How we use your personal information
This privacy notice explains how Wolfson College (“we”, “the College”, “us” and “our”) handles and uses information we collect about those applicants we make an offer of study to, and students once they join the College (“you” and “your”).
This statement forms part of the College’s compliance with data protection law in the UK.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College under UK GDPR is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge, CB2 1UR; 01223 768745; dpo@isl.colleges.cam.ac.uk.
Please note that if you engage with us for any other purpose (e.g. if you work or volunteer for us), there are additional privacy notices that you will be directed to with for those other purposes, usually at the first point of engagement.
We use your personal information to manage the ongoing relationship between the College and you as part of our lifelong community of scholars. This includes guiding and supporting your academic studies, maintaining and reviewing your academic progress and pastoral welfare, reviewing your financial commitments to the College and (if you live in College accommodation) managing our relationship with you as a resident.
The normal legal basis for processing your personal information is that it is necessary in the performance of one or more contracts with us (including preparing to become a student and member of the College, the expectations on both sides during your course of studies and any related accommodation contract). We have commitments to other external bodies (particularly the University of Cambridge) as part of those contracts, and we outline below (see ‘Who we share your data with’) how and when we ordinarily share your personal information.
For some specific purposes, we may be required to rely on another legal basis, including where we are comply with a legal obligation, or we may believe it is in our legitimate interest to do so (eg to enable your access to external services). You may ask for more information on these matters at any time if you have specific concerns.
Where we process special category personal data about you, we process this data under the following legal bases:
- Substantial public interest: where processing is necessary to meet our obligations in areas such as health and safety, equality of opportunity, safeguarding, or the provision of appropriate support and adjustments.
- Explicit consent: where you have voluntarily provided this information for a specific purpose and no other legal condition applies.
We ensure that appropriate safeguards are in place to protect your data in line with our data protection policy.
What data are processed and why?
We collect and process your personal information, as specified below, for a number of purposes, including:
- maintaining your personal details, including basic spouse/partner information if they accompany you to Cambridge, to ensure effective communications with you.
- maintaining a formal record of your academic progress at the College, the University of Cambridge and elsewhere.
- maintaining a formal record of your other engagements with and achievements at Wolfson, the University of Cambridge and elsewhere ensuring that we can communicate your successes and individual distinctions to prospective employers and to others involved in your Cambridge career.
- maintaining a record, where appropriate, of any particular personal needs you require to participate fully in College and University life (including any support needs that are, or have been, provided by the College or the University during your course of studies), as well as information about your general health and wellbeing.
- maintaining financial records relating to your studies, your College accommodation (where applicable), your funding and other financial support arrangements, enabling us to perform contracts efficiently and to assist you (if requested) in the management of your finances while a student.
- provision of references to third parties.
- maintaining a record of your behaviour and in particular where there have been concerns or complaints raised about you. including:
- details of any investigations undertaken by the College into your conduct or behaviour (e.g. disciplinary investigations, fitness to study investigations, complaints made against you).
- a record, including the final outcome, of any investigation by the University into your conduct or behaviour.
- maintaining a record of any complaints you make to the College and their outcomes.
- maintaining data to enable the College and the University to produce statistics and research for internal and statutory reporting purposes.
Further details are provided in the Annex at the end of this document.
If you have concerns or queries about any of these purposes, please contact the College Data Protection Lead using the contact details above.
Please note that if you engage with us for any other purposes (eg if you work for us, or volunteer for us), there are additional privacy notices that you will be provided with for those other purposes, usually at the first point of engagement.
The College does not carry out automated decision-making or profiling.
When on the College site, we also collect the following:
The College captures and records timed images of individuals moving through the College, using a number of fixed CCTV cameras. This complies with our legal and contractual obligations to provide a safe and secure environment for all those who work at, study in, or otherwise use or visit the College and its facilities. CCTV images are automatically deleted after 30 days unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
Our electronic door security system will, by its nature, register each use of an access card. Data from the system may be used to determine who has accessed an area in the event of an issue with a room/area. Like all data we store, this information is kept confidentially, with access restricted to authorised members of staff. Door access control data are deleted after 12 months.
We also operate Wi-Fi across our sites, which can be accessed by members of the College and guests. We retain device information (such as physical MAC address and IP address) and details of the IP address the device connected to. The data is retained for 3 months.
The College has a legal obligation to maintain records of incidents, near misses, or accidents which occur on the College site. Records will retain the names and contact details of those involved, together with any witnesses. Reports may contain special category personal data provided by individuals and are stored confidentially for a minimum of 3 years.
We also operate Wi-Fi which can be accessed by College visitors and guests. We retain device information (such as physical MAC address and IP address) and details of the IP address the device is connected to. The data is retained for 90 days.
How long we keep your information for
The Annex below outlines specific retention periods for certain categories of data. Many of these are determined by legal requirements relating to that specific data.
Where no specific retention period is noted, six years after your graduation, or when you go out of
residence for the final time, the College reduces your personal information to a subset of data so that we can retain a sufficient record of your academic achievements and your time at the College, for references and related purposes.
The archived record would typically retain:
- name
- last known address
- date of birth
- year of admission to the College
- schools attended
- subjects, dates and classes of degrees
- matriculation form
- accommodation while a student
- name of partner and dependents if they accompany you to Cambridge while you are a student
- participation in sports clubs and societies
- details of immediate family as provided by you at admission
- details of academic awards and prizes, and other College funding
- publications and other achievements that you have told us about or which appear in published University and College sources.
We strongly encourage all of our students to remain in touch with the College after they graduate and, for that reason, we transfer a subset of this data to the College Alumni and Development Office. You are encouraged to read our separate data protection statement to cover your lifelong relationship with the College at: https://www.wolfson.cam.ac.uk/about/governance/data-protection
Who we share your data with
Within the College
We share the following data selectively with relevant people employed by the College: names, subjects, age, year in course, accommodation in College, academic performance, details of prizes and awards, dietary preferences, financial circumstances as declared by you, emergency contacts as declared by you, disabilities declared by you, details of accidents or other personal incidents requiring the intervention of the Porters or College first aiders. This is considered necessary for the College to operate smoothly.
The College also takes and processes photographs of its students, either individually and/or as a group in matriculation and graduation photographs. These are widely used within the College; some are held on the College’s intranet with restricted access, and some may be on public display.
Otherwise, we restrict the sharing of your personal information within the College in a way that ensures that it can discharge its duty of care to you whilst ensuring that only relevant data is shared on a strictly ‘need to know’ basis in line with its policy on ‘Confidentiality in a Student Welfare Context’ policy.
For sensitive data (including disciplinary matters, and special category data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, health, gender, or sexual orientation) we will always ask for your consent to share. Further details can be found in the College’s ‘Confidentiality in a Welfare Context’ Policy.
The College receives a full set of examination results which is shared confidentially with relevant fellows of the College, members of the teaching staff, and tutorial staff, for internal use only.
With the University
By being a member of a College and registering for a course of study, you are automatically a member of the University of Cambridge. The academic and student support arrangements between the College and the University of Cambridge are complex and varied depending on your course and level of study. Information relating to you (and particularly your academic studies) is shared routinely and often with the University. The University and its partners (including the College) have a data sharing agreement to govern such interactions and information transfers in both directions, as well as a shared student record system and database.
The Students Record System (‘CamSIS’) which is used by the University and Colleges of Cambridge (‘Collegiate Cambridge’) is controlled by both parties, except for ‘College only’ fields, which are controlled solely by the College (e.g. tutorial side). The University, colleges and students are together responsible for keeping CamSIS up-to-date.
If you transfer to another College, we will share personal data with that College with your consent. We share your name, email address, and details of your academic performance with external College Teaching Associates, Directors of Studies, and supervisors in order to arrange teaching and academic support.
With your consent we will share data with the Accessibility & Disability Resource Centre, in order to fulfil our obligations to provide suitable resources for students with disabilities. Where relevant, we provide an annual return to the University Childcare Office detailing your name, CRS ID, course, nationality and number of children, for so long as you are a resident junior member of the University.
The personal information shared with the University will include only that which is necessary for you to undertake and complete your studies and your examinations, as well as any data necessary for the College to fulfil its obligations and agreements with the University about the shared University community. This includes data relating to any complaint of a breach of the College or
University Student Code of Conduct which falls to be investigated by the University or to have sanctions imposed by the University. The College may also share sufficient information for the University to record and collate instances of student behaviour or complaints across all of the Colleges and the University. Where possible, the College will notify you of its intention to share such data in advance.
The University is a separate legal entity to the College and has its own statement about your personal information and its procedures, which you can view at: https://www.information-compliance.admin.cam.ac.uk/data-protection/student-data. The University in turns shares information with the affiliated student unions and a number of other bodies for statutory and other purposes.
With other organisations
The College routinely shares information with, and receives information from, where appropriate:
- Cambridge City Council and other local authorities (to provide evidence of any rights to or exemptions from local services and taxes, including electoral registration and council tax).
- Your funding providers or sponsors, as agreed with them and/or you, including the Student Loans Company and the Cambridge Trust.
- Universities and Colleges Admissions Service (in relation to your application, offer and requirements to meet any offer of study).
- Other Colleges insofar as they provide services to us (such as tutorials or residential accommodation).
- Your former school or college, or national or local media, in respect of outstanding examination performance or other noteworthy achievements.
- Your registered GP medical practice on a student-by-student basis, including the settlement of payments owed them for medical letters and other services.
- Insurance companies in respect of room and bicycle insurance, under a data sharing agreement, or when a student is likely to make a claim on the College insurance.
- External lettings agents, with your prior knowledge.
- Banks and building societies, so you can open an account.
- The Health and Safety Executive and UK Immigration authorities, under specific statutory obligations falling on the data subject and/or the College.
- Universities and Colleges Admissions Service, in relation to your application, offer and requirements to meet any offer of study.
- the College’s solicitors in some cases concerning students.
- with your consent, we may share reports of your progress submitted by you with the donors of certain named bursaries and other funds.
Under some circumstances, for example in cases of crime or health and safety investigations, we may also be subject to a legal requirement to share your personal information with some government agencies such as the police or security services or other statutory authorities with investigatory powers. Where possible, the College will notify you of its intention to share such information in advance.
CCTV images and door access data may be shared with the police if a crime is under investigation. They can also be used by College officers and staff to investigate allegations of staff or student misconduct, and to establish the safety of students known or suspected to be at risk.
We recognise that health data in particular are of a sensitive nature. Wherever possible, we will discuss and agree with you in advance with whom and when we share this information, but we reserve the right to disclose information to others in matters relating to significant risks to the health and safety of you or others.
The University will issue official University Transcripts and Academic Verification Letters through Digitary Core (https://core.digitary.net/#/user/login), a secure electronic document system which also allows students to release/share information electronically to other organisations. All students are encouraged to use this facility for routine confirmation of qualifications.
The College will normally provide academic references to other academic institutions, a prospective employer or financial sponsor if it is reasonably clear that it would be in your interests to do so, and we have made reasonable checks to ensure the information is being requested for that purpose. We provide confirmation of your attendance at Wolfson, the years of matriculation and graduation and the course of study (but not your exam results) when requested, as this information is published in the Reporter in any case.
We may also provide personal information to agencies and trusted advisers in order to receive professional advice or guidance in relation to a number of matters (examples of such advice include legal and audit services, fee status verification services, intercollegiate agreement services) or to provide services to you through a third party on our behalf. In such circumstances, data sharing agreements are in place to ensure your personal information is not retained by them for longer than necessary or otherwise shared more widely.
The College may share information with organisations overseas as part of arrangements related to your membership of the College (e.g. student exchange programme, choir tours, field trips, or liaison with an overseas funding provider). In most cases, this will be related to the operation of a contract.
Publication of your personal information
We would not normally make your personal information publicly available without your consent, except as described above.
We would urge you to be careful when sharing personal information about other students in public social media sites and other similar environments.
Please also note the University’s people search function may also be widened to be accessible to the general public by changing the settings at http://www.lookup.cam.ac.uk/self. Its default setting is otherwise access to all members of the University and all Colleges: we share this because we believe it helps significantly in building community relations and networks and helps others get in touch with you easily.
If you have concerns or queries about any of these purposes, please contact the College Data Protection Lead: bursar@wolfson.cam.ac.uk
Your rights
You have the right: to ask us for access to, rectification or erasure of your personal information; to restrict processing (pending correction or deletion); to object to communications; and to ask for the transfer of your personal information electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at: https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office. Details of how to make a complaint to the Information Commissioner’s Office are available at https://ico.org.uk/make-a-complaint/
This is a live document which may be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
Last updated: June 2026
Version Control
| Date | Version | Review Reason |
| 2018 | Draft | New DPS for review by the Information & Records Management Working Party |
| 2018 | 1.0 | Publication |
| 06/2026 | 1.1 | Reviewed by Compliance Manager. New ISL contact details and complaints information added to comply with new DUAA legislation. |
ANNEX
The following information (except where otherwise indicated) is normally actively retained until six years after you complete your studies, at which point it is added to the College archive as part of your student file.
We collect and process your personal information, as specified below, for a number of purposes and may retain copies of any correspondence touching on these matters.
A. maintaining your personal details, including ensuring effective communications with you:
We retain personal information (provided by you or by the University of Cambridge, or created by us), including:
i. your current name and any previous names you have had.
ii. unique personal identifiers (e.g. student number, CRSID, date of birth, photograph).
iii. your current and previous contact details, including College address (where applicable).
iv. next-of-kin and/or emergency contacts.
v. your partner’s name if you have declared that you are accompanied on applying to Cambridge or if you subsequently apply for partnered accommodation to the College.
vi. number and ages of dependent children;
vii. immigration status of overseas students, for example visa information, passport details.
We will assume that you have obtained permission from your next-of-kin or emergency contacts for us to hold their information for that purpose.
B. maintaining a formal record of your academic progress and achievements at the College, the University of Cambridge and elsewhere:
We retain personal information (provided by you or by the University of Cambridge, or created by us), including:
i. your application details, our assessment of your application and the details of any offer(s) of study we have made.
ii. records of academic provision put in place by the College, including names of Tutors and Directors of Studies, supervisions, end of term/year reports from your supervisors and other official assessors, self-assessment forms, College examinations/progress tests and other academic support.
iii. matriculation and graduation details and records of your academic qualifications (including those prior to becoming a member of the College).
iv. other details of your academic progress or achievements (e.g. College or University awards or prizes).
v. application for and participation in student exchange programmes.
vi. records of academic appeals.
Where an award or prize is provided by an external sponsor, we will normally share details about you and your academic performance with them. We may also publicise your achievements elsewhere but would seek your consent before doing so.
C. maintaining a formal record of your other engagements with and achievements at the College, the University of Cambridge and elsewhere:
We retain personal information (provided by you or by the University of Cambridge, or created by us), including:
i. records of your membership of College committees, the Wolfson College Student Association (WCSA) and College clubs and societies.
ii. awards, prizes and achievements in College or University-related activities (e.g. music, arts, sports etc.).
iii. records of your library borrowing, and any fines that accrue, processing data entered on and stored on a shared University-wide Library system.
iv. records of any induction for the College Gym.
v. awards, prizes and achievements in College or University-related activities.
vi. records of data subject access requests made by you under the data protection legislation. These records are retained for two years after the year in which they were made; copies of ID supplied in support of such requests are destroyed six months after the response to the request is sent.
Some details processed under this heading will eventually form part of your alumnus record and further details can be found in the privacy notice for Alumni & Friends: https://www.wolfson.cam.ac.uk/about/governance/data-protection
D. maintaining a record, where appropriate, of any particular personal needs you require to participate fully in College and University life (including any support needs that are, or have been, provided by the College or the University during your course of studies), as well as information about your general health and wellbeing:
We retain personal information (provided by you or by the University of Cambridge, or created by us), including:
i. details of medical history as disclosed by you, including details of any disability, illness, condition and any consequent learning support, loans of College equipment, social support or other support needs, dietary preferences, and counselling referrals.
- Please note that where you make use of services not offered directly by the College (e.g. the University Counselling Centre and the University’s Accessibility & Disability Resource Centre), these support services will have their own privacy notice and we advise you to read these.
ii. details of consultations with the College Welfare Team
- Data generated by the College Nurse and Welfare Team are held separately in externally hosted cloud-based systems. Data Protection Impact Assessments (DPIAs) have been carried out to assess the risks of your privacy and the College holds data sharing agreements with both providers. Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you receive for a period of 8 years after leaving the College according to an NHS Code of Practice.
iii. statements from professional medical advisers, provided either by you or directly to us.
iv. details of any accident or injury sustained while on College premises or requiring the intervention of the Porters or other first aiders.
- Accident/incident reports maintained by the Porters are normally deleted after 3 years.
- We also retain information that may be provided by you and/or other College members and/or any eyewitnesses as appropriate, of accidents or events in which you were involved. Health & safety legislation requires the College to retain this data for a minimum of 3 years.
v. details of any serious risks affecting you, including severe allergies.
vi. arrangements agreed with you to manage your use of College and University facilities (e.g. computing services, sports facilities, libraries, accommodation, learning spaces, personal evacuation plans and any other special requirements that may be linked to your health or religious beliefs).
- Personal evacuation plans are retained only for the duration of a student’s residence in the College.
i. Responses to invitations issued by the College, for the purposes of arranging seating plans, identifying those with particular dietary needs, and booking spaces for events.
- Records of dietary preferences are not retained for any longer than necessary for the provision of a specific event, which might require you to provide it on successive occasions.
i. Records of data subject access requests made by you under the data protection legislation. These records are retained for two years after the year in which they were made; copies of ID supplied in support of such requests are destroyed six months after the response to the request is sent.
vii. Arrangements to deliver pastoral care through meetings or discussions with the Chaplaincy team.
- Where records are held by the Chaplaincy team, they are retained for as long as the student is resident in Cambridge, and/or under their pastoral care.
viii. other information to support your health, safety and wellbeing.
We recognise that much of the personal information outlined above is of a sensitive nature and requires a high level of discretion. Wherever possible, we will discuss and agree with you in advance with whom and when we share this information but reserve the right to disclose information to others in matters relating to significant risks to your health and safety or the health and safety of others. All personal data is managed in line with our ‘Confidentiality in a Welfare Context’ policy.
E. maintaining financial records relating to your studies, your funding and other financial support arrangements:
We retain personal information provided by you or by the University of Cambridge, or created by us, including:
i. records of your sources of funding support and tuition fee liabilities and, where relevant, records of your accommodation liabilities and other related charges, as well as what monies are to be, and have been, collected by the College on behalf of itself and the University.
ii. records of any financial support agreed by the University and/or the College. These may include Cambridge Bursaries; other studentships or awards, including means-tested bursaries drawing with the student’s consent on information stored under the Higher Education Bursary and Scholarship Scheme.
iii. fee status; childcare grants; learning and research grants; tenth-term funding for graduate students; and additional hardship or other discretionary funding benefits, loans or waivers approved by the College.
iv. where you reside in accommodation owned or managed by the College, copies of any accommodation contract(s).
v. where appropriate, your banking details in order to conduct financial transactions, and records of such transactions.
vi. records of your College financial account, including balance and transactions, payment mitigation and late payment forms.
vii. records of any work undertaken for the College, such as supervisions or invigilation.
viii. copies of any correspondence with you about any of the above matters.
This information is normally retained until 7 years after you complete your studies, but some records are retained permanently in order to meet accounting standards. Evidence of eligibility for means-tested bursaries is destroyed after 6 years, with basic statistical information anonymised at that point.
Where this information includes the personal information of others (e.g. parental income evidence), we will assume that you have their permission to provide it to us for our purposes.
F. provision of references to third parties:
In addition to the information above (and particularly your achievements in B and C above), we retain personal information (provided by you or created by us), including:
i. records of your advisers, including, where relevant, your Tutor, Director of Studies and other nominated College personnel who provided you with personal support.
G. maintaining a record of your behaviour and in particular where there have been concerns or complaints raised about you:
We retain personal information (provided by you or by others, or created by us), including:
i. details, including the final outcome, of any investigations undertaken by the College into your conduct or behaviour (e.g. disciplinary investigations, fitness to study investigations, complaints made against you).
ii. a record, including the final outcome, of any investigation of the University into your conduct or behaviour.
The College has several complaints procedures, relating to different matters, with which you are expected to familiarise yourself. We recognise that investigations may include information or statements of either a sensitive or disputed nature, and that such records require a high level of confidentiality. Wherever possible, we will discuss and agree with you in advance with whom and when we share this information but reserve the right to disclose information to others in matters relating to significant risks to your health and safety or the health and safety of others. Further details are provided in the College’s ‘Confidentiality in a Welfare Context’ Policy. Much of this information is normally retained for six years after an investigation is concluded.
H. maintaining a record of any complaints you make to the College and their outcomes:
We retain personal information (provided by you or by others, or created by us), including:
i. details of any complaints you have made to the College and their outcomes, where these have been taken through the College complaints procedure. This information is normally retained for 6 years.
I. maintaining data to enable the College and the University to produce statistics and research for internal and statutory reporting purposes.
It is difficult to provide a comprehensive list, but we retain indefinitely personal information (provided by you), including:
i. information relating to the College’s duties under the Equality Act 2010, for example collecting data on nationality, ethnicity, disability status, religious and other beliefs, gender, sexuality, and age. Data is anonymised after you leave the College in line with the principle of data minimisation.
ii. information relating to your rights to live, work and study in the United Kingdom.
iii. any criminal record that may affect your status as a student of the University of Cambridge or the College.
If you have concerns or queries about any of these purposes, please contact the Tutorial Office Manager (tutorial-manager@wolfson.cam.ac.uk) or the Bursar (bursar@wolfson.cam.ac.uk).
Updated June 2026