How we use your personal information
This privacy notice explains how Wolfson College (“we”, “our”, “the College” or “us”) handles and uses the data we collect about our alumni and our past, current and future supporters, volunteers and participants in membership groups (“you” or “your”), including those who have requested to be on our mailing lists.
This statement forms part of the College’s compliance with data protection legislation in the UK.
The controller for your personal data is Wolfson College, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge CB2 1UR; email: dpo@isl.colleges.cam.ac.uk
What data are processed and why?
In broad terms, we use your data to manage the ongoing relationship between you and the College as part of our lifelong community of scholars, including keeping in touch with you, keeping up to date on your achievements, and maintaining your engagement with and contribution to College life and the Wolfson community.
We collect and process your personal data, as specified below, for a number of purposes, including:
- Maintaining a formal record of your academic progress and achievements at Wolfson, the University of Cambridge and elsewhere.
- Retaining a formal record of your academic, career or other life achievements in order to congratulate you, to involve you in College life, to strengthen Wolfson’s reputation through our connection with you and help you to network with other College members effectively.
- Engaging you in College and University events that we believe will be of interest to you, including alumni and open events, events with students such as workshops or careers events, volunteering opportunities, student support and other ways you can contribute to the life of the College and its community.
- Providing you with information about the College, including major initiatives and programmes relating to either the academic endeavour, or the provision of services and facilities to members and the wider public.
- Encouraging you to make a financial contribution to the College and processing any such contributions.
- Assessing the likelihood that you will, now or in the future, make a financial contribution (gift) to the College.
- Promoting third-party services we believe will be of interest to you.
- Sending you e-newsletters, publications and surveys.
- Internal reporting and record keeping.
The legal basis for processing your personal data is that it is necessary for the purposes of our legitimate interests, (except where elsewhere in this statement we have indicated otherwise), where we have concluded that our interests do not impact inappropriately on your fundamental rights and freedoms. You may ask us to explain our rationale at any time. There is no statutory or contractual requirement for you to provide us with any personal data.
Where we process special category personal data about you (as outlined above), we process this data under the following legal bases:
- Substantial public interest: where processing is necessary to meet our obligations in areas such as health and safety, equality of opportunity, safeguarding, or the provision of appropriate support and adjustments.
- Explicit consent: where you have voluntarily provided this information for a specific purpose and no other legal condition applies.
Where the data comes from
We may hold information relating to you from several sources. A significant proportion of the information we hold on alumni is that which you provide to us (for example, you may give us information by filling in forms on the College website, or by corresponding with us by telephone, email or otherwise). If you are a student or studied at Cambridge, some of your personal data is transferred from your student record to the College’s alumni database. We may also obtain data from the University, publicly available sources, and trusted third party data providers as outlined in the Annex.
Who we share your data with
We believe that most alumni understand in detail the complex and many interactions of the College with the University of Cambridge. Personal data of our members is shared with the University routinely throughout any course of study, and it is our strong preference to continue such collaborative working thereafter.
There is a data sharing protocol in place between the University of Cambridge, the Colleges in the University of Cambridge and Cambridge in America to govern the sharing of personal data of alumni and other supporters, which complies with UK data protection legislation. This is necessary because they are distinct legal entities. The protocol outlines that (depending on constraints set by you, and which you may change at any time) the College may share any of the above categories of personal data with the University. The protocol can be viewed at https://www.ois.cam.ac.uk/policies-and-protocols
For clarity, the College has a separate database from the University, but has access to the University’s database: additionally, we maintain other electronic and paper records.
The University has its own data protection statement and procedures.
We also share data on a considered and confidential basis, where appropriate, with:
- Cambridge in America (the University’s affiliate alumni office in the USA).
- third party agencies who provide us with data in the public domain about alumni and supporters.
- selected companies who provide College-branded or College-endorsed products and services.
- volunteer partners closely related to us (e.g. College trustees and alumni group representatives).
- contractors providing services to you on our behalf, or services to us (our “data processors”) as outlined above, including, but not limited to:
- HMRC, for Gift Aid claim and audit
- The College Auditors
- Lloyds Bank plc, for financial transactions including credit/debit card payments for donations and events
- Editors, designers and mailing houses who work with us on College publications
- Blackbaud Inc., the vendor of our contact management database
- The Charities Aid Foundation (CAF), for the receipt of online donations and direct debit processing
- Fundraising consultants, to help us to manage Giving Days and other fundraising opportunities
- Email marketing platforms, for the processing and dispatch of bulk email communications
- Self-service ticketing and event management platforms when we organise events
- Our accounts processing system provider
- Software-as-a-service (SaaS) companies for the collection of survey data and opinion to guide our alumni relations and fundraising programmes.
The College captures and records timed images of individuals moving through the College, using a number of fixed CCTV cameras. CCTV images are automatically deleted after 30 days, unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
Our door security system controls door access, which will, by its nature, register each use of an access card. Data from the system may be used to determine who has accessed an area in the event of an issue with a room. Like all data we store, this information is kept confidentially, with access restricted to authorised members of staff. Door access control data are deleted after 12 months.
The College operates a reception registration system for managing the safety of our guests and visitors which collects contact details for use in an emergency. The lawful basis for processing this data is consent and all registration data is automatically deleted at the end of each day.
The College will retain the names and contact details of those who are named in a College Incident, Near Miss, or Accident Report. These reports may contain sensitive personal data provided with the consent of individuals and are stored confidentially for a minimum of 3 years.
We also operate Wi-Fi which can be accessed by College visitors and guests. We retain device information (such as physical MAC address and IP address) and details of the IP address the device is connected to. The data is retained for 90 days.
How we protect your data
We ensure we have appropriate data sharing agreements in place to protect your personal data before using a third-party service.
We do not sell your personal data to third parties under any circumstances; nor permit third parties to sell on data we have shared with them.
We facilitate communication between individual alumni (of the College or the University), but in doing so we do not release personal contact details without your express permission.
Any transfers of your data overseas (outside of the UK are protected either by ‘adequacy regulations’ issued by the UK Government (declaring the recipient country as a 'safe' territory for personal data), or by relevant standard contractual clauses which give obligations for the recipient to safeguard the data.
Communications
If you are a new contact for our Development Office, we will ask you at the outset how you would like to receive news and other communications from us. If you are already receiving such communications, you are able to change your preferences (or ask us to stop sending you news and other communications completely) by completing the online form on the College website: https://www.wolfson.cam.ac.uk/alumni/contact, or by emailing the Development team at development@wolfson.cam.ac.uk. You may request changes at any time.
We will always respect a request by you to stop processing your personal data in addition your statutory rights are set out below.
Data retention
We will retain your data indefinitely in support of your lifelong relationship with the College or until you request us to do otherwise. Further details are provided in the Annex at the end of this document. Please contact us at development@wolfson.cam.ac.uk if you wish to ask us not to process your personal data for particular purposes. Where you have specific requests relating to how we manage your data, we will endeavour to resolve these, but please note there may be circumstances where we cannot comply.
Where you opt out of all future communications or exercise your right to erasure, we will continue to maintain a core set of personal data (name, subject(s), matriculation and graduation details, unique identification number and date of birth) to ensure we do not contact you inadvertently in future and to maintain your academic record. We may also need to retain some financial records about your statutory purposes (e.g. Gift Aid, anti-fraud and accounting matters).
Fundraising Regulator
Wolfson College is a member of the Fundraising Regulator, and we continually review our practises to respect the privacy of our alumni and friends.
Your Rights
You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at: https://www.wolfson.cam.ac.uk/about/governance/data-protection
You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office. Details of how to make a complaint to the Information Commissioner’s Office are available at https://ico.org.uk/make-a-complaint/data-protection-complaints/
This is a live document which will be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
Last updated: June 2026
ANNEX
We collect and process your personal data, as specified below, for a number of purposes, including:
A. Maintaining a record of your academic progress and achievements at the College, the University of Cambridge and elsewhere:
We retain personal data (provided by you or by the University of Cambridge, or created by us), including:
i. your current name and any previous names you have had
ii. unique personal identifiers (e.g. student number, CRS ID, date of birth, photograph)
iii. your current and previous contact details
iv. your application details, our assessment of your application and the details of any offer(s) of study we have made
v. records of your academic provision from the College (including supervisions, College examinations and other academic support)
vi. matriculation and graduation details and records of your academic qualifications (including those prior to becoming a member of the College)
vii. other details of your academic progress or achievement (e.g. College or University awards or prizes).
B. Retaining a formal record of your academic career or other life achievements in order to congratulate you, to involve you in College life, to strengthen Wolfson’s reputation through our connection with you and help you to network with other College members effectively;
We retain personal data (provided by you), including:
i. details of your achievements since you completed your course(s) of study
ii. membership of College and external clubs and societies (including alumni groups)
iii. your previous and current employment status (including retirement), including job title, sector, income, work contact details and dates of employment.
When you provide this information, we will assume (unless you notify us otherwise) that we can promote these achievements in our public literature and can use this information for other purposes outlined in this statement. We may supplement information from other public sources that we consider to be reliable (e.g. your public social media profile(s), King’s Honours List, Companies House, high profile news reports or articles) and may check their accuracy with you from time to time.
C. Engaging you in College and University events that we believe will be of interest to you, including alumni and open events, volunteering opportunities, student support and other ways you can contribute to the life of the College and its community:
We retain personal data (provided by you or by the University of Cambridge, or created by us), including:
i. your key relationships with other members (past or present) of the University of Cambridge, or any of its Colleges.
ii. your previous attendance at Wolfson or University events.
iii. information about your areas of personal interest.
iv. personal data relating to your attendance at events and your personal preferences (e.g. dietary or accommodation requirements, access needs or requests).
v. records of any communications (verbal or written) we have had with you, including the purpose and outcome of those communications.
When you provide this information, we will assume (unless you notify us otherwise) that we can use this information for other purposes outlined in this statement. We may supplement information from other public sources that we consider to be reliable (e.g. your public social media profile(s), University publications, high profile news reports or articles) and may check their accuracy with you from time to time.
D. Providing you with information about the development of the College, including major initiatives and programmes relating to either the academic endeavour, or the provision of services and facilities to members and the wider public:
We retain personal data (provided by you or by the University of Cambridge, or created by us), including:
i. any communication preferences confirmed by you.
ii. ways in which you have supported the College.
By providing us with email addresses and telephone numbers, we have taken this to be consent to use those channels to contact you for this and other purposes outlined in this statement, unless you have outlined to us your preferred communication channels. When you provide this information, we will assume (unless you notify us otherwise) that we can use this information for other purposes outlined in this statement.
E. Encouraging you to make a financial contribution to the College and processing any such contributions:
The College’s income consists of gifts and benefactions, income derived from prudent investment of any endowment and student fees. We value all financial contributions from our members and other supporters and, accordingly, retain personal data (provided by you or by the University of Cambridge, or created by us), including:
i. the purposes and amounts of any donations or other support previously provided to the University or to the College by you.
ii. the method(s) of payments used and related payment references.
iii. your bank details (for processing direct debit or other financial transactions).
iv. your tax status and Gift Aid declaration.
Some of this financial information needs to be retained for statutory purposes for a number of years (e.g. Gift Aid, anti-fraud and accounting matters). When you provide this information, we will assume (unless you notify us otherwise) that we can use this information for other purposes outlined in this statement. We will also use this information for the issuing of donor acknowledgment lists and other ways of stewardship and thanking donors.
Before seeking or accepting major donations, we are required to conduct due diligence, including reviewing publicly available personal data relating to the donor's criminal convictions and offences.
F. Assessing the likelihood that you will, now or in the future, make a financial contribution (gift) to the College:
The College undertakes research to determine the likelihood that you will now, or in the future, make a financial contribution (gift) to the College. This work may be carried out by the College or a third party working on our behalf and results in us creating personal data including:
i. Your estimated income or asset worth (where this is not provided by you).
ii. your potential capacity to make a gift, which is determined by a combination of your giving history, your attendance at College and University events, and your other interactions with the College since you graduated, including any positive or negative indications from you about your capacity or willingness to give to the College.
iii. gifts you have made to other charitable organisations.
Our research includes incorporating information from public sources that we consider to be reliable (e.g. your public social media profile(s), King’s Honours List, Companies House, high profile news reports or articles, company websites, the Charity Commission and property websites). In using these sources, we have considered the potential intrusion of your privacy. In most cases, our assessment above aims to exclude you from unwelcome or inappropriate approaches so as not to compromise your ongoing relationship with us.
We may use external contractors or consultants to assist us in this research. Where we do so, any sharing of your personal data is on the strict understanding that they may not repurpose it or pass it on to other third parties. We do not sell your personal data under any circumstances.
G. Promoting third-party services we believe will be of interest to you:
We retain personal data (provided by you) including:
i. Any preferences to be excluded from such services.
H. Sending you e-newsletters, publications and surveys:
Wolfson sends regular e-newsletters, publications and surveys and retains data from those communications, including any:
i. personal data (provided by you).
ii. any preferences to be excluded from such communications.
iii. records of your engagement, e.g. links clicked in e-newsletters.
I. Internal reporting and record keeping:
Wolfson is required to maintain certain records for tax and auditing purposes.
If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at development@wolfson.cam.ac.uk.
If you have any concerns about your personal data held by the University, please contact the University separately by emailing: data.protection@admin.cam.ac.uk
College Data Protection Lead
Last reviewed: June 2026
Version Control
| Date | Version | Reason for review |
| 2018 | Draft | New statement for review by Information & Records Working Party |
| 2018 | 1.0 | Publication |
| 09/2024 | 1.1 | Section G added to cover communications |
| 09/2025 | 1.2 | Review by Compliance Manager. Change of title from supporters to Friends. Amended OIS to ISL with new contact details. |
| 06/2026 | 2.0 | Review by Compliance Manager. Included complaints process for the new DUAA legislation. Added a link to the Contact Preferences page on the College website. Added H, I & J to the Annex. Due diligence for major donations included in E. |