How we use your personal information
This privacy notice explains how Wolfson College (“we”, “our”, “the College” and “us”) handles and uses data of users of the Wolfson College Library (“you” and “your”), both in person and remotely.
This statement forms part of the College’s compliance with data protection legislation in the UK.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College under UK GDPR is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge, CB2 1UR; 01223 768745; dpo@isl.colleges.cam.ac.uk.
What data are processed and why
Unless otherwise stated below, the legal bases for processing your personal data includes our contractual obligations to provide library services and to enable you to participate in ‘WolfWorks’ and other academic skills events. Your data is also processed in accordance with our legitimate interests in maintaining records of collection use, improving collections, services and user experience, maintaining security and administering enquiries, services and events efficiently. We will retain your information for the periods stated below unless or until you request us to do otherwise.
We collect and process your personal information for the following purposes:
A. To deliver our contractual obligations to you as a user of our service
We will hold your name and CRSID. Your data is used to provide you with access to the Library and its services and to contact you with information about your Library use and the services which the Library offers. This information can be accessed by Library staff for the duration of your College membership.
Your data is held securely on College and University databases, or on a shared College drive, with access restricted to authorised members of the Library team.
B. Maintaining records of reprographics orders
We hold your name, CRSID and details of copies supplied. This information is retained for 3 years.
C. Maintaining records of enquiries received by the Library
We record your name, contact details (email address, postal address or telephone number depending on your preferred method of contact), details of your enquiry and the information we have supplied. Enquiries will be retained for 3 years. Anonymised enquiry data may be retained for longer periods.
D. Images for promotional purposes
Photographs of the Library and students in the Library are taken throughout the year and at ‘WolfWorks’ or other academic skills events and may be used for promotional purposes via social media, hardcopy posters, the College website, reports and in presentations for subsequent research activity. You will be informed when photographs are taken and you have the right not to appear in photographs if you prefer.
E. Managing ‘WolfWorks’ or other academic skills events
If you book to attend a ‘WolfWorks’ or other academic skills event, we will collect and process the following:
Your name, CRSid (and therefore email), level of study, mode of study and subject which are used to ensure effective communications with you and maintain attendance records. We will retain your personal information for 4 years for research purposes, when it will be deleted securely, unless it has already been anonymised.
Special category data, such as allergies, accessibility needs, and other support needs, may be collected with your explicit consent to enable your participation in a specific event or visit. We retain this data only as long as necessary, and you may need to provide it again for future events or visits.
Who we share your data with
Within the Course
We share your name, CRSID, email address, level of study, mode of study, and subject with relevant people involved in the event. This is considered necessary for courses to operate smoothly.
Some events are recorded and published on the College ‘YouTube’ channel in order to share the academic skills and knowledge with others unable to attend the events. You will be informed at the time of booking whether a course will be recorded. Please speak to the event organiser if you do not wish to appear in a recording.
Outside the Course
We may share anonymised data outside the course for promotional, evaluative and research purposes. We will refer to the Cambridge Centre for Teaching and Learning (CCTL) Ethics Committee, where necessary. The anonymised data used in subsequent research may be taken from:
- In-sessional feedback
- Comments and answers to survey questions on teaching after the course
- One-to-one interviews and focus groups to evaluate the programme.
We will retain your personal information for 3 years for research purposes as outlined above, when it will be deleted securely, unless it has already been anonymised.
You may ask us for further information on these matters at any time if you have any specific concerns.
The Library and its affiliated libraries, use a shared Library Management System and databases and, as a result, your personal information is available to all authorised libraries in the University of Cambridge, the Cambridge Theological Federation, and participating College Libraries. See the Cambridge University Libraries Privacy Notice for more information.
For the sake of completeness, University staff and current students of the University are covered by the University’s main privacy notices. Data belonging to College members are covered by a data sharing agreement between the University and the Cambridge colleges which can be viewed at https://www.ois.cam.ac.uk/policies-and-protocols
The library loan management software, ‘Alma’, is hosted outside of the UK. Your personal data is transferred to the European Economic Area using the UK-EU adequacy agreement to safeguard your data.
The library’s electronic door security system registers each use of door access cards. All data is securely stored, with access restricted to authorised members of staff and is retained for 2 years.
The College captures and records timed images of individuals moving through the College and in the Library, using a number of fixed CCTV cameras. CCTV images are automatically deleted after 30 days, unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
We also operate Wi-Fi across our site, which can be accessed by members of the College and visitors. We retain device information (such as physical MAC address and IP address), and details of the IP address the device is connected to. The data is retained for 90 days.
Your rights
You have the right: to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your information electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office. Details of how to make a complaint to the Information Commissioner’s Office are available at https://ico.org.uk/make-a-complaint/.
This is a live document which may be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
June 2026
Version Control
| Date | Version | Reason for Review/Change |
| September 2025 | Draft | New DPS created and reviewed by the College Librarian and College Data Protection Lead. |
| June 2026 | 1.0 | Changed ISL contact details, included condition for processing special category data and data protection complaints procedure for compliance with new DUAA legislation. |