How we use your personal information
This privacy notice explains how Wolfson College (“we” “our”, “the College” and “us”) handles and uses information we collect about event organisers that use College facilities (“you” and “your”).
In broad terms, we use your information to manage the event(s) we either host for you or otherwise provide facilities, as well as to maintain our records of previous, current and future clients for events business for the College.
This statement forms part of the College’s compliance with data protection law in the UK.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College under UK GDPR is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge, CB2 1UR; 01223 768745; dpo@isl.colleges.cam.ac.uk.
What data are processed and why
Unless otherwise stated below, the legal basis for processing your personal information is that it is necessary in order for you to enter into a contract to provide events facilities, accommodation and/or other resources to you. We will retain your information for the periods stated below unless or until you request us to do otherwise.
We collect and process your personal information for the following purposes:
A. Maintaining clear contact information for the booking, provision and payment of events.
We will hold your name, address, email address, phone number and other relevant contact details you provide to us and will use this information to maintain contact with you to provide your requested services, manage their delivery and bill you for them.
We retain this information in our events database for 5 years after the most recent event we host for you, and for 7 years in our financial records due to statutory requirements. Where we have not hosted an event for you, we will retain the details relating to your initial enquiries of services for no more than two years.
Personal information of delegates of your event
The provision or management of your event by us might require you to provide us with personal information relating to your event delegates (such as name, dietary requirements, access needs and specific accommodation requirements). This may include the provision of sensitive personal information which is classed as “special category data” and processed based on substantial public interest to protect your health and safety of delegates and provide appropriate support and with the explicit consent of your delegates. We will not retain this information for any longer than necessary for the provision of the event, which might require you to provide it on successive occasions. We will assume that you have obtained the consent from your delegates for us to hold their personal information for that purpose. Your delegates may wish to view our Data Protection Statement for Visitors and Guests for reference.
We also collect the following data when guests visit the College:
The College captures and records timed images of individuals moving through the College, using a number of fixed CCTV cameras. CCTV images are automatically deleted after 30 days, unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
Our door security system controls door access, which will, by its nature, register each use of an access card. Data from the system may be used to determine who has accessed an area in the event of an issue with a room. Like all data we store, this information is kept confidentially, with access restricted to authorised members of staff. Door access control data are deleted after 12 months.
The College retains the names and contact details of individuals named in a College incident, near miss or accident report. The lawful basis for processing this personal data is compliance with a legal obligation. These records are stored confidentially for a minimum of 3 years. Where medical assistance is provided, we may also collect health information which is classed as “special category data” and is processed based on substantial public interest to protect your health and safety and provide appropriate support. Records containing health or medical information are retained for 8 years from the date the medical assistance was provided.
For guests who attend live streaming events, their image or voice may appear in livestreaming and recordings. You will be advised of this at the time of booking and we also provide notices at each event. For further details please refer to the College Filming, Photography and Recording Policy.
We also operate Wi-Fi which can be accessed by College visitors and guests. We retain device information (such as physical MAC address and IP address) and details of the IP address the device is connected to. The data is retained for 90 days.
B. Providing you with details about future event provision services.
While we retain your contact information, we will contact you about our services. You may unsubscribe from such communications at any time by emailing conferences@wolfson.cam.ac.uk
Who we share your data with
Your data is shared with HMRC and other authorities, solicitors or other agents handling business on behalf of the College as necessary for compliance with our legal obligations. We do not pass personal data to any third party without the consent of the data subject. While we manage your data within the College, we do use cloud-based storage systems for invoicing, processing payments and booking accommodation.
How long do we keep your data?
Contact details and information gathered on qualifications, past performance and references prior to signing a contract are normally held for as long as the information facilitates the business operations of the College. The data are regularly reviewed by individual College officers and staff. Data contained in invoices are held within our accounting system for 7 years.
Your rights
You have the right: to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your information electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right to lodge a complaint about our management of your personal data with the Information Commissioner’s Office. Details of how to make a complaint to the Information Commissioner’s Office are available at https://ico.org.uk/make-a-complaint/
This is a live document which will be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead, June 2026
Date of next review: June 2029
Version Control
| Date | Version | Reason for review |
| 2018 | Draft | New statement for review by Records Working Party |
| 09/2018 | 1.0 | Publication |
| 09/2025 | 1.1 | Review by Compliance Manager. Included door access, WI-FI and guest registration. |
| 06/2026 | 1.2 | Review by Compliance Manager for compliance with new DUAA legislation, effective 19/6/2026. Data protection complaints contact details provided. Condition for processing special category data included. |