OxFirst Club Privacy Notice (UK)

Last updated: 21 September 2026

OxPrime Limited, trading as OxFirst Club (“OxFirst Club”, “we”, “us”), respects your privacy. This Privacy Notice explains how we collect, use, share and protect personal data when you interact with OxFirst Club, including through our website, membership activities, events and communications.

This notice is intended to meet the transparency requirements under the UK GDPR and Data Protection Act 2018 (as amended).

1) Who we are (data controller) and how to contact us

OxPrime Limited, trading as OxFirst Club, is the data controller for the personal data described in this Privacy Notice.

Controller: OxPrime Limited (company number 14326070), trading as OxFirst Club

Registered office address: Belsyre Court, 1st Floor, 57 Woodstock Road, Oxford, England, OX2 6HJ

Privacy contact email: info@oxfirst.com (use subject: “Privacy Request”)

2) Scope

This Privacy Notice applies to personal data processed by OxFirst Club in connection with:

• our website, membership registrations and member accounts;
• our communications and relationship management;
• our products and services;
• events, webinars and activities;
• relationships with clients, partners, volunteers, contractors and other contacts;
• website analytics, cookie preferences and advertising measurement, where applicable.

3) Personal data we collect

We may collect the following categories of personal data, depending on your relationship with us:

Identity and contact data: name, email address, phone number, postal address, job title, employer/organisation.

Membership and account data: membership enquiries, registration information, account information and information relating to your participation in OxFirst Club.

Event and participation data: registrations and attendance.

Transaction and record data: invoices, billing details, payment confirmations and purchase records.

Communications data: emails/messages you send us, requests for support, feedback or survey responses.

Content you provide: information you upload or provide to us, such as forms, documents and submissions.

Technical and website usage data: information relating to your device, browser and use of our website, which may include IP address and other online identifiers, browser type, device information, pages visited, referral information and interactions with our website.

Cookie and consent data: information about the cookie choices and consent preferences you make through our cookie settings tool.

Analytics and advertising data: where you consent, information about how you reached and used our website and whether advertising resulted in actions such as a registration.

Event media: photographs, video or audio recordings where OxFirst Club events or activities are photographed or recorded. Where appropriate, additional information will be provided in connection with the relevant event.

4) How we collect personal data

We collect personal data:

• directly from you, for example through forms, registrations, purchases or emails;
• from your organisation where it provides your professional contact details in the context of services or events;
• automatically when you use our website, through necessary website technologies and, where you consent, analytics or advertising technologies; and/or
• from service providers that support our website, membership activities, events or communications.

5) How we use your personal data (purposes and lawful bases)

We only process personal data where we have a lawful basis under the UK GDPR. Depending on the circumstances, those bases may include:

• Contract – where processing is necessary to provide services, membership benefits or event participation that you have requested.
• Legitimate interests – where processing is reasonably necessary for our legitimate interests or those of a third party and those interests are not overridden by your rights and interests. Our legitimate interests may include operating, administering and developing OxFirst Club; managing membership and professional relationships; organising and improving events, services and activities; maintaining appropriate business and compliance records; protecting our systems, organisation and legal rights; preventing fraud, misuse and security incidents; and communicating with members and professional contacts where permitted by law.
• Consent – where you choose to opt in, including where consent is required for non-essential cookies or similar technologies.
• Legal obligation – where processing is necessary to comply with tax, accounting, regulatory or other legal obligations, or to respond to lawful requests.

Where we rely on legitimate interests, we assess the purpose and necessity of the processing and the impact on the individuals concerned, as required by applicable law.

Our main purposes include:

1. To deliver services and process transactions, including managing orders, invoicing and records.
2. To respond to enquiries and provide support.
3. To administer events and activities, including confirmations, logistics and updates.
4. To administer membership enquiries, registrations, member accounts and membership relationships.
5. To manage and develop our professional, partner and organisational relationships, and to communicate about OxFirst Club activities where permitted by law.
6. To improve our services and activities, including through feedback you provide.
7. To protect our website, systems, events and services against fraud, misuse and security risks, and to establish, exercise or defend legal claims or protect our legal rights.
8. Where you consent, to understand how our website is used through analytics and to measure the effectiveness of our advertising.
9. Where applicable, to document and promote OxFirst Club events and activities through photographs, video or audio recordings, subject to appropriate notices and applicable data protection requirements.

6) When we share personal data

We may disclose personal data where reasonably necessary for the purposes described in this notice, where permitted by law, or where required to meet a legal or regulatory obligation.

Depending on the circumstances, recipients may include:

• website hosting, IT, cybersecurity and technical service providers;
• membership, registration, communications and event-service providers;
• payment, invoicing or accounting service providers, where relevant;
• website security, anti-spam or CAPTCHA providers, where relevant;
• co-hosts, venues, sponsors and event service providers where reasonably necessary to organise, administer or deliver an event, or where another lawful basis permits the disclosure;
• Google, where applicable, in connection with Google Analytics and Google Ads and subject to your cookie choices;
• professional advisers, insurers, auditors and other advisers where reasonably necessary;
• prospective purchasers, investors, lenders or their advisers in connection with a proposed corporate transaction, subject to appropriate safeguards; and
• public authorities, regulators, courts or other bodies where required by law or necessary to respond to a valid legal request or protect our legal rights.

Events and third parties

Where an event involves a co-host, venue, sponsor or service provider, we may share limited attendee or participation information where reasonably necessary to organise, administer or deliver the event, or where another lawful basis permits us to do so. Where required by law, we will provide additional information or obtain consent before doing so.

Third parties present at an event, such as sponsors or exhibitors, may also ask you directly for your details at booths, meetings or during sessions. Providing your information to them is optional and is subject to their own privacy practices.

Corporate transactions

If OxPrime Limited or OxFirst Club is involved in a merger, acquisition, financing, reorganisation, sale of assets or similar transaction, personal data may be disclosed or transferred as part of that transaction, subject to applicable law and appropriate safeguards.

7) International transfers

Some of the service providers we use may process personal data outside the UK. This may include providers of website, analytics, advertising, communications, security or other technology services.

Where personal data is transferred outside the UK to a country that is not covered by UK adequacy regulations, we will use an appropriate transfer mechanism or other safeguard required by applicable UK data protection law.

Where you enable Google Analytics or Advertising technologies, information may be processed by Google and its service providers in countries outside the UK, subject to applicable data protection safeguards.

8) Cookies and similar technologies

OxFirst Club uses cookies and similar storage and access technologies to operate and secure our website, remember your preferences and, where you consent, understand how the website is used and measure the effectiveness of our advertising.

Our website currently uses the following categories of technologies:

• Necessary: technologies required to make the website work, maintain security and remember your cookie choices. These may be used without consent where an applicable legal exception permits this.
• Analytics: with your permission, we use Google Analytics to understand how our website is used, including which pages are visited and how visitors arrive at our website.
• Advertising: with your permission, we use Google Ads technologies to measure the effectiveness of our advertising, including whether an advertisement led to an action such as a registration.

Non-essential Analytics and Advertising technologies are not enabled through our consent tool unless you choose to allow them. You can choose “Accept all”, “Reject all”, or manage individual categories through our Cookie settings tool.

You can change or withdraw your cookie choices at any time through the Cookie settings link on our website. We may update the technologies or providers we use from time to time. Where a change requires fresh consent or updated information under applicable law, we will take the appropriate steps.

Information processed through analytics or advertising technologies may include information about your device and browser, pages visited, referral or campaign information, interactions with the website and online identifiers.

Individual storage and access technologies may operate for a session or for a longer period depending on their purpose and configuration. We review the technologies we use and their duration and seek to keep them no longer than reasonably necessary for the relevant purpose. Current choices and providers are made available through our Cookie settings tool.

Your browser may also allow you to block or delete cookies. However, blocking technologies that are necessary for the operation of the website may affect the availability or operation of some functions.

9) How long we keep personal data (retention)

We keep personal data for no longer than reasonably necessary for the purposes for which it is processed, taking into account our operational, legal, regulatory, tax, accounting and compliance requirements.

We may retain personal data for longer where reasonably necessary to:

• comply with legal, regulatory, tax or accounting obligations;
• establish, exercise or defend legal claims or protect our legal rights;
• resolve disputes or enforce agreements;
• prevent or investigate fraud, misuse or security incidents; or
• maintain appropriate business, governance and compliance records.

Retention periods vary according to the nature of the information, the purposes for which it is used and the circumstances in which it was collected. In deciding how long to retain information, we may consider its nature and sensitivity, applicable limitation periods, legal or regulatory requirements, the risk of harm from unauthorised use or disclosure and whether the relevant purpose can be achieved in another way.

You can request further information about our retention practices by emailing info@oxfirst.com.

10) Your rights and choices (UK)

Depending on the circumstances, you may have rights under UK data protection law to:

• access your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of your personal data;
• restrict the processing of your personal data;
• object to certain processing;
• receive certain personal data in a portable format; and
• withdraw consent where we rely on consent.

These rights are not all absolute. They may be subject to conditions, limitations and exemptions under applicable data protection law. Where the law permits us to decline or limit a request, we may do so and will explain our reasons where required.

Where you withdraw consent, this does not affect the lawfulness of processing carried out before you withdrew it.

To exercise your rights, email info@oxfirst.com with “Privacy Request” in the subject line and describe your request.

We may request information reasonably necessary to confirm your identity, locate the relevant information or understand the scope of your request. We will handle requests in accordance with the applicable legal requirements and time limits.

11) Children’s data

OxFirst Club’s services are not directed at children and we do not knowingly collect personal data from children through services aimed at them.

Under UK data protection rules applying to online services, children under the age of 13 cannot provide their own consent for an information society service where consent is the lawful basis relied upon.

If you believe we have collected a child’s personal data in error, please contact us and we will take appropriate steps to address the matter, including deletion where appropriate.

12) Security

We use organisational and technical measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal data is limited as appropriate to people and service providers who reasonably require it for their work or to provide services to us, subject to relevant confidentiality and security arrangements.

13) Changes to this Privacy Notice

We may update this Privacy Notice from time to time.

If we make material changes, we will post an updated notice on our website and/or notify you by email or another appropriate method where required or appropriate.

The “Last updated” date at the top of this Privacy Notice indicates when it was most recently revised.

14) Complaints (UK)

If you have a concern or complaint about how we have handled your personal data, we encourage you to raise it with us first and to allow us to complete our internal data protection complaints procedure so that we have an opportunity to investigate and, where appropriate, resolve the matter.

You can make a data protection complaint by emailing info@oxfirst.com with “Data Protection Complaint” in the subject line and providing sufficient information for us to understand and investigate your complaint.

We may ask you for information that is reasonably necessary to investigate the complaint. We will acknowledge receipt within 30 days unless we have already provided a substantive outcome within that period. We will investigate the complaint appropriately and without undue delay, keep you informed of relevant progress as required, and communicate the outcome.

If you remain dissatisfied after we have provided our final response, or if we have not provided an outcome without undue delay, you may complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

We encourage you to allow us the opportunity to complete our internal complaints procedure before referring the matter to the ICO. This does not affect your statutory right to contact or complain to the ICO at any point.

Further information about making a complaint and the ICO’s current contact details are available at ico.org.uk.