How we use your personal information
This privacy notice explains how Vlogٷ (“we” “the College”, our” and “us”) handles and uses information we collect about our Staff (“you” and “your”). For these purposes, “Staff” is intended to include employees, workers, casual workers, undergraduate supervisors, ad-hoc or temporary maintenance, kitchen or catering staff and also includes individuals in receipt of a College pension.
This statement forms part of the College’s compliance with data protection legislation in the UK.
The controller for your personal data is Vlogٷ, Barton Road, Cambridge CB3 9BB. Your primary contact for all data protection matters is the College Data Protection Lead: bursar@wolfson.cam.ac.uk This is the same address to contact if you wish to exercise any of your data protection rights, including requesting copies of personal data the College holds about you, or making a complaint about how the College has managed your personal data.
The designated Data Protection Officer appointed by the College under UK GDPR is Intercollegiate Services Limited (ISL), 64 Bridge Street, Cambridge, CB2 1UR; 01223 768745; dpo@isl.colleges.cam.ac.uk.
What data are processed and why?
In broad terms, we use your data to manage your employment, including your role and the performance of it, how we support you as an employer, how you are paid and other statutory requirements.
Unless otherwise stated, the legal basis for processing your personal data is that it is necessary for the performance of the employment contract we hold with you and for statutory purposes (e.g. processing tax and pension contributions). Special category health data such as dietary requirements, allergens, and accessibility needs are processed for reasons of substantial public interest to protect your health and safety and to provide support for individuals with a particular disability or medical condition.
We collect and process personal information provided by you or created by us for the following purposes:
A. Maintaining your personal details, including ensuring effective communications with you.
Personal data includes:
i. *your current name and any previous names you have had.
ii. * unique personal identifiers (e.g. CRSID, date of birth, National Insurance number, P45, photograph).
iii. your current and previous contact details.
iv. your next-of-kin, emergency contact and their relationship to you.
v. disclosure of any criminal background.
We will assume that you have obtained permission from your next-of-kin and emergency contact for us to hold their information for that purpose.
B. Maintaining a formal record of your employment by the College.
Personal data includes:
i. your application details where appropriate, your CV, our assessment of your application and the details of any offer(s) we have made.
ii. evidence of your eligibility to work in the UK.
iii. records of progress and performance at work (including staff development reviews, probation evaluations, submissions for discretionary salary increments, periods of holiday leave, leave of absence and sick-leave, promotions, clocking-in records (where applicable), personal risk assessments, disciplinary records, complaints you make to the College and their outcomes, attendance on approved training courses, participation on College committees).
iv. records of your qualifications, including those prior to joining the College.
v. other details of your achievements (e.g. offices and appointments, College and external awards or prizes, membership of professional bodies, participation in sports teams or other social activities, especially in a College or University context).
C. Maintaining records of what we owe and pay you in performance of our contractual agreement with you.
Personal data includes:
i.* name, address, phone number, email address, date of birth, National Insurance number, bank details, salary and other payroll information, tax code, pension scheme membership, benefits, Court Orders, student loan details,
ii. *expenses claims to allow us to reimburse your expenses.
D. Maintaining a record (where appropriate), of any personal needs you require to contribute and participate fully in your work
Personal data includes:
i. *details of any disclosed disability, illness, and any consequent support, or other support needs.
ii. details of consultations with the College Nurse or Welfare Team.
iii. *car registration, motorcycle and bicycle registration and safe storage details.
iv. *details of any serious risks affecting you, for example severe allergies.
v. *arrangements agreed with you to manage your use of College and University facilities (for example computing services, sports and gym facilities, library), including personal emergency evacuation plans (PEEP) and any other special requirements that may be linked to your health or religious beliefs.
vi. details of any accident or injury sustained by you while on College premises, and our response, recorded for health and safety purposes.
vii. copies of statements from professional medical advisers, provided either by you or directly to us.
viii.records of your library borrowing, and any fines that accrue, processing data entered on and stored on a shared University-wide Library system.
* Indicates data provided by you. All other data is obtained direct from your bank, or from HMRC, pension scheme administrators, and courts.
The information listed in sections A-D above is normally retained during your employment by the College, and then for no longer than six years after you leave. Information held in our email system is discarded when your user account is deactivated within a year of leaving the College’s employment.
Personal evacuation plans are deleted when they are no longer relevant or when an individual leaves the College’s employment. Accident records are deleted after three years, unless required as part of an insurance claim. Names, email addresses and hardware identifiers and network connection records stored on College servers are retained while your account is active. Medical records are held by the College Nurse for eight years.
Please note that where you are referred to services not offered directly by the College (e.g. the University Counselling Centre and Access & Disability Resource Centre, and the College’s external Occupational Health provider), these support services will have their own privacy notices and we suggest that you read these.
E. Supporting your employment and your performance in your role.
Personal data includes:
i. * your name, date of birth, NI number, contact details (phone, email, postal, both work and personal) and photograph.
ii. your current and any previous role descriptions.
iii. your current and any previous contracts of employment and related correspondence.
iv. any occupational health assessments and medical information you have provided, and related work requirements.
v. * your training and development qualifications, requests and requirements.
F. Maintaining records of what we owe and pay you in performance of our contractual agreement with you.
Personal data includes:
i. * name, address, phone number, email address, date of birth, National Insurance number, bank details, your current and previous salary and other earnings (e.g. maternity pay, overtime), and the amounts you have paid in statutory taxes, tax code, pension scheme membership, benefits, Court Orders, student loan details. The data are either provided by you, or directly from your bank, HMRC, pension scheme or Courts.
ii. correspondence between you and the College, and between members and staff of the College, relating to your pay, pension, benefits and other remuneration.
iii. expenses claims to allow us to reimburse your expenses.
iv. loan repayments.
v. reimbursement of overpayments.
In addition, we maintain records of your use or take-up of any benefit schemes provided by us, which we collate and monitor to review the effectiveness of these staff benefits. The legal basis for this processing is that it is in our legitimate interest to ensure that any staff benefit schemes represent good value for money to both you and us and to ensure that you do not overuse your entitlements.
G. Administering HR-related processes, including records of absences and regular appraisals of your performance and, where necessary, investigations or reviews into your conduct or performance.
Personal data includes:
i. * records relating to training and qualifications.
ii. records, where they exist, of any investigation or review into your conduct or performance.
iii. records of absences from work including, but not limited to, annual leave entitlement, sickness leave, parental leave and compassionate leave.
iv. correspondence between you and the College, and between members and staff of the College, regarding any matters relating to your employment and any related issues including, but not limited to, changes to duties, responsibilities and benefits, your retirement, resignation or exit from the College and personal and professional references provided by the College to you or a third party at your request.
H. Maintaining data to enable the College to produce statistics and research for internal and statutory reporting purposes.
Personal data includes:
i. * information relating to your age and gender, nationality, gender and gender reassignment, religion or beliefs, sexual orientation, ethnicity, disability and marital status. The lawful basis for collecting this data is that is in our legitimate interests to do so that we can monitor our equal opportunity practices and make adjustments to support staff with disabilities. This data is retained for 6 years after your employment ends.
I. Disclosing personal information about you to external organisations, as permitted or required by law.
If you have concerns or queries about any of these purposes, or how we communicate with you, please contact the College Data Protection Lead at the address given above.
We would not monitor social media sites for any personal data relating to you, unless we believed there was a legitimate interest for us to do so (e.g. monitoring compliance with an agreed plan, such as a homeworking agreement) and only if we inform you we might do this in advance. Consequently, we do not routinely screen your social media profiles but, if aspects of these are brought to our attention and give rise to concerns about your conduct, we may need to consider them.
We ensure appropriate safeguards are in place to protect your privacy in line with our Data Protection Policy.
We do not undertake automated decision-making or profiling.
Where the data comes from
Data marked with an * relate to information provided by you, on application for a post in the College, on appointment to a post, and during (and in some circumstances after) their employment with the College, or created in discussion and agreement with you. Other data and information are generated by the College or, where self-evident, provided by a third party.
Why we need this information
You are required to provide certain personal data to the College in order to become and continue to be a member of staff, be remunerated for your work, and enable the College to meet its legal and statutory obligations.
We also collect the following data:
- CCTV: The College captures and records timed images of individuals moving through the College, using a number of fixed CCTV cameras. CCTV images are automatically deleted after 30 days, unless a copy is made for evidential or investigative purposes. Further details of the College’s CCTV system and procedures can be found in our CCTV Policy and Code of Practice.
- Security Access System: Our door security system controls door access, which will, by its nature, register each use of an access card. Data from the system may be used to determine who has accessed an area in the event of an issue with a room. Like all data we store, this information is kept confidentially, with access restricted to authorised members of staff. Door access control data are deleted after 12 months.
- Accidents: The College retains the names and contact details of individuals named in a College incident, near miss or accident report. The lawful basis for processing this personal data is the College’s compliance with a legal obligation. These records are stored confidentially for a minimum of 3 years. If the College Nurse provides medical assistance, we may also collect health information which is classed as “special category data” and is processed based on substantial public interest to protect your health and safety and provide appropriate support. Healthcare professionals are legally required to maintain medical records for 8 years.
- Wi-Fi: The College’s Wi-Fi system collects device information (such as physical MAC address and IP address) and details of the IP address the device is connected to. The data is retained for 90 days.
Filming, photography and recording: Some College events may be photographed, filmed or recorded. We will tell attendees when this is expected to take place and you may ask not to be photographed, filmed or recorded. We may process photographs, film, audio recordings, and spoken or written words for College communications and publicity purposes. We use this information to publicise College events, activities and services. This may include use in social media, websites, printed publications, marketing, press coverage, information leaflets, electronic newsletters, presentations and other publicity materials.
Where we rely on consent, you may withdraw it at any time by notifying us. Withdrawal will not affect any processing that has already taken place. We will take reasonable steps to stop further use where possible, but we cannot guarantee removal of material that has already been published online, on social media, by the press, or by other attendees at an event and we may not be able to control its further storage, use or circulation.
We may collect contact details, including your name, postal address, email address, telephone number and signature. Where relevant, we may also collect a child’s name and date of birth. Where images or recordings of children are taken, we will obtain consent from a parent or guardian.
Under UK GDPR, we rely on the following lawful bases when processing this information:
- consent, where you have attended an event, completed a photography, filming or recording consent form; and
- legitimate interests, where photography, filming or recording takes place at a College event and individuals may be identifiable.
Further details are provided in the College’s Filming, Photography & Recording Policy.
Who we share your data with
We would normally publish, on the staff intranet and elsewhere, your name, photograph, work email address and College phone number.
We may share images, and recordings where necessary for College communications and publicity work. This may include sharing with news media, design and print agencies, and organisations that support publication or promotion. Images or recordings may appear in printed materials, on websites or on social media, and may therefore be accessible to anyone who views those channels or materials.
We share your personal information where necessary and appropriate across the collegiate University. The University and its partners (including all of the Colleges) have a data sharing protocol to govern the sharing of College staff. This is necessary because they are distinct legal entities. The parties may share any of the above categories of personal information, and the agreement can be viewed in full at
We also share relevant personal data with:
- your pension scheme and with relevant government agencies (e.g. HMRC).
- Appointed third-party service providers who use cloud-based storage systems for HR management processes, accounts processing and sales made through our Electronic Point of Sale (EPOS) system, to process credit/debit card payments and for booking accommodation.
- College insurers in the event or likelihood of a claim.
Any transmission of information between partners is managed through agreed processes that comply with UK data protection legislation.
Full names, addresses, job titles, employment dates and salary details may be shared with employers, landlords and mortgage providers, at the request of the data subject, as and when reference requests are received.
With the data subject’s consent, full names, addresses, date of birth, contact details, employment dates, job details and hazards drawn from risk assessments, and absence information are provided to the College’s Occupational Health Service provider whenever advice is required on an employee’s fitness for work and/or adjustments that may be required.
How long do we keep your data?
We hold all information for the duration of your employment and in the case of staff members, for 6 years after the end of your employment, except where noted elsewhere in this statement.
Records of your time as a Senior Member or Academic Visitor are retained as part of the College’s historical record in the College Archive for the lifetime of the College.
After you leave certain records pertaining to your employment are retained indefinitely so that the details of your employment can be confirmed and (depending on your staff group) for statistical or historical research. We will retain your personal details, including name, job role(s), years of service in the College Archive.
Information relating to senior members and staff may be reviewed and retained indefinitely in the College Archive.
We reserve the right to retain the personal data longer than the periods stated above, where it becomes apparent that there is a need to do so. For example, in the event of a major health or personal injury incident, records may need to be kept for up to 40 years.
We then store in a permanent archive:
i. your full name and title.
ii. your job title(s) or College affiliation(s) and the corresponding dates of employment or membership.
Your rights
You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you feel that the College has not met your expectations while handling your personal data, you have the right to make a complaint. Full details of the College’s data protection complaints procedure can be found at: /about/governance/data-protection
You retain the right at all times to lodge a complaint about our management of your personal information with the :
When changes are made to this statement, we will publish the updated version on our website and notify you by other communication channels as we deem appropriate or necessary.
This is a live document which will be updated periodically. The most recent version will always be available on our website.
College Data Protection Lead
Last updated: June 2026
Version Control
| Date | Version | Reason for review |
| 2018 | Draft | New statement for review by Information & Records Working Party |
| 2018 | 1.0 | Publication |
| 09/2025 | 1.1 | Review by Compliance Manager. Amended to include academic visitors |
| 06/2026 | 1.2 | Review by Compliance Manager for compliance with new DUAA legislation, effective 19/6/2026. Data protection complaints contact details provided. Condition for processing special category data included. |
| 07/2026 | 2.0 | The previous privacy notice for staff and Fellows has been split for ease of reference and reading. |