How we use your personal information
This privacy notice explains how Wolfson College (“we”, “our”, “the College” and “us”) handles and uses information we collect about contractors, suppliers and business contacts (“you” and “your”) who supply goods or services to the College, or who wish to do so.
This statement forms part of the College’s compliance with data protection law in the UK.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College under UK GDPR is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge, CB2 1UR; 01223 768745; dpo@isl.colleges.cam.ac.uk.
What data are processed and why
The College processes contact names, phone numbers, postal and email addresses, bank details, statements, invoices and payment details, together with details of professional qualifications, past performance and work references. We use your data to manage our relationship with you, to pay you for goods and services, as well as to maintain records of previous, current and future business contacts.
The lawful basis for processing your personal information is that it is necessary in order for you to enter into a contract with us.
We do not undertake automated decision-making.
Where the data comes from
The personal data held are provided by our contractors, suppliers and contacts via email, invoices, mailings, or individual approaches. Some may be supplemented by information on company websites or in other public sources.
We also collect the following data when/if you visit the College:
The College captures and records timed images of individuals moving through the College, using a number of fixed CCTV cameras. CCTV images are automatically deleted after 30 days, unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
Our door security system controls door access, which will, by its nature, register each use of an access card. Data from the system may be used to determine who has accessed an area in the event of an issue with a room. Like all data we store, this information is kept confidentially, with access restricted to authorised members of staff. Door access control data are deleted after 12 months.
The College operates a reception registration system for managing the safety of our guests and visitors which collects contact details for use in an emergency. The lawful basis for processing this data is explicit consent. All registration data is automatically deleted at the end of each day.
The College retains the names and contact details of individuals named in a College incident, near miss or accident report. The lawful basis for processing this personal data is compliance with a legal obligation. These records are stored confidentially for a minimum of 3 years. Where medical assistance is provided, we may also collect health information which is classed as “special category data” and is processed based on substantial public interest to protect your health and safety and provide appropriate support. Records containing health or medical information are retained for 8 years from the date the medical assistance was provided.
We also operate Wi-Fi which can be accessed by College visitors and guests. We retain device information (such as physical MAC address and IP address) and details of the IP address the device is connected to. The data is retained for 90 days.
Who we share your data with
Your data is shared with HMRC and other authorities, solicitors or other agents handling business on behalf of the College as necessary for compliance with our legal obligations. We do not pass personal data to any third party without the consent of the data subject. While we manage your data within the College, we do use cloud-based storage systems for invoicing and processing payments.
How long do we keep your data?
Contact details and information gathered on qualifications, past performance and references prior to signing a contract are normally held for as long as the information facilitates the business operations of the College. The data are regularly reviewed by individual College officers and staff. Data contained in invoices are held within our accounting system for 7 years.
Your rights
You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you have questions or concerns about your personal information, or how it is used, you are invited to speak to staff in the relevant College department in the first instance.
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at: https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office. Details of how to make a complaint to the Information Commissioner’s Office are available at https://ico.org.uk/make-a-complaint/data-protection-complaints/
This is a live document which will be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
June 2026
Version Control
| Date | Version | Reason for review/changes |
| 06/2026 | V1.0 | New statement. Reviewed by the CDPL. |