How we use your personal information​

This statement explains how St Edmund’s College (“we” and “our”) handles and uses information we collect about our College members (“you” and “your”). For these purposes, “College members” is intended to include all categories of fellows, distinguished associates, senior members, bye-fellows, visiting researchers, research associates, visiting associates, ordinary members, and widows/widowers of fellows. It excludes staff, students and alumni, who are covered by separate Data Protection Statements – see www.st-edmunds.cam.ac.uk/data-protection. In broad terms, we use your data to manage your membership of the College. If you have a role in the College, we use your data in connection with your role and the performance of it, how we support you in the role, and, if applicable, how you are paid, as well as other statutory requirements.

The controller for your personal information is St Edmund’s College, Mount Pleasant, Cambridge CB3 0BN. The Data Protection Officer for the College is the Office of Intercollegiate Services Ltd (12B King’s Parade, Cambridge; 01223 768745; college.dpo@ois.cam.ac.uk). OIS Ltd should be contacted if you have any concerns about how the College is managing your personal information, or if you require advice on how to exercise your rights as outlined in this statement. The person within the College with overall responsibility for the protection of information is the Senior Information Risk Owner who at at the time of issue is the Bursar (bursar@st-edmunds.cam.ac.uk). The person who is responsible for day-to-day monitoring of compliance with relevant legislation and dealing with any concerns relating to the College’s data protection arrangements is the College Data Protection Lead, who at the time of issue is the Governance, Risk & Compliance Manager (grcm@st-edmunds.cam.ac.uk).

Unless otherwise stated, the legal basis for processing your personal data is that it is necessary for the performance of the terms of membership existing and agreed between us, or for statutory purposes (e.g. in connection with the processing if applicable of salary, tax and pension contributions).

How your data is used by the College

Your data is used by us for a number of purposes, including:
(a) supporting your membership and if applicable your performance in your role. Such personal data includes:
• *personal details, including name, contact details (phone, email, postal, both work and personal) and photograph, your dietary needs and preferences;
• your attendance at College events, your academic achievements and interests, and your involvement in College activities; and
• your current and any previous role descriptions;
• your current and any previous contracts of employment, membership agreements and related correspondence;
• any occupational health assessments and medical information you have provided, and related work requirements; and
• *your training and development qualifications, requests and requirements.
(b) ensuring that you have the right to work for the College. Such personal data includes:
• *your recruitment information (including your original application form and associated information submitted at that time);
• other data relating to your recruitment (including your offer of membership and related correspondence, references we took up on your appointment, and any pre-membership assessment of you); and
• *evidence of your right to work in the UK (e.g. copies of your passport).
(c) maintaining an emergency contact point for you. Such personal data may include details of your preferred emergency contact, including their name, relationship to you and their contact details.*
(d) monitoring equality and diversity within the College. Such personal data may include information relating to your age, nationality, gender, religion or beliefs, sexual orientation and ethnicity.*
(e) disclosing personal information about you to external organisations, as permitted or required by law.
[The following paragraphs apply where your role with the College is remunerated]
(f) paying and rewarding you for your work. Such personal data includes:
• *your bank details;
• *details of your preferred pension scheme;
• your current and previous salary and other earnings (e.g. maternity pay, overtime), and the amounts you have paid in statutory taxes; and
• correspondence between you and the College, and between members and staff of the College, relating to your pay, pension, benefits and other remuneration.
In addition, we maintain records of your use or take-up of any benefit schemes provided by us, which we collate and monitor to review the effectiveness of these College members’ benefits. The legal basis for this processing is that it is in our legitimate interest to ensure that any staff benefit schemes represent good value for money to both you and us, and to ensure that you do not overuse your entitlements.
(g) administering HR-related processes, including records of absences and regular appraisals of your performance and, where necessary, investigations or reviews into your conduct or performance. Such personal data includes:
• *records of your induction programme and its completion;
• *records of your performance appraisals with your line manager;
• records, where they exist, of any investigation or review into your conduct or performance;
• records of absences from work (including but not limited to annual leave entitlement, sickness leave, parental leave and compassionate leave); and
• correspondence between you and the College, and between members and staff of the College, regarding any matters relating to your membership and any related issues (including but not limited to changes to duties, responsibilities and benefits, your retirement, resignation or exit from the College and personal and professional references provided by the College to you or a third party at your request).

If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given below.

Data marked with an * above relate to information provided by you, or created in discussion and agreement with you. Other data and information is generated by the College or, where self-evident, provided by a third party.

We would not monitor social media sites for any personal data relating to you, unless we believed there was a legitimate interest for us to do so (e.g. monitoring compliance with an agreed plan, such as a homeworking agreement) and only if we inform you we might do this in advance. Consequently, we do not routinely screen your social media profiles but, if aspects of these are brought to our attention and give rise to concerns about your conduct, we may need to consider them.

We also operate CCTV on our sites, which will capture footage. Our CCTV policy can be viewed at www.st-edmunds.cam.ac.uk/data-protection/cctv.

Who we share your data with

In respect of the senior membership of the College we would normally publish (on our website and elsewhere) your name, photograph (if you have provided one, also displayed with your name in College on a photoboard), your email and College contact phone number and basic biographical information relating to your College and University posts.

We share your personal information where necessary and appropriate across the collegiate University. The University and its partners (including all of the Colleges) have a data sharing protocol to govern the sharing of staff and members of the College. This is necessary because they are distinct legal entities. The parties may share any of the above categories of personal information, and the agreement can be viewed in full at https://www.ois.cam.ac.uk/policies-and-protocols/data-sharing-protocols. Any transmission of information between partners is managed through agreed processes that comply with UK data protection legislation.

We share relevant personal data with our sub-contracting agents (including but not limited to payroll and health and safety) and with relevant government agencies. If your role in College is remunerated we share relevant personal data with our payroll bureau, with HMRC, and with your pension provider. Information is not shared with other third parties without your written consent, other than your name, role and employment contact details which are made publicly available. Generally, personal data is not shared outside of the European Economic Area.

We hold all information for the duration of your membership. Where your role with the College is remunerated we will hold your information for no more than twelve months after the end of your employment, and after that time, we retain a small subset of personal data for up to seven years after your remunerated role with the College ends:

• *personal details, including name and your preferred personal contact details (if we still have these);
• your previous salaries and other earnings, pensions and the amounts you have paid in statutory taxes;
• records of your performance appraisals with the relevant College officer;
• records, where they exist, of any investigation or review into your conduct or performance;
• your reasons for leaving and any related correspondence;
• any references we have written subsequent to your employment with us.

Those marked with an * relate to information provided by you, or created in discussion and agreement with you.

We reserve the right to retain the personal data longer than the periods stated above, where it becomes apparent that there is a need to do so – for example, in the event of a major health or personal injury incident, records may need to be kept for up to forty years.

We then store in a permanent archive:

a. your full name and title, and photograph;
b. your job title(s), College office(s) and role(s) held, and College affiliation(s) and the corresponding dates of employment/membership;
c. information relating to significant involvement with College affairs and events;
d. information on your academic work provided by you in connection with your appointment or election, including the identity and any letter of recommendation by the Fellow sponsor; and
e. information relating to your significant academic achievements and awards.

Your rights

You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

Failure to provide the information reasonably requested of you may result in disciplinary action taken by the College, which could ultimately lead to the termination of your membership.

You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office at https://ico.org.uk/concerns