OxMatch did not respond to Cherwell’s queries regarding why such emails would be sent, especially as they appear to be “incompatible” with the purpose of communicating regarding a match and this use was not specified within the sign-up form. However, MyTutor confirmed to Cherwell that the email was sponsored – although not for a “substantial” amount. They continued: “OxMatch reached out to propose we sponsor one of their emails, and we were disappointed to learn that the message may not have been sent in line with their privacy agreement with users. As such we won’t be working with them again, and will be updating our due diligence process when sending sponsored messages via third parties in future. We note that OxMatch have updated their privacy guidelines to refer to third party marketing but that should not be taken as meaning that we endorse or have approved this update.”
OxMatch told Cherwell: “In accordance with GDPR, we process and release data only in anonymous forms for statistical analysis. All data is kept anonymous and identifiable data is not shared with any third parties.” OxMatch refused to confirm how long data is kept or how data is stored.
In December 2020, OxMatch collaborated with student paper The Flete to release an “OxMatch Campus Report”, running through the answers of those who signed up, including answers to a series of questions like which subjects signed up, political leanings, crushes and a diagram of kinkiness levels at each college.
OxMatch’s own Privacy Guidelines and Data Practices, effective from November 20th 2020, were shared with each of the participants at the beginning of their form. It stated: “We also gather metadata: statistics about how the student population as a whole answered. This is just for fun posts on our Facebook: it’s always anonymised, and we’ll only use data aggregated across at least 15 people.”
Individuals who wish to know what data any company holds on them can make a subject access request under GDPR law. This request can be made via email, social media or any other reasonable means of communication. By the same method, these individuals can request that their data is deleted.