skip to primary navigationskip to content

Student Privacy Notice

Student Privacy Notice

This page provides information about the use of personal information while you are a member of the University of Cambridge Graduate Union.

1. What is ‘personal information’?

‘Personal information’ means any information which relates to or identifies you as an individual.


2. How does this webpage relate to other information about data protection?

The Graduate Union engages with you in a number of ways in the course of its legitimate activities as a , and where this occurs, the Graduate Union will be able to demonstrate a legal basis for doing so and will, wherever required, inform you of its collection. This page outlines how the Graduate Union processes data and aims to notify you of how your data is processed.

When you applied to become a student you were told how the University and the relevant College(s) would use your personal information to process your application and for related purposes (see The University has its own notice for students detailing how its protocols for managing your privacy, of which the Graduate Union would be given data as all students are members unless they opt out under the 1994 Education Act. 

 In addition to the information published here, when you use specific activities and facilities offered by the Graduate Union, you will be told about any other uses of your personal information for that specific purpose, where consent is required.


3. Who will process my personal information?

The information published here applies to the use, sharing and disclosure of your personal information by the University of Cambridge Graduate Union. The Graduate Union is a separate legal entity from both the University of Cambridge, the 31 Cambridge Colleges, and any other Society or other representational body . The University and your College will provide you with its own statement setting out how it will use, share and disclose your personal information while you are a student.


 4. What personal information will be processed?

The Graduate Union will keep a record the information you submit in the course of participation in any of its activities and/or with its personnel: such as any given survey, campaign-orientated or consultative exercise, involvement in any schemes or outreach programs, correspondence, or use of the Graduate Union services and facilities. The Graduate Union will keep a record of the details you provide in these instances, as well as any supplementary personal information from the University regarding your College, course, or student status. This personal information may include data such as your name, home address, date of birth, equality and diversity data, course studied and involvement in the activities of the Graduate Union.

Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats. Access to your personal information is limited to staff who have a legitimate interest in it for the purpose of carrying out their contractual duties, and our use of your personal information will not be excessive.

The University will include your basic contact details in their internal online directory, Lookup, though you can opt out of this ( ). You may also choose to include your email address in our external online directory, Jackdaw ( ). The Graduate Union is able to access this these directories and, -reference existing data it legitimately processes with personal information from these directories.

In addition to this, the Graduate Union may process some information about you that is classed as ‘sensitive’ or ‘special category’ personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, religious beliefs or health/disability that we use for planning and monitoring purposes, or in order to provide care, help or suitable adjustments. Access to, and the sharing of, your ‘sensitive’ personal data are controlled very carefully. You will normally be given further details about our use of any such data when we collect it from you.


5. What is the purpose and legal basis of the processing?

The Graduate Union will process your personal information for a range of contractual, statutory or public interest purposes, including the following:

  • to represent your interests as a student of the University of Cambridge in accordance with the Graduate Unions constitution and democratic functioning:
  • to provide, run and coordinate activities and facilities to you (e.g. student campaigns, member services, etc.);
  • to enable your participation in organised activities and events
  • to communicate effectively with you (predominantly via email and online/via digital means), including the distribution of relevant [e-]newsletters, memos and circulars, and notice of student elections and campaigns;
  • to gauge member satisfaction and gather feedback, operate security (including CCTV), deal with complaints and issues, and for monitoring purposes;
  • to support your training, medical, safety, welfare and religious requirements; and
  • to compile statistics and conduct research for internal reporting purposes.

When we seek to obtain information for a specific campaign, cause or survey, which aims to solicit student opinion, we will seek your consent at the point of collection (which you can withdraw at any time); this will detail the purposes that this data will be used for. However, this data may also be used for equalities monitoring and student welfare, and as this processing is in the course of the official duties of the Graduate Union, the law does not require your consent for us to use your data in this way. However, your data will not be processed in such a way as to make you as an individual identifiable to any external or unauthorised parties, except where your explicit consent is given.

We consider the processing of your personal information for these purposes to be either necessary for the performance of our contractual obligations with you, or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. representation of student interests to the University), or necessary for the pursuit of the legitimate interests of the Graduate Union or an external organisation (e.g. to enable your access to external services). We will not use your personal information to carry out any wholly automated decision making that affects you .

 We will ensure that:

  • Data is kept safe and secure;
  • Data is handled legally, responsibly, and ethically;
  • We are open and transparent about what data we are using and why; and
  • All legal requirements are met regarding data privacy.


6. Who will my personal information be shared with?

In the course of its legitimate activities as a Students’ Union, the Graduate Union may share your information with service-providers contracted to support its operations. For example, the Graduate Union may engage the services of an email client to process its email; may utilise online storage services; or may engage in services that help to securely manage sensitive datasets such as mailing lists or survey data. In the course of engaging with any third party services your data will only ever be shared for legitimate administrative p legitimate activities; your data will never be sold to third parties and strict contractual provisions will be in place, along with internal management controls, to ensure contracted our data only.


We may from time to time we may gather data where relevant, to inform our campaigns. This will be used to inform campaigns, aimed at affecting the decisions of the University, College and Local/national authorities. When we do gather data, this will be clearly stated as its intended use.


As described above, your personal information is shared with relevant Collegiate University and local/national authorities. In addition, it is shared as permitted or required by law, on a considered and confidential basis, with a range of external organisations, including the following:


  • external individuals involved in relevant the Graduate Union committees or procedures
  • companies or organisations providing specific services to, or on behalf of the Graduate Union, the University and/or one or more Colleges; or
  • Relevant Government Departments (e.g. Department for Education, Home Office, Foreign and Commonwealth Office, Department of Health).
  • Relevant executive agencies or non-departmental public bodies
  • Relevant Higher Education bodies (e.g. Higher Education Funding Council for England, Office for Students, UK Research and Innovation, Universities and Colleges Admissions Service, Office for Fair Access, Office of the Independent Adjudicator, the organisation(s) running the National Student Survey and other student and leaver surveys).
  • Any relevant professional or statutory regulatory bodies (e.g. General Medical Council).
  • Local authorities.
  • On occasion and where necessary, auditors.
  • Companies or organisations providing specific services to, or on behalf of, the University and/or one or more Colleges.

You are able to control how external enquirers or organisations access details of your results and degrees awarded. We will normally provide references to third parties. We will make your examination results publicly available in accordance with our statutory provisions (you can opt out of these being posted on the Senate House notice boards and published in the Reporter). Your name and the type of degree awarded will be published in the relevant graduation programme.

On occasion, the above types of sharing may involve the transfer of your personal information outside the European Economic Area (e.g. to facilitate your participation in an exchange visit or to report to an overseas funding provider). Such transfers usually are necessary in order to meet our contractual obligations with you, and are carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information.

Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).


8. How can I access my personal information?

You have the right to access the personal information that is held about you by the Graduate Union. You are able to make a “Subject Request” by emailing .

You also have the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, or to object to processing (including the receipt of direct marketing) or to receive an electronic copy of the personal information you provided to us. Please note that all of these rights are qualified in various ways.


9. How long is my information kept?

Any information that you submit to the Graduate Union, or that was otherwise collected, is kept for a period of seven years, or longer dependent upon the use of your data as outlined at the point of collection such as the use of multi-year statistics in order to inform campaigns and other Services, ), unless you ask for it to be deleted before this.


10. Who can I contact?

If you have any questions about how your personal information is used, or wish to exercise any of your rights, please contact


11. How do I complain?

If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (


12. Are changes made to this webpage?

This webpage was last updated in May 2018. It is reviewed when necessary and at least annually. Any changes will be published here and you will be notified via this webpage and/or by email.