

• Local Storage: As detailed in our Cookies & Tracking Technologies Policy, we use browser sessionStorage to save your survey progress. This is automatically and permanently deleted from your device when you close the browser tab.
• Analytics Data: Referral data collected via Google Analytics 4 is retained only for the minimum period necessary for our research (typically configured to 2 months) before being automatically deleted by Google.
• Retention: Your name and email address will be deleted once the research project and its related update communications conclude. Anonymised survey data and aggregated statistics will be retained indefinitely in the University of Oxford's research data archives, as they can no longer be linked to you.

7. Your Data Protection Rights

Under UK law, you have specific rights regarding your personal data. Because survey responses are designed to be anonymous, we may not be able to identify your specific data to delete or amend it once submitted unless you provided identifiable information (like contact details or an identifiable voice note).

Where we can identify you, you have the right to:

• Withdraw Consent: You can withdraw your consent for contact updates, analytics tracking, or voice note usage at any time.
• Access: Request a copy of the personal data we hold about you.
• Erasure/Rectification: Request that we delete or correct your personal data.

To exercise any of these rights, or to withdraw your consent, please contact the research team at: national.conversation@demography.ox.ac.uk

8. Complaints

If you have concerns about how we have handled your data, you can contact the research team at: national.conversation@demography.ox.ac.uk. If you remain dissatisfied, you can contact the University of Oxford’s Information Compliance Team at:

• Email: data.protection@admin.ox.ac.uk
• Post: Information Compliance Team, University of Oxford, Wellington Square, Oxford, OX1 2JD.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at https://ico.org.uk.