How we use your personal information
This privacy notice explains how Wolfson College (“we” “the College”, our” and “us”) handles and uses information we collect about our Staff, Senior Members and Academic Visitors (“you” and “your”). For these purposes, “staff” is intended to include employees, Fellows, workers, casual workers and contractors (e.g. undergraduate supervisors, ad-hoc or temporary maintenance, kitchen or catering staff etc.) and includes individuals now in receipt of a College pension.
In broad terms, we use your data to manage your employment, appointment, or membership with the College, including your role and the performance of it, how we support you as an employer, how you are paid and other statutory requirements.
This statement forms part of the College’s compliance with data protection legislation in the UK.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. The designated Data Protection Officer appointed by the College is Intercollegiate Services Limited (ISL), email: dpo@isl.colleges.cam.ac.uk
Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
What data are processed and why?
Your data is used by us for a number of purposes, including:
A. supporting your employment and your performance in your role:
Personal data includes:
i. * personal details, including name, date of birth, NI number, contact details (phone, email, postal, both work and personal) and photograph;
ii. your current and any previous role descriptions;
iii. your current and any previous contracts of employment and related correspondence;
iv. any occupational health assessments and medical information you have provided, and related work requirements;
v. * your training and development qualifications, requests and requirements.
B. ensuring that you have the right to work for the College:
Personal data includes:
i. * your recruitment information (including your original application form and associated information submitted at that time);
ii. other data relating to your recruitment (including your offer of employment and related correspondence, references we took up on your appointment, and any pre-employment assessment of you);
iii. * evidence of your right to work in the UK (e.g. a copy of your passport).
C. paying and rewarding you for your work:
Personal data includes:
i. * your bank details;
ii. * details of your preferred pension scheme;
iii. your current and previous salary and other earnings (e.g. maternity pay, overtime), and the amounts you have paid in statutory taxes
iv. correspondence between you and the College, and between members and staff of the College, relating to your pay, pension, benefits and other remuneration.
In addition, we maintain records of your use or take-up of any benefit schemes provided by us, which we collate and monitor to review the effectiveness of these staff benefits. The legal basis for this processing is that it is in our legitimate interest to ensure that any staff benefit schemes represent good value for money to both you and us and to ensure that you do not overuse your entitlements.
D. administering HR-related processes, including records of absences and regular appraisals of your performance and, where necessary, investigations or reviews into your conduct or performance:
Personal data includes:
i. * records of your induction programme and its completion.
ii. * records of your performance appraisals with your line manager.
iii. records, where they exist, of any investigation or review into your conduct or performance.
iv. records of absences from work (including but not limited to annual leave entitlement, sickness leave, parental leave and compassionate leave).
v. correspondence between you and the College, and between members and staff of the College, regarding any matters relating to your employment and/or membership and any related issues (including but not limited to changes to duties, responsibilities and benefits, your retirement, resignation or exit from the College and personal and professional references provided by the College to you or a third party at your request).
E. maintaining an emergency contact point for you:
Personal data includes:
i. details of your preferred emergency contact, including their name, relationship to you and their contact details.*
F. monitoring equality and diversity within the College:
Personal data includes:
i. information relating to your age, nationality, gender and gender reassignment, religion or beliefs, sexual orientation, ethnicity, disability and marital status.*
G. disclosing personal information about you to external organisations, as permitted or required by law.
H. For College governance purposes (if you are a Fellow or have Dining Rights)
Personal data for Fellows includes:
i. Your name, contact details (phone, email, postal both work and personal), age, your current and previous fellowship titles and dates of election, the CV and recommendations supplied at the time of your election, and related correspondence which may including details of partners and dependents in the case of visiting fellows.
Personal data for those outside College but with dining rights includes:
i. Your name, date of birth (where applicable), contact details (email, postal both work and personal) and any related correspondence.
Data marked with an * relate to information provided by you or created in discussion and agreement with you. Other data and information are generated by the College or, where self-evident, provided by a third party.
If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given below.
Unless otherwise stated, the legal basis for processing your personal data is that it is necessary for the performance of the employment contract or membership agreement we hold with you, or for statutory purposes (e.g. processing tax and pension contributions).
Special category health data may be processed by the HR department for the purposes of “Employment, social security and social protection”. Dietary requirements, allergens, and accessibility needs are processed based on substantial public interest to protect your health and safety and provide appropriate support with your explicit consent. We will not retain this information for any longer than necessary which might require you to provide it on successive occasions.
Where the data comes from
Most of personal data held are supplied by the member of staff on application for a post in the College, on appointment to a post, and during (and in some circumstances after) their employment by the College.
The College captures and records timed images of individuals moving through the College, using a number of fixed CCTV cameras. CCTV images are automatically deleted after 30 days, unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
Our door security system controls door access, which will, by its nature, register each use of an access card. Data from the system may be used to determine who has accessed an area in the event of an issue with a room. Like all data we store, this information is kept confidentially, with access restricted to authorised members of staff. Door access control data are deleted after 12 months.
The College retains the names and contact details of individuals named in a College incident, near miss or accident report. The lawful basis for processing this personal data is compliance with a legal obligation. These records are stored confidentially for a minimum of 3 years. Where medical assistance is provided, we may also collect health information which is classed as “special category data” and is processed based on substantial public interest to protect your health and safety and provide appropriate support. Records containing health or medical information are retained for 8 years from the date the medical assistance was provided.
We also operate Wi-Fi which can be accessed by College visitors and guests. We retain device information (such as physical MAC address and IP address) and details of the IP address the device is connected to. The data is retained for 90 days.
We would not monitor social media sites for any personal data relating to you, unless we believed there was a legitimate interest for us to do so (e.g. monitoring compliance with an agreed plan, such as a homeworking agreement) and only if we inform you we might do this in advance. Consequently, we do not routinely screen your social media profiles but, if aspects of these are brought to our attention and give rise to concerns about your conduct, we may need to consider them.
We do not undertake automated decision-making or profiling.
Who we share your data with
For staff and senior members we would normally publish (on our website and elsewhere) your name, photograph (if you have provided one), your email address, College contact phone number and, for Fellows and Senior Academic Visitors, basic biographical information relating to your College and University posts.
We share your personal information where necessary and appropriate across the collegiate University. The University and its partners (including all of the Colleges) have a data sharing protocol to govern the sharing of staff and members of the College. This is necessary because they are distinct legal entities. The parties may share any of the above categories of personal information, and the agreement can be viewed in full at https://www.ois.cam.ac.uk/policies-and-protocols/data-sharing-protocols
We also share relevant personal data with:
- your pension scheme and with relevant government agencies (e.g. HMRC).
- Appointed third-party service providers who use cloud-based storage systems for HR management processes, accounts processing and sales made through our Electronic Point of Sale (EPOS) system, to process credit/debit card payments and for booking accommodation.
- College insurers in the event or likelihood of a claim.
Any transmission of information between partners is managed through agreed processes that comply with UK data protection legislation.
Full names, addresses, job titles, employment dates and salary details may be shared with employers, landlords and mortgage providers, at the request of the data subject, as and when reference requests are received.
With the data subject’s consent, full names, addresses, date of birth, contact details, employment dates, job details and hazards drawn from risk assessments, and absence information are provided to the College’s Occupational Health Service provider whenever advice is required on an employee’s fitness for work and/or adjustments that may be required.
How long do we keep your data?
We hold all information for the duration of your employment and in the case of staff members, for 6 years after the end of your employment, except where noted elsewhere in this statement.
Records of your time as a Senior Member or Academic Visitor are retained as part of the College’s historical record in the College Archive for the lifetime of the College.
After you leave certain records pertaining to your employment are retained indefinitely so that the details of your employment can be confirmed and (depending on your staff group) for statistical or historical research. We will retain your personal details, including name, job role(s), years of service in the College Archive.
Information relating to senior members and staff may be reviewed and retained indefinitely in the College Archive.
We reserve the right to retain the personal data longer than the periods stated above, where it becomes apparent that there is a need to do so. For example, in the event of a major health or personal injury incident, records may need to be kept for up to 40 years.
We then store in a permanent archive:
i. your full name and title.
ii. your job title(s) or College affiliation(s) and the corresponding dates of employment or membership.
Your rights
You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at: https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right at all times to lodge a complaint about our management of your personal information with the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/data-protection-complaints/
When changes are made to this statement, we will publish the updated version on our website and notify you by other communication channels as we deem appropriate or necessary.
This is a live document which will be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
Last updated: June 2026
Version Control
| Date | Version | Reason for review |
| 2018 | Draft | New statement for review by Information & Records Working Party |
| 2018 | 1.0 | Publication |
| 09/2025 | 1.1 | Review by Compliance Manager. Amended to include academic visitors |
| 06/2026 | 1.2 | Review by Compliance Manager for compliance with new DUAA legislation, effective 19/6/2026. Data protection complaints contact details provided. Condition for processing special category data included. |