91����

1. The purpose of this policy is to ensure compliance with data protection law in the UK (the General Data Protection Regulation and related national legislation). Data protection law applies to the processing (collection, storage, use and transfer) of personal information (data and other personal identifiers) about data subjects (living identifiable individuals). 
    
2. Under data protection law, the College is identified as a data controller and as such is subject to a range of legal obligations.  For clarity, the University of Cambridge and the other Colleges in Cambridge are separate data controllers, with their own policies and procedures.  Sharing of personal information between the University and the Colleges is covered by a formal data sharing protocol. 
    
3. This policy applies to all staff and members of the college, except when they are acting in a private or external capacity.  For clarity, the term staff means anyone working in any context for the College at any level or grade (whether permanent, fixed term or temporary) and including employees, retired but active members and staff, visiting Fellows, workers, trainees, interns, seconded staff, agency staff, agents, volunteers, and external members of College committees.  Equally, the term member includes senior members (Fellows) and junior members (students and alumni) of the College when they are handling or processing personal information on behalf of the College, except when they are acting in a private or external capacity. 
    
4. This policy should be read in conjunction with:

• College Statutes and Ordinances;
• staff employment contracts and comparable documents (which outline confidentiality obligations when processing information of the College);
• policies, procedures and terms of conditions of the College and, where relevant, similar documents of the University of Cambridge with regard to:
• information security;
• acceptable use of IT facilities (including use of personal devices);
• records management and retention;
• any other contractual obligations on the College or the individual which impose confidentiality or information management obligations (which may at times exceed those of College policies with respect to storage or security requirements – e.g. for funded research).

5. This policy is approved by College Council.  It is reviewed at least once every three years.  The Council remains responsible for ensuring appropriate resources are in place to achieve compliance with data protection law in line with an appropriate overall risk profile. 

6. The College upholds data protection law as part of everyday working practices, through: 

• ensuring all personal information (see Annex) is managed appropriately through this policy;
• understanding, and applying as necessary, the data protection principles (see Annex) when processing personal information;
• understanding, and fulfilling as necessary, the rights given to data subjects (see Annex) under data protection law;
• understanding, and implementing as necessary, the College’s accountability obligations (see Annex) under data protection law; and
• the publication of data protection statements outlining the details of its personal data processing in a clear and transparent manner.

7. The College shall appoint a statutory data protection officer, who will be responsible for: 

• monitoring and auditing the College’s compliance with its obligations data protection law, especially its overall risk profile, and reporting on such annually to the College;
• advising the College on all aspects of its compliance with data protection law;
• acting as the College’s standard point of contact with the Information Commissioner’s Office with regard to data protection law, including in the case of personal data breaches; and
• acting as an available point of contact for complaints from data subjects.

8. The College shall otherwise ensure all members and staff are aware of this policy and any associated procedures and notes of guidance relating to data protection compliance, provide training as appropriate, and review regularly its procedures and processes to ensure they are fit for purpose.  It shall also maintain records of its information assets. 
    
9. Individual members and staff are responsible for:

• completing relevant data protection training, as advised by the College;
• following relevant College policies, procedures and notes of guidance;
• only accessing and using personal information as necessary for their contractual duties and/or other College roles;
• ensuring personal information they have access to is not disclosed unnecessarily or inappropriately;
• where identified, reporting personal data breaches, and co-operating with College authorities to address them; and
• only deleting, copying or removing personal information when leaving the College as agreed with the College and as appropriate.

Non-observance of the responsibilities in paragraph 9 may result in disciplinary action against individual members or staff.

10. The obligations outlined above do not waive any personal liability for individual criminal offences for the wilful misuse of personal data under data protection legislation.

 &�Բ�����;

The data protection principles state that personal data shall be:

• processed (i.e. collected, handled, stored, disclosed and destroyed) fairly, lawfully and transparently.  As part of this, the College must have a ‘legal basis’ for processing an individual’s personal data (most commonly, the processing is necessary for the College to operate a contract with them, the processing is necessary to fulfil a legal obligation, the processing is in the legitimate interests of the College and does not override their privacy considerations, or they have consented to the processing);
• processed only for specified, explicit and legitimate purposes;
• adequate, relevant and limited; accurate (and rectified if inaccurate);
• not kept for longer than necessary;
• processed securely. 

An individual’s rights (all of which are qualified in different ways) are as follows:

• the right to be informed of how their personal data are being used.  This right is usually fulfilled by the provision of ‘privacy notices’ (also known as ‘data protection statements’ or, especially in the context of websites, ‘privacy policies’) which set out how an organisation plans to use an individual’s personal data, who it will be shared with, ways to complain, and so on;
• the right of access to their personal data;
• the right to have their inaccurate personal data rectified;
• the right to have their personal data erased (right to be forgotten);
• the right to restrict the processing of their personal data pending its verification or correction;
• the right to receive copies of their personal data in a machine-readable and commonly-used format (right to data portability);
• the right to object: to processing (including profiling) of their data that proceeds under particular legal bases; to direct marketing; and to processing of their data for research purposes where that research is not in the public interest;
• the right not to be subject to a decision based solely on automated decision-making using their personal data. 

The College is required under law to:

• comply with data protection law and hold records demonstrating this;
• implement policies, procedures, processes and training to promote “data protection by design and by default”;
• have appropriate contracts in place when outsourcing functions that involve the processing of personal data;
• maintain records of the data processing that is carried out across the College;
• record and report personal data breaches;
• carry out, where relevant, data protection impact assessment on high risk processing activities;
• cooperate with the Information Commissioner’s Office (ICO) as the UK regulator of data protection law;
• respond to regulatory/court action and pay administrative levies and fines issued by the ICO. 

This statement explains how 91���� (“we” and “our”) handles and uses information we collect about applicants (“you” and “your”) for jobs.

In broad terms, we use your data to manage your application to the College and our subsequent recruitment processes.

The controller for your personal information is 91����, University of Cambridge, Huntingdon Road, CB3 0DF.  The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Bursar (Rob Hopwood) - bursar@murrayedwards.cam.ac.uk

The legal basis for processing your personal data is that it is necessary either in order for you to enter into an employment contract with us or for us to fulfil our legal obligations should we become your employer.

How your data is used by the College

Your data is used by us in the first instance solely for the purposes of considering your suitability for employment and for us to manage our recruitment processes, including our monitoring of equality and diversity within the College.  If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given below.

The College holds the following personal data relating to you, in line with the purposes above:

• *personal details, including name, contact details (phone, email, postal);
• *evidence of your right to work in the UK (e.g. copies of your passport or birth certificate and any relevant visas)
• your application form and associated information submitted by you at that time;
• other data relating to your recruitment (including references we take up as part of the recruitment process, any pre-employment assessment of you, and any assessment of you at an informal or formal interview);
• *any occupational health assessments and/or medical information you have provided, and related work requirements;
• * information relating to your age, nationality, gender, disability, religion or beliefs, sexual orientation, gender identification and ethnicity;
• any correspondence relating to the outcome of the recruitment process (either successful or unsuccessful).

Those marked with an * relate to information provided by you.  Other data and information is generated by us or, where self-evident, provided by a third party.

We will not access personal data about you from social media sites, unless there is a legitimate interest for us to do so (for example, the role you have applied for has a significant public-facing element to it, or is involved with publicity and presenting us to the general public).  Consequently, we do not routinely screen applicants’ social media profiles but, if aspects of your social media profile are brought to our attention and give rise to concerns about your suitability for the role in question, we may need to consider them. 

For certain posts, we may use the Disclosure and Barring Services (DBS) and Disclosure Scotland to help assess your suitability for certain positions of trust.  If this is the case, we will make this clear to you in separate correspondence.  Certificate and status check information is only used for this specific purpose, and we comply fully with the DBS code of Practice regarding the correct use, handling, storage, retention and destruction of certificates and certificate information.  We recognise that it is a criminal offence to pass this information on to anyone who is not entitled to receive it.

Who we share your data with

Information is not shared with other third parties without your written consent. 

If you are successful in your application, the data is subsequently held as part of your employment record with us. Where unsuccessful we retain all data and information for no more than 12 months after the closing date of the application process. 

In either case, where the post has required a “resident market test” (needed if the post is open to applicants from outside the European Union), the College will retain the application records of any shortlisted candidates for the duration of the sponsored post and twelve months thereafter.

Your rights

You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability).  Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

Failure to provide the information reasonably requested of you may result in an automatic disqualification from the recruitment process.

You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office. 

This statement explains how 91���� (“we” and “our”) handles and uses information we collect about visitors, guests and attendees of the College (“you” and “your”), for events and other reasons.  In broad terms, we use your information to manage your visit or the event(s) you are attending, including dinners and accommodation and other needs requested by you, as well as to maintain our records of previous, current and future attendees for events management for the College.

The controller for your personal information is 91����, Huntingdon Road, Cambridge, CB3 0DF. The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is Rob Hopwood, Bursar: bursar@murrayedwards.cam.ac.uk

The legal basis for processing your personal information is that it is necessary in order for you to enter into a contract to provide facilities and resources to you.  In many cases, you will be providing the personal information to us alongside consent for us to use that information to provide for your needs or otherwise to provide you with an improved service while you are at the College. We will retain your information for the periods stated below unless or until you request us to do otherwise. 

We collect and process your personal information for the following purposes:

• maintaining clear contact information for the booking, provision and payment of services. We will hold your name, address, email address, phone number and other relevant contact details you provide to us, and will use this information to maintain contact with you to provide your requested services, manage their delivery and bill you for them.  We retain relevant information in our events records for four years after the most recent visit or event you attend.  If you are a member of the College (including if you are a former student), we will provide our Development Office with your contact details in order for them to update their records, if you are happy for us to do this.
• providing you with necessary and preferred services.
• Where relevant, we will also collect data for the provision of services, your reason(s) for attending the event, your nationality and passport details, your car registration, your credit or debit card information and/or any service preferences you request specifically (e.g. room type, dietary requirements, amenities requested).  This may include you providing sensitive personal information.  We will not retain this information for any longer than necessary for the provision of the specific event or visit, which might require you to provide it on successive occasions.
• providing you with details about future College events.
• While we retain your contact information, we will contact you about future College events we believe may be of interest to you, providing you have given us explicit consent to do so.  Consent may be withdrawn at any time.
• fulfilling our legal obligations.

The College is required to keep for 12 months the names and nationalities of all those staying in accommodation.  In the case of nationals outside of the UK, Republic of Ireland and the Commonwealth, we must also keep a record of your passport details and next destination.  The College is also required to keep details relating to any financial transaction for a period of seven years.

We also operate CCTV on our site which will capture footage.  Our CCTV policy can be viewed here

We do not share personal information with third parties. If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given above.

You have the right: to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your information electronically to a third party (data portability).  Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

You retain the right at all times to lodge a complaint about our management of your personal information with the Information Commissioner’s Office at https://ico.org.uk/concerns/     

91���� is committed to respecting the privacy of its staff and to ensuring that the personal data that we hold for you is processed in a fair and transparent way in accordance with the Data Protection Act 1998 and the General Data Protection Regulation.

This statement explains how 91���� ("we" and "our") handles and uses information we collect about our staff ("you" and "your"). For these purposes, "staff" is intended to include employees, workers and casual workers and contractors (e.g. undergraduate supervisors, ad-hoc or temporary catering staff etc.) 

The controller for your personal information is 91����, University of Cambridge, Huntingdon Road, Cambridge, CB3 0DF. The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Bursar (Rob Hopwood) – Bursar@murrayedwards.cam.ac.uk 

How your data is used by 91����

In broad terms, we use your data to manage your employment with the College, including providing you with your remuneration and statutory benefits, managing your role and the performance of it, and supporting you as an employer, as well as fulfilling our statutory obligations relating to your employment.

For most of the personal data we request from you, the legal basis for processing it, unless otherwise stated, is the fulfillment of the employment contract we hold with you. We collect this data from you by means of the new joiner form which we ask you to complete at the start of your employment, plus subsequent correspondence with you, such as updates to your personal details.

In connection with your employment, some of the data we collect and process is so that we can fulfill our statutory legal obligations. This data is collected at the start of your employment and updated during your employment, and include:

• your personal identity and contact details (full name, date of birth, gender, postal address, NI number) to inform HMRC of your employment with us;
• evidence of your right to work in the UK (passport, birth certificate, visa) to comply with immigration law.

The kinds of purposes for which we may use your personal data in order to fulfill the employment contract or in some cases to comply with legal obligations as employer, fall into the following categories:

*Data marked above and below with an * relate to information most probably provided by you, or created in discussion and agreement with you. Other data and information is generated by the College or, where self-evident, provided by a third party.

• Ensuring that you have the right to work for the College:
• your recruitment documents* and information (including your application documents);
• other data relating to your recruitment (including your offer of employment and related correspondence, references, and any pre-employment assessment of you);
• your nationality and evidence of your right to work in the UK* (e.g. copies of your passport);
• the outcome of a Disclosure and Barring Service (DBS) check on you (where relevant to your role).
• Paying you and providing you with employment benefits:
• personal details* (full name, postal address, NI number, date of birth, gender)
• your bank details*;
• your current and previous salary (and other earnings e.g. maternity pay, allowances), and your tax information;
• your pension scheme and policy details*;
• your personal details such as may be needed to register you for employment benefits* (e.g. gym);
• sickness certificates, to ensure you are paid appropriately for company or statutory sick pay* (basing our processing of such data on condition (b) of Article 9(2) of the GDPR as this may be classed as special category data);
• your car registration for parking in the College car park* (where applicable);
• correspondence between you and the College, and between authorised staff of the College for legitimate processing purposes, relating to your pay and other remuneration, pension and benefits.
• Supporting your employment and your performance in your role:
• personal details* (name, contact details (phone, email, both work and personal);
• your current role description and any previous job descriptions;
• your current (and any previous) contracts of employment and related correspondence;
• any occupational health assessments and medical information you provide relating to your ability to carry out your role and any related work requirements you might need*; (we base our processing of such data on condition (h) of Article 9(2) of the GDPR as this may be classed as special category data,);
• any relevant dietary or religious requirements that might dictate your meal or other requirements as part of the College community (we base our processing of such data on condition (a) of Article 9(2) of the GDPR as this may be classed as special category data,);
• your training and development requirements, requests and qualifications*
• any legal undertaking you may be asked to participate in as part of your role.
• Administering HR-related processes, including records of absences and regular appraisals of your performance and, where necessary, investigations or reviews into your conduct or performance:
• a photo of you* for the provision of your College security card and for the staff photo board and in some cases the College website;
• details of your preferred emergency contact* (name, relationship to you and contact details) so that we can contact them in the event that something happens to you or we can’t reach you;
• records of your induction programme and its completion;
• records of your performance appraisals with your line manager;
• records, where applicable, of any investigation or review into your conduct or performance;
• records of Health & Safety matters or incidents so that the College can comply with its obligations under Health & Safety law and can maintain a safe and healthy working environment;
• records of roles you might undertake on behalf of the College e.g. in the capacity of First Aider;
• records of absences from work (including but not limited to annual leave entitlement, sickness leave, parental leave and compassionate leave)
• correspondence between you and the College, and between members and staff of the College, regarding any matters relating to your employment and related issues (including but not limited to changes to duties, responsibilities, benefits, your retirement, resignation or exit from College, personal and professional references provided by College to you or a third party at your request).
• details of how your post is funded.
• Ensuring that you are suitable for certain positions of trust.
• For certain posts, we may use the Disclosure and Barring Services (DBS) / Disclosure Scotland to help assess your suitability for a position of trust. If this is the case, we will make this clear to you. Certificate and status check information is only used for this specific purpose, and we comply fully with the DBS code of Practice regarding the correct use, handling, storage, retention and destruction of certificates and certificate information, recognising that it is a criminal offence to pass this information on to anyone who is not entitled to receive it.
• Disclosing personal information about you to external organisations, as permitted or required by law
• e.g. submissions to the Office of National Statistics
• e.g. the police, should you be involved in criminal activity or a criminal investigation

In a small number of cases, we exercise our legitimate organisational interest in collecting and / or processing data. This might include records of your use or take-up of any benefit schemes provided by us to enable us to monitor to review the effectiveness of these benefits and ensure that benefit schemes represent good value for money (both to you and us) and that you do not overuse your entitlements.

On rare occasions we might monitor social networking sites to ensure compliance with an agreed plan, such as a homeworking agreement but we would only do so if we had informed you in advance that we might do this. In almost all other regards we would not monitor social media sites for any personal data relating to you, but, if aspects of these are brought to our attention and give rise to concerns about your conduct, we may need to consider them. Our social media guidelines are available at: /. We also operate CCTV on our College site which will capture footage. Our CCTV policy is available here.

Please let us know of any concerns or queries you may have relating to any of these purposes, or to how we communicate with you.

Who we share your data with

We share relevant personal data with our sub-contracting agents and with relevant government regulatory bodies (e.g. HMRC or the Office of National Statistics).

We also share your relevant personal details with benefits providers e.g. your pension provider.

We also share personal identification details (your name and date of birth) with the University of Cambridge and / or its component institutions, for example in order to register you with its Information Systems department for an IT account, or to give you access both to the College library and to the University of Cambridge Library, or for membership of Regent House.  In addition, the University uses your personal information to monitor, evaluate and support your research activity; for example as part of the Research Excellence Framework ().

We may also liaise with the University’s Training department and likewise with any third party trainers, including on occasions your name and role details, to provide you with training related to your role.

We also share employment related details on a non-identifiable basis with professional advisors, and with inter-collegiate bodies to assess and monitor fair grading, remuneration and employment approach.

Employment related data may be shared, again on an anonymous non-identifiable basis and often in aggregated format, with external bodies for the purposes of monitoring equal opportunities.

Information is not shared with other third parties without your written consent, other than your name, role and employment contact details which are made publically available. Generally, personal data is not shared outside of the European Economic Area.

How we store your data

We hold all information for the duration of your employment and thereafter for up to 12 months in electronic and hard copy. Hard copy information is stored in locked cupboards or cabinets and in locked rooms. Data in electronic format is stored under password protection.

After an initial 12 months we hold personal data on electronic and hard copy archive generally for no more than 10 years after your relationship with the College ends. We reserve the right to retain the personal data longer than the periods stated above where it becomes apparent that there is a need to do so (for example, in the event of a major health or personal injury incident, records may need to be kept for up to 40 years).

Details we hold would be:

• personal details, including name and your preferred personal contact details* (if we still have these);
• your previous salaries and other earnings, pensions and the amounts you have paid in statutory taxes;
• records of your performance appraisals with your line manager;
• absence and attendance records
• records, where they exist, of any investigation or review into your conduct or performance;
• your reasons for leaving and any related correspondence;
• any references we have written subsequent to your employment with us;
• roles held within College (in certain instances members may be asked to approve the retention of their data for other reasons, for example archival records of College history);
• information about instances, appointments and elections which may be approved by Council and details of which may be kept within council agendas and minutes in perpetuity. 

Your rights

You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them. Failure to provide the information reasonably requested of you may result in disciplinary action taken by the College, which could ultimately lead to your dismissal from employment. You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office at  

91���� is committed to respecting the privacy of its staff and to ensuring that the personal data that we hold for you is processed in a fair and transparent way in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation.

This statement explains how 91���� ("we" and "our") handles and uses information we collect about our staff ("you" and "your"). For these purposes, "staff" is intended to include employees, workers and casual workers and contractors (e.g. undergraduate supervisors, ad-hoc or temporary catering staff etc.)

The controller for your personal information is 91����, University of Cambridge, Huntingdon Road, Cambridge, CB3 0DF. The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Bursar (Rob Hopwood) – bursar@murrayedwards.cam.ac.uk.

How your data is used by 91����

In broad terms, we use your data to manage your employment with the College, including providing you with your remuneration and statutory benefits, managing your role and the performance of it, and supporting you as an employer, as well as fulfilling our statutory obligations relating to your employment.

For most of the personal data we request from you, the legal basis for processing it, unless otherwise stated, is the fulfillment of the contract we hold with you, either a contract of service or a contract for services. We collect this data from you by means of the new joiner form which we ask you to complete at the start of your employment, plus subsequent correspondence with you, such as updates to your personal details or other form to collect relevant details from you when you are engaged to perform services for the college.

In connection with your employment, some of the data we collect and process is so that we can fulfill our statutory legal obligations. This data is collected at the start of your employment and updated during your employment, and include:

• your personal identity and contact details (full name, date of birth, gender, postal address, NI number) to inform HMRC of your employment with us;
• evidence of your right to work in the UK (passport, birth certificate, visa) to comply with immigration law.

The kinds of purposes for which we may use your personal data in order to fulfill the employment contract (or contract for services) or in some cases to comply with legal obligations as employer, fall into the following categories:

*Data marked above and below with an * relate to information most probably provided by you, or created in discussion and agreement with you. Other data and information is generated by the College or, where self-evident, provided by a third party.

• Ensuring that you have the right to work for the College:
• your recruitment documents* and information (including your application documents);
• other data relating to your recruitment (including your offer of employment and related correspondence, references, and any pre-employment assessment of you);
• your nationality and evidence of your right to work in the UK* (e.g. copies of your passport);
• the outcome of a Disclosure and Barring Service (DBS) check on you (where relevant to your role).
• Paying you and providing you with employment benefits:
• personal details* (full name, postal address, NI number, date of birth, gender)
• your bank details*;
• your current and previous salary (and other earnings e.g. maternity pay, allowances), and your tax information;
• your pension scheme and policy details*;
• your personal details such as may be needed to register you for employment benefits* (e.g. gym);
• sickness certificates, to ensure you are paid appropriately for company or statutory sick pay* (basing our processing of such data on condition (b) of Article 9(2) of the GDPR as this may be classed as special category data);
• your car registration for parking in the College car park* (where applicable);
• correspondence between you and the College, and between authorised staff of the College for legitimate processing purposes, relating to your pay and other remuneration, pension and benefits.
• Supporting your employment and/or your performance in your role:
• personal details* (name, contact details (phone, email, both work and personal);
• your current role description and any previous job descriptions;
• your current (and any previous) contracts of employment and related correspondence;
• any occupational health assessments and medical information you provide relating to your ability to carry out your role and any related work requirements you might need*; (we base our processing of such data on condition (h) of Article 9(2) of the GDPR as this may be classed as special category data,);
• any relevant dietary or religious requirements that might dictate your meal or other requirements as part of the College community (we base our processing of such data on condition (a) of Article 9(2) of the GDPR as this may be classed as special category data,);
• your training and development requirements, requests and qualifications*
• any legal undertaking you may be asked to participate in as part of your role.
• online identifiers such as IP address to facilitate remote working. 

• Administering HR-related processes, including records of absences and regular appraisals of your performance and, where necessary, investigations or reviews into your conduct or performance:
• a photo of you* for the provision of your College security card and for the staff photo board and in some cases the College website;
• details of your preferred emergency contact* (name, relationship to you and contact details) so that we can contact them in the event that something happens to you or we can’t reach you;
• records of your induction programme and its completion;
• records of your performance appraisals with your line manager;
• records, where applicable, of any investigation or review into your conduct or performance;
• records of Health & Safety matters or incidents so that the College can comply with its obligations under Health & Safety law and can maintain a safe and healthy working environment;
• records of roles you might undertake on behalf of the College e.g. in the capacity of First Aider;
• records of absences from work (including but not limited to annual leave entitlement, sickness leave, parental leave and compassionate leave)
• correspondence between you and the College, and between members and staff of the College, regarding any matters relating to your employment and related issues (including but not limited to changes to duties, responsibilities, benefits, your retirement, resignation or exit from College, personal and professional references provided by College to you or a third party at your request).
• Ensuring that you are suitable for certain positions of trust.
• For certain posts, we may use the Disclosure and Barring Services (DBS) / Disclosure Scotland to help assess your suitability for a position of trust. If this is the case, we will make this clear to you. Certificate and status check information is only used for this specific purpose, and we comply fully with the DBS code of Practice regarding the correct use, handling, storage, retention and destruction of certificates and certificate information, recognising that it is a criminal offence to pass this information on to anyone who is not entitled to receive it.
• Disclosing personal information about you to external organisations, as permitted or required by law
• e.g. submissions to the Office of National Statistics
• e.g. the police, should you be involved in criminal activity or a criminal investigation 

In a small number of cases, we exercise our legitimate organisational interest in collecting and/or processing data. This might include records of your use or take-up of any benefit schemes provided by us to enable us to monitor to review the effectiveness of these benefits and ensure that benefit schemes represent good value for money (both to you and us) and that you do not overuse your entitlements.

On rare occasions we might monitor social networking sites to ensure compliance with an agreed plan with employees, such as a homeworking agreement but we would only do so if we had informed you in advance that we might do this. In almost all other regards we would not monitor social media sites for any personal data relating to you, but, if aspects of these are brought to our attention and give rise to concerns about your conduct, we may need to consider them. Our social media guidelines are available in the staff handbook. We also operate CCTV on our College site which will capture footage. Our CCTV policy is available here. 

Please let us know of any concerns or queries you may have relating to any of these purposes, or to how we communicate with you. 

Who we share your data with

We share relevant personal data with our sub-contracting agents and with relevant government regulatory bodies (e.g. HMRC or the Office of National Statistics).

We also share your relevant personal details with benefits providers e.g. your pension provider.

We also share personal identification details (your name and date of birth) with the University of Cambridge and/or its component institutions, for example in order to register you with its Information Systems department for an IT account, or to give you access both to the College library and to the University of Cambridge Library.

We may also liaise with the University’s Training department and likewise with any third party trainers, including on occasions your name and role details, to provide you with training related to your role.

We also share employment related details on a non-identifiable basis with professional advisors, and with inter-collegiate bodies to assess and monitor fair grading, remuneration and employment approach.

Employment related data may be shared, again on an anonymous non-identifiable basis and often in aggregated format, with external bodies for the purposes of monitoring equal opportunities.

Information is not shared with other third parties without your written consent, other than your name, role and employment contact details which are made publicly available.

How we store your data

We hold all information for the duration of your employment and thereafter for up to 12 months in electronic and hard copy. Hard copy information is stored in locked cupboards or cabinets and in locked rooms. Data in electronic format is stored under password protection.

After an initial 12 months we hold personal data on electronic and hard copy archive generally for no more than 10 years after your relationship with the College ends. We reserve the right to retain the personal data longer than the periods stated above where it becomes apparent that there is a need to do so (for example, in the event of a major health or personal injury incident, records may need to be kept for up to 40 years).

Details we hold would be:

• personal details, including name and your preferred personal contact details* (if we still have these);
• your previous salaries and other earnings, pensions and the amounts you have paid in statutory taxes;
• records of your performance appraisals with your line manager;
• absence and attendance records
• records, where they exist, of any investigation or review into your conduct or performance;
• your reasons for leaving and any related correspondence;
• any references we have written subsequent to your employment with us;
• roles held within College (in certain instances members may be asked to approve the retention of their data for other reasons, for example archival records of College history). 

Your rights

You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them. Failure to provide the information reasonably requested of you may result in disciplinary action taken by the College, which could ultimately lead to your dismissal from employment. You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office at  

This statement explains how 91���� (“the College”, “we” and “our”) handles and uses information we collect about those applicants we make an offer of study to, and students once they join the College (“you” and “your”). In broad terms, we use your personal information to manage the ongoing relationship between the College and you as part of our lifelong community of scholars. This includes guiding and supporting your academic studies, maintaining and reviewing your academic progress and pastoral welfare, reviewing your financial commitments to the College and (if you live in College accommodation) managing our relationship with you as a resident.

When changes are made to this statement, we will publish the updated version on our website and notify you by other communications channels as we deem appropriate or necessary.

The controller for your personal information is 91����, Huntingdon Road, University of Cambridge, Cambridge CB3 0DF. The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Bursar, Mr Rob Hopwood, (bursar@murrayedwards.cam.ac.uk).

The normal legal basis for processing your personal information is that it is necessary in the performance of one or more contracts with us (including preparing to become a student and member of the College, the expectations on both sides during your course of studies and any related accommodation contract). We have commitments to other external bodies (particularly the University of Cambridge) as part of those contracts, and we outline below (see “How we share your personal information) how and when we ordinarily will share your personal information. For some specific purposes, we may rely on another legal basis, including where we are required for compliance with a legal obligation (e.g. financial records, equal opportunities monitoring), or where we believe it is in our legitimate interest to do so (e.g. to enable your access to external services). You may ask us for further information on these matters at any time if you have specific concerns. 

How your information is used by the College

We collect and process your personal information, as specified below, for a number of purposes, including:

1. maintaining your personal details, including ensuring effective communications with you;
2. maintaining a formal record of your academic progress and achievements at the College, the University of Cambridge and elsewhere;
3. maintaining a formal record of your other engagements with and achievements at the College, the University of Cambridge and elsewhere;
4. maintaining a record, where appropriate, of any particular personal needs you require to participate fully in College and University life (including any support needs that are, or have been, provided by the College or the University during your course of studies), as well as information about your general health and wellbeing;
5. maintaining financial records relating to your studies, your funding and other financial support arrangements;
6. provision of references to third parties, including retaining information that will allow such references to be meaningful and personalised;
7. maintaining a record of your behaviour and in particular where there has been concerns or complaints raised about you;
8. maintaining a record of any complaints you make to the College and their outcomes;
9. maintaining data to enable the College and the University to produce statistics and research for internal and statutory reporting purposes.

Further details are provided in the Annex. If you have concerns or queries about any of these purposes, please contact us at the address given below, or speak to the Senior Tutor.

We also operate CCTV on our main College site, which will capture footage. Our CCTV policy can be viewed here

Please note that if you engage with us for any other purpose (e.g. you work for us, or volunteer for us), there are additional data protection statements that you will be provided with for those other purposes, usually at the first point of engagement.

How long we keep your information for

The Annex outlines specific retention periods for certain categories of information: most of these are determined by legal requirements relating to that specific information.

The College publishes a data retention schedule, which is available on request from the Head of Tutorial.

Finally, we strongly encourage all of our students to remain in touch with the College after they leave and, for that reason, we transfer a subset of this information to our alumnae office who keep this information on a separate, secure database. You are encouraged to read our separate statement about personal information for alumnae, which covers your ongoing lifelong membership of the College.  

How we share your personal information 

Within the College

We share the following information with relevant people within the College: USN, name, subject, matriculation term, expected graduation term, crsid, Tutor, Director of Studies, pigeonhole number and year of study. Again, this is considered necessary for the College to operate smoothly but you can request a greater level of privacy by contacting the Senior Tutor. 

The College shares your email address with the 91���� JCR (undergraduates) or MCR (postgraduates) for the purpose of facilitating student representation and welfare. It may occasionally share other information of relevance, such as your sporting interests or achievements. 

The College also takes photographs of its students as a group in a matriculation and graduation photograph. These are used within the College and may be on public display.

Otherwise, the College restricts the sharing of your personal information within the College in line with its confidentiality policy 

With the University

By being a member of a College and registering for a course of study, you are automatically a member of the University of Cambridge. The academic and student support arrangements between the College and the University of Cambridge are complex and varied depending on your course and level of study. Information relating to you (and particularly your academic studies) is shared routinely and often with the University, and the University and its partners (including the College) have a data sharing agreement to govern such interactions and information transfers in both directions, as well as a shared student record system and database. 

The personal information shared with the University will include only that which is necessary for you to undertake and complete your studies and your examinations, and in addition will include any information necessary for the College to fulfill its obligations and agreements with the University about the shared University community (including sufficient information for the University to record and collate instances of student behaviour or complaints across all of the Colleges and the University). Where possible, the College will notify you of its intention to share such data in advance.

The University is a separate legal entity from the College and has its own statement about your personal information and its procedures, which you can view at: . It in turns shares information with the affiliated student unions and a number of other bodies for statutory and other purposes. 

With other organisations

The College routinely shares information with, and receives information from, where appropriate:

• the Cambridge City Council and other local authorities (to provide evidence of any rights to or exemptions from local services and taxes, including electoral registration and council tax);
• your funding providers or sponsors, as agreed with them and/or you, including the Student Loans Company;
• Universities and Colleges Admissions Service (in relation to your application, offer and requirements to meet any offer of study).

We may also be subject to a legal requirement (with or without your consent) to share your personal information with some government agencies under special circumstances (e.g. relating to crime or health and safety), such as the police or security services or other statutory authorities with investigatory powers. Where possible, the College will notify you of its intention to share such information in advance.

We will normally provide confirmation of your qualifications and other academic references to a prospective employer or financial sponsor if it is reasonably clear that it would be in your interests to do so, and we have made reasonable checks to ensure the information is being requested for that purpose.

We may also provide personal information to agencies and trusted advisers in order to receive professional advice or guidance in relation to a number of matters (examples of such advice include legal and audit services, fee status verification services, intercollegiate agreement services) or to provide services to you through a third party on our behalf. In such circumstances, data sharing agreements are in place to ensure your personal information is not retained by them for longer than necessary or otherwise shared more widely.

The College may share information with organisations overseas as part of arrangements related to your membership of the College (e.g. field trip, student exchange programme, an overseas funding provider). In most cases, this will be related to the operation of a contract. 

Publication of your personal information

We would not normally make your personal information publicly available without your consent.

Please also note the University’s people search function may also be widened to be accessible to the general public by changing the settings at : its default setting is otherwise access to all members of the University and all Colleges: we share this because we believe it helps significantly in building community relations and networks and helps others get in touch with you easily.

We would encourage you to be careful when sharing personal information about other students in public social media sites and other similar environments.

Your rights

You have the right: to ask us for access to, rectification or erasure of your personal information; to restrict processing (pending correction or deletion); to object to communications; and to ask for the transfer of your personal information electronically to a third party (data portability).

Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

If you have questions or concerns about your personal information, or how it used, please speak to the relevant College staff in the first instance. If you need further guidance, please contact the Senior Tutor using the details given above.

If you remain unhappy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (). 

Annex

We collect and process your personal information, as specified below, for a number of purposes, including:

• maintaining your personal details, including ensuring effective communications with you; 

We retain personal information (provided by you or by the University of Cambridge, or created by us), including:

• your current name and any previous names you have had;
• unique personal identifiers (e.g. student number, CRSID, date of birth, photograph);
• your current and previous contact details;
• next-of-kin or emergency contacts. 

We will assume that you have obtained permission from your next-of-kin or emergency contact for us to hold their information for that purpose.

• maintaining a formal record of your academic progress and achievements at the College, the University of Cambridge and elsewhere: 

We retain personal information (provided by you or by the University of Cambridge, or created by us), including:

• your application details, our assessment of your application and the details of any offer(s) of study we have made;
• records of your academic provision from the College (including supervisions, College examinations and other academic support);
• matriculation and graduation details and records of your academic qualifications (including those prior to becoming a member of the College);
• other details of your academic progress or achievements (e.g. College or University awards or prizes). 

Where an award or prize is provided by an external sponsor, we will normally share details about you and your academic performance with them. We also display a list of prizewinners in College immediately after the exam period.

• maintaining a formal record of your other engagements with and achievements at the College, the University of Cambridge and elsewhere: 

We retain personal information (provided by you or by the University of Cambridge, or created by us), including:

• records of your membership of College committees, the Junior Combination Room (JCR), Middle CombinationRoom (MCR) and College clubs and societies;
• awards, prizes and achievements in College or University-related activities (e.g music, arts, sports etc.).
• maintaining a record, where appropriate, of any particular personal needs you require to participate fully in College and University life (including any support needs that are, or have been, provided by the College or the University during your course of studies), as well as information about your general health and wellbeing: 

We retain personal information (provided by you or by the University of Cambridge, or created by us), including:

• details of any disability, illness, and any consequent learning support, social support or other support needs;
• details of any serious risks affecting you (e.g. severe allergies);
• arrangements agreed with you to manage your use of College and University facilities (e.g. computing services, sports facilities, libraries, accommodation, learning spaces), including any special requirements that may be linked to your health or religious beliefs;
• other information to support your health, safety and wellbeing. 

We may also retain copies of statements from professional medical advisers, provided either by you or directly to us. 

All personal information will be managed in line with our confidentiality policy. We recognise that much of the personal information outlined above is of a sensitive nature and requires a high level of discretion. Wherever possible, we will discuss and agree with you in advance with whom and when we share this information but reserve the right to disclose information to others in matters relating to significant risks to your health and safety or the health and safety of others. 

This information is normally retained until one year after you complete your studies.

Please note that where you are referred to services not offered directly by the College (e.g., counsellor retained by the College for students’ use, the University Counselling Centre and the University’s Disability Resource Centre), these support services will have their own data protection statement (or privacy notice) and we advise you pay close attention to these.

• maintaining financial records relating to your studies, your funding and other financial support arrangements: 

We retain personal information (provided by you or by the University of Cambridge, or created by us), including:

• records of your sources of funding support and tuition fee liabilities and, where relevant, records of your accommodation liabilities and other related charges (e.g. overhead and IT charges), as well as what monies are to be, and have been, collected by the College on behalf of itself and the University;
• records of any financial support agreed by the University and/or the College (including Cambridge Bursaries, other studentships or awards, additional discretionary funding, benefits or waivers approved by the College);
• where you reside in accommodation owned or managed by the College, copies of any accommodation contract(s);
• where appropriate, your banking details in order to make any payments due to you, and records of such transactions;
• records of your College financial account, including balance and transactions;
• copies of any correspondence with you about any of the above matters. 

Where this information includes the personal information of others (e.g. parental income evidence), we will assume that you have their permission to provide it to us for our purposes.  

This information is normally retained until seven years after you complete your studies.

• provision of references to third parties: 

In addition to the information above (and particularly your achievements in B and C above), we retain personal information (provided by you or created by us), including:

• records of your advisers, including where relevant your Tutor, Director of Studies and other nominated College personnel who provided you with personal support.
• maintaining a record of your behaviour and in particular where there has been concerns or complaints raised about you: 

We retain personal information (provided by you or by others, or created by us), including:

• details of any investigations undertaken by the College into your conduct or behaviour (e.g. disciplinary investigations, fitness to study investigations, complaints made against you);
• a record, including the final outcome, of any investigation of the University into your conduct or behaviour. 

The College has several complaints procedures, relating to different matters, and, in all cases, personal information will be managed in line with our confidentiality policy. We recognise that investigations may include information or statements of either a sensitive or disputed nature, and that such records require a high level of confidentiality. Wherever possible, we will discuss and agree with you in advance with whom and when we share this information but reserve the right to disclose information to others in matters relating to significant risks to your health and safety or the health and safety of others. 

This information is normally retained until one year after you complete your studies.

• maintaining a record of any complaints you make to the College and their outcomes: 

We retain personal information (provided by you or by others, or created by us), including:

• details of any complaints you have made to the College and their outcomes, where these have been taken through the College complaints procedure. 

This information is normally retained until three years after you complete your studies.

• maintaining data to enable the College and the University to produce statistics and research for internal and statutory reporting purposes. 

It is difficult to provide a comprehensive list, but we retain personal information (provided by you), including:

• information relating to “equal opportunities” (e.g. nationality, ethnicity, religious and other beliefs, gender, sexuality, age) in order to fulfil legal requirements of the College or the University;
• information relating to known family, working or social relationships with other members (past or present) of the University of Cambridge or any of the Colleges;
• information relating to your rights to live, work and study in the United Kingdom;
• any criminal record that may affect your status as a student of the University or the College. 

If you have concerns or queries about any of these purposes, please contact us, or speak to the Senior Tutor or to the Bursar. 

This statement explains how 91���� ("we" and "our") handles and uses information we collect about event organisers that use College facilities ("you" and "your"). In broad terms, we use your information to manage the event(s) we either host for you or otherwise provide facilities, as well as maintain our records of previous, current and future clients for events business for the College.

The controller for your personal information is the 91����, New Hall, Huntingdon Road, Cambridge, CB3 0DF. The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Bursar, Rob Hopwood, bursar@murrayedwards.cam.ac.uk.

The legal basis for processing your personal information is that it is necessary in order for you to enter into a contract to provide events facilities and resources to you. We will retain your information for the periods stated below unless or until you request us to do otherwise. 

We collect and process your personal information for the following purposes:

• maintaining clear contact information for the booking, provision and payment of events.

We will hold your name, address, email address, phone number and other relevant contact details you provide to us, and will use this information to maintain contact with you to provide your requested services, manage their delivery and bill you for them. We retain this information in our events records for six years after the most recent event we host for you, and for seven years in our financial records (due to statutory requirements). Where we have not hosted an event for you, we will retain the details relating to your initial enquiries of services for no more than two years.

• providing you with details about future event provision services.
• we may collect information when you voluntarily complete customer surveys.

While we retain your contact information, we will contact you about our services. You may unsubscribe from such communications at any time. 

We do not share personal information with third parties. If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given above.

We will always hold your information securely. To prevent unauthorised disclosure or access to your information, we have implemented strong physical and electronic security safeguards. 

Personal information of delegates of your event

The provision or management of your event by us might require you to provide us with personal information relating to your event delegates (such as name, dietary requirements, accommodation requirements. This may include the provision of sensitive personal information. We will not retain this information for any longer than necessary for the provision of the specific event, which might require you to provide it on successive occasions. We will assume that you have obtained the consent from your delegates for us to hold their personal information for that purpose.

Children: If You are booking on behalf of a child aged under 16, You must have permission of their legal guardian to process their data.

We also operate CCTV on our entire property, which will capture footage. Our CCTV policy can be viewed here.

You have the right: to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your information electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them. You retain the right at all times to lodge a complaint about our management of your personal information with the Information Commissioner’s Office at  

his statement explains how the College (“we” and “our”) handles and uses data we collect about our alumnae and our past, current and future supporters (“you” and “your”) and those who have requested to be kept informed as a Friend of the Women’s Art Collection. In broad terms, we use your data to keep in touch with you as alumnae (as life-long members of the College) and supporters, in order to keep you up to date with our activities and developments, to provide services to you, and to identify ways in which you can support us, through donations and/or volunteering your time and expertise. 

We will retain your data indefinitely or until you request us to do otherwise. When changes are made to this statement, we will publish the updated version to our website and notify you by other communications channels as we deem appropriate or necessary.

The controller for your personal data is 91����, New Hall, Huntingdon Road, Cambridge, CB3 0DF. The Data Protection Officer for the College is Beatrice Jamnezhad at the Office of Intercollegiate Services Ltd (OIS), 12B King’s Parade, Cambridge; 01223 768745; college.dpo@ois.cam.ac.uk. OIS should be contacted if you have any concerns about how the College is managing your personal information, or if you require advice on how to exercise your rights as outlined in this statement. The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal data, is the Bursar, Rob Hopwood, bursar@murrayedwards.cam.ac.uk. 

The legal basis for processing your personal data is that it is necessary for the purposes of our legitimate interests, where we have concluded that our interests do not impact inappropriately on your fundamental rights and freedoms, except where elsewhere in this statement we have indicated otherwise. You may ask us to explain our rationale at any time. 

How your data is used by the College

Your data is used by us for a number of interdependent purposes, including alumnae relations, communications and fundraising. These include:

• publications
• surveys
• appeals and requests for donations
• the promotion of alumnae and other College events
• the promotion of other services open to College members

Communications to you may be sent by post, telephone or electronic means, depending on the contact details we hold and the preferences expressed by you about the types of communications you wish to receive. We may use automated or manual analysis to link data together to help us identify your potential for supporting us and/or the University. If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given below. 

What data is held by the College

We work closely with the University as a result of their shared interest in having a coordinated approach to their alumni and supporters. We have a separate database from the University, but we also have access to the University’s database. The University has its own data protection statement and procedures.

Where provided by you, or provided by the University or obtained from public sources, records may contain:

• details of your school, College and University education
• unique personal identifiers (e.g. student number, date of birth)
• your contact details
• your attendance at College or University events
• other contact with us or the University since graduation
• your key relationships with other alumni or supporters of the College and/or the University and other Colleges within Cambridge
• your career highlights and other life achievements
• financial information relating to you and any of your key relationships (including but not necessarily limited to income, philanthropy and other giving)
• information about donations made by you to either the College or the University
• information about your areas of personal interest
• photographs of you
• personal data provided by you for a specific purpose or purposes (for example disability or catering preferences for event management)
• your communication preferences

Communications

If you are a new contact for our Development Office, we will ask you at the outset how you would like to receive news and other communications from us. If you are already receiving such communications, you are able to change your preferences (or ask us to stop sending you news and other communications completely) by email to newhallsociety@murrayedwards.cam.ac.uk. You may request changes at any time. 

When the College shares your data with others

We do not sell your personal data to third parties under any circumstances, or permit third parties to sell on the data we have shared with them.

Depending on constraints set by you, and which you may change at any time, we may share any of the above categories of data with the University.

We believe that most alumnae understand in detail the complex and many interactions of the College with the University of Cambridge. Personal data of our members is shared with the University routinely throughout any course of study, and it is our strong preference to continue such collaborative working thereafter.

The University and its partners (including the College) have a data sharing agreement to govern the sharing of personal data of alumni and other supporters. This is necessary because they are distinct legal entities. The agreement outlines that, depending on constraints set by you, and which you may change at any time, the University and College may share any of the above categories of personal data with the University and can be viewed in full at URL. Any transmission of data to or from the University is managed through agreed processes which comply with UK data protection legislation. 

For clarity, the College has a separate database from the University, but has access to the University’s database: additionally, we maintain other electronic and paper records.

The University has its own . 

We share data on a considered and confidential basis, where appropriate, with:

• Cambridge in America (the University’s affiliate alumni office in the U.S.)
• Third-party agencies who provide us with data in the public domain about alumnae and supporters
• Companies who provide College-branded or College-endorsed products and services
• Volunteers closely related to us (e.g. year and local alumnae representatives)
• Contractors providing services to you on our behalf or services to us (our ‘data processors’), including but not limited to database software providers (currently Blackbaud Inc), telephone fundraising consultants (currently Buffalo Fundraising Consultants) and mailing providers for publications. This list of contractors is updated as required. Use of the data is restricted to purposes defined by the College. 

We also facilitate communication between individual alumnae (of the College or the University), but in doing so we do not release personal contact details without prior permission. 

Your rights

You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them. 

Where you opt out of all future communications or exercise your right to erasure, we will continue to maintain a core set of personal data (name, subject(s), matriculation and graduation details, unique University identification number and date of birth) to ensure we do not contact you inadvertently in future, while still maintaining our record of your academic achievements. We may also need to retain some financial records about you for statutory purposes (e.g. Gift Aid, anti-fraud and accounting matters). 

You retain the right at all times to lodge a complaint about our management of your personal data with the . 

All 91���� students are part of Cambridge University Student Union or the Graduate Union. CUSU’s privacy notice and data protection statement can be found here and Graduate Union privacy notices are .

Data protection information for specific student societies at 91���� should be obtained from those groups’ organisers. 

91���� Website 

How we use your personal information

This statement explains how 91���� (“we” and “our”) handles and uses information we collect when you visit the College website – .   Where you engage with the College for another purpose (e.g. as a prospective or current student, as a previous student, as a member of the College or as a visitor to the College), there are other data protection statements to explain our management of your personal information. Where you enter your personal information into an online form for any specified purpose, you will be told about the use we will make of that information (e.g. to send you newsletters or to enable your attendance at an event).

The controller for your personal information is 91����, New Hall, Huntingdon Road, CB3 0DF.  The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Bursar, Rob Hopwood, bursar@murrayedwards.cam.ac.uk.

The legal basis for processing your personal data is that it is necessary for the purposes of our legitimate interests, where we have concluded that our interests do not impact inappropriately on your fundamental rights and freedoms.  You may ask us to explain our rationale at any time.  

We collect and process your personal information for operating and improving our webpages, analysing their use and ensuring the security of our website.

We use a third party service, Google Analytics, to collect standard internet log information and details of your visitor behaviour patterns.  We do this to find out, for example, the number of visitors to each page of our website.  

We use a plugin called Disqus to facilitate the ability for visitors to comment on our news and blog articles. You can read the Disqus Privacy Policy here:

We have a shop on our website, which requires personal information for the purpose of billing and delivering purchases only. The shop is powered through a Drupal Commerce plugin for iATS.

There are a number of webforms on our site which require you to provide personal information. This information is used only to fulfil the purpose of the form – for example, to update your details in our alumnae database or to book your place at graduation. 

We also collect the request made by your browser to the server hosting the website which includes the IP address, the date and time of connection and the page you ask for. We use this information to ensure the security of our websites and we store it for 7 days. We may use and disclose it as necessary in the event of a security concern or incident.  

For information about how we use cookies on our websites, please see /privacy-and-cookies

If you have concerns or queries about any of the above, please contact us at the address given above. 

You have the right: to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your information electronically to a third party (data portability).  Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them. 

You retain the right at all times to lodge a complaint about our management of your personal information with the Information Commissioner’s Office at      

 Events Website

How we use your personal information 

This statement explains how 91���� ("we" and "our") handles and uses information we collect when you visit the College website(s) – .  

91���� is committed to the proper management of personal data. 

Where you engage with the College for another purpose (e.g. as a prospective or current student, as a previous student, as a member of the College or as a visitor to the College), there are other data protection statements to explain our management of your personal information. 

Where you enter your personal information into an online form for any specified purpose, you will be told about the use we will make of that information (e.g. to log the enquiry in our database, send newsletters or to enable your attendance at an event).  

The controller for your personal information is the Bursar, 91����, New Hall, Huntingdon Road, CB3 0DF. The person responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Bursar, Rob Hopwood, bursar@murrayedwards.cam.ac.uk. 

The legal basis for processing your personal data is that it is necessary for the purposes of our legitimate interests, where we have concluded that our interests do not impact inappropriately on your fundamental rights and freedoms. You may ask us to explain our rationale at any time.  

What information do we collect?

We collect background information about you when you use our website, including your IP address, date and time of connection and the pages you visit. We also employ cookies on our websites. The legal basis for processing your personal information is that it is our legitimate interests to provide and monitor the usefulness of our website and to ensure it is kept secure.  

We use a third party service, Google Analytics, to collect standard internet log information and details of your visitor behaviour patterns. We do this to find out, for example, the number of visitors to each page of our website. This data is deleted by Google in accordance with their Data Retention Policy after 26 months. More detail is available  

We also collect the request made by your browser to the server hosting the website which includes the IP address, the date and time of connection and the page you ask for. We use this information to ensure the security of our websites and we delete it after a maximum of 3 months. We may use and disclose it as necessary in the event of a security concern or incident. For more technical details please se .  

For information about how we use cookies on our websites, please see / 

We do not share personal information with third parties. If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given above.  

You have the right: to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your information electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.  

You retain the right at all times to lodge a complaint about our management of your personal information with the Information Commissioner’s Office at  

The Women’s Art Collection

This statement explains how 91���� (“we” and “our”) handles and uses information we collect when you visit The Women's Art Collection . �į

 Where you engage with the College for another purpose (e.g. as a prospective or current student, as a previous student, as a member of the College or as a visitor to the College), there are other data protection statements to explain our management of your personal information. 

 The use of your personal information in the ways described is necessary for the legitimate interests of the College in operating and improving our website, analysing its use and ensuring its security.  We have concluded that our interests do not impact inappropriately on your fundamental rights and freedoms. You may ask us to explain our rationale at any time. �į 

 What do we use your information for?  

 We collect and process your personal information for operating and improving our webpages, analysing their use and ensuring the security of our websites.  We also collect information to send you news and information about The Women's Art Collection, when you sign up online to our mailing list. �į

 When you visit our website, we use the third-party Google Analytics service to collect standard internet log information. We use Google Analytics 4, which does not log or store individual IP addresses. We use analytics to find out how visitors use our website and to improve its usability. The data is anonymised before it is stored and before we see or use it for analytics processing. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our site. For more information about how Google Analytics uses this information, please see the . 

 When you visit our website, we use cookies and page-tagging techniques to collect the request made by your browser to the server hosting the website. This includes your IP address, the date and time of connection, the version of the web browser you are using, and the page you ask for. We use this information to ensure the security of our website and we delete it after a maximum of 3 months. We may need to use and disclose it as necessary in the event of a security concern or incident. 

 For information about how we use cookies on our website, please see the College’s Cookie Policy. �į  

 Where we do need to collect any additional personal data not listed above via our website, you will be told at that time about the use we will make of that information. For example, you may need to complete an online form in order for us to send you newsletters or to book to attend an event. 

 How do we protect your information?  

 Data retained by the College is kept on secure servers and shared only with staff who are directly involved with the running of The Women's Art Collection. Account data as described above is held for a period of seven years from creation and then permanently deleted. �į

 Do we disclose any information to outside parties?  

 We do not sell, trade, or otherwise transfer to outside parties your personal information. This does not include trusted third parties who assist us as noted above in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety. �į

 We share your email address with Mailchimp when you sign up for The Women's Art Collection newsletter; please see their .  In addition, we use Eventbrite as a booking system for Art Collection events; please see their . 

 Your Rights  

 You have the right:  

• to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion);  
• to object to communications or direct marketing;  
• to ask for the transfer of your information electronically to a third party (data portability). �į

 Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them. You retain the right at all times to lodge a complaint about our management of your personal information with the . &�Բ�����;