How we use your personal information
This privacy notice explains how Wolfson College (“we”, “the College”, “our” and “us”) handles and uses information we collect about visitors, guests and attendees of the College (“you” and “your”), for events. In broad terms, we use your information to manage your visit or the event(s) you are attending, including dinners and accommodation and other needs requested by you, or on your behalf, as well as to maintain our records of previous, current and future attendees for events management for the College.
This statement forms part of the College’s compliance with data protection legislation in the UK.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College under UK GDPR is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge, CB2 1UR; 01223 768745; dpo@isl.colleges.cam.ac.uk.
What data are processed and why
Unless otherwise stated below, the legal basis for processing your personal information is that it is necessary in order for you to enter into a contract to provide events facilities, accommodation and/or other resources to you. In some cases, you will be providing your personal information to us alongside consent for us to use that information to provide for your needs or otherwise to provide you with an improved service while you are at the College. We will retain your information for the periods stated below, unless or until you request us to do otherwise.
We collect and process your personal information for the following purposes:
A. Maintaining clear contact information for the booking, provision and payment of goods and services.
We will hold your name, address, email address, phone number and other relevant contact details you provide to us, together with credit/debit card details and will use this information to maintain contact with you to provide your requested services, manage their delivery and bill you for them. We retain this information for 7 years after the most recent visit or event you attend. If you are a member of the College (including if you are a former student), we will provide our Development & Alumni Relations Office with your contact details in order for them to update their records, if you are happy for us to do this.
B. Providing you with necessary and preferred services.
Where relevant, we will also collect data for the provision of services, your reason(s) for attending the event, your nationality and passport details, your car registration, your credit or debit card information and/or any service preferences you request specifically (e.g. room type, access needs, dietary requirements, allergens, and amenities). This may include you providing special category personal data, which for dietary or accessibility requirements are processed based on substantial public interest to protect your health and safety and provide appropriate support with your explicit consent. We will not retain this information for any longer than necessary for the provision of the specific event or visit, which might require you to provide it on successive occasions. Where this data is provided by an event organiser, we will assume that they have obtained your consent for the data to be shared with us.
If you attend live streaming events, your image or voice may appear in livestreaming/recordings. You will be advised of this at the time of booking. For further details please refer to the College Filming, Photography and Recording Policy.
C. Providing you with details about future College events.
While we retain your contact information, we will contact you about future College events we believe may be of interest to you, providing you have given us explicit consent to do so. Consent may be withdrawn at any time by emailing conferences@wolfson.cam.ac.uk
D. Fulfilling our legal obligations.
The College is required to keep for 12 months the names and nationalities of all those staying in College accommodation. In the case of nationals outside of the UK, Republic of Ireland and the Commonwealth, we must also keep a record of your passport details and next destination. The College is also required to keep details relating to any financial transaction for a period of 7 years.
We do not undertake automated decision-making or profiling.
Where does the data come from?
The majority of personal data held are those provided by you or from event organisers making arrangements on your behalf at the time of booking, together with any further requirements or instructions that you supply to the College.
The College captures and records timed images of individuals moving through the College, using a number of fixed CCTV cameras. CCTV images are automatically deleted after 30 days, unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
Our door security system controls door access, which will, by its nature, register each use of an access card. Data from the system may be used to determine who has accessed an area in the event of an issue with a room. Like all data we store, this information is kept confidentially, with access restricted to authorised members of staff. Door access control data are deleted after 12 months.
The College operates a reception registration system for managing the safety of our guests and visitors which collects contact details for use in an emergency. The lawful basis for processing this data is explicit consent. All registration data is automatically deleted at the end of each day.
The College retains the names and contact details of individuals named in a College incident, near miss or accident report. The lawful basis for processing this personal data is compliance with a legal obligation. These records are stored confidentially for a minimum of 3 years. Where medical assistance is provided, we may also collect health information which is classed as “special category data” and is processed based on substantial public interest to protect your health and safety and provide appropriate support. Records containing health or medical information are retained for 8 years from the date the medical assistance was provided.
We also operate Wi-Fi which can be accessed by College visitors and guests. We retain device information (such as physical MAC address and IP address) and details of the IP address the device is connected to. The data is retained for 90 days.
Who we share your data with
We share personal information with cloud-based third parties to process credit/debit card payments, for booking accommodation, accounts processing and for sales via our Electronic Point of Sale (EPOS) system.
CCTV images and door access data may be shared with the police if a crime is under investigation. This data can also be used by College officers and staff to investigate allegations of staff or student misconduct, and to establish the safety of students known or suspected to be at risk.
If you have concerns or queries about any of these purposes, or how we communicate with you, please contact the College Data Protection Lead using the email or address given above.
Your rights
You have the right: to ask us for access to, rectification or erasure of your personal information; to restrict processing (pending correction or deletion); to object to communications and to ask for the transfer of your personal information electronically to a third party (data portability).
Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you have questions or concerns about your personal information, or how it is used, please speak to the relevant College staff in the first instance. If you need further guidance or want to make a complaint, please contact the College Data Protection Lead: bursar@wolfson.cam.ac.uk
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right to lodge a complaint about our management of your personal data with the Information Commissioner’s Office. Details of how to make a complaint to the Information Commissioner’s Office are available at https://ico.org.uk/make-a-complaint/
This is a live document which will be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
Last updated: June 2026
Version Control
| Date | Version | Reason for review/change |
| 2018 | Draft | New statement for review by Information & Records Working Party |
| 05/2018 | 1.0 | Publication |
| 09/2025 | 1.1 | Review by Compliance Manager. Included door access, WI-FI, guest registration, ISL change of details. |
| 06/2026 | 1.2 | Review by Compliance Manager for compliance with new DUAA legislation, effective 19/6/2026. Data protection complaints contact details provided. Condition for processing special category data included. |