This statement explains how the Office of Intercollegiate Services (“OIS”) handles and uses data it collects about staff, officers and students (both current and prospective) of the University of Cambridge, one or more of the Colleges and/or the Colleges of the Cambridge Theological Federation, for processes it is commissioned to operate by one or more of those institutions.
When changes are made to this statement, we will publish the updated version on our website.
Unless otherwise stated below, the data controller for your personal data remains the institution that supplied OIS with the data (i.e. either the University of Cambridge or one of the Cambridge Colleges). For this personal data, OIS only acts in the capacity of a data processor for one or more of those institutions.
The lawful basis for processing your personal data is that it is in the legitimate interests of one or more persons to do so. This is usually the legitimate interests of the relevant data controller but may also be your own legitimate interests. In all cases, OIS has concluded that the collection, storage or processing of your personal data does not infringe significantly any of your rights or freedoms. You may ask us for further information on these matters at any time if you have specific concerns by contacting us on 01223 768745 or admin@ois.cam.ac.uk.
How your data is used by OIS
OIS is commissioned by the Colleges, individually or collectively, to manage a number of processes including:
Relevant to individual students (current or prospective) as data subjects
- initial processing of requests from students for the extraordinary transfer from one College to another (commissioned by the Senior Tutors’ Committee);
- advice on complaints and disciplinary investigations being conducted within the College (commissioned by the individual Colleges);
- the Graduate Fee Agreement intercollegiate redistribution of fees (commissioned by the Bursars’ Committee);
- the Cambridge Bursary Scheme intercollegiate redistribution and periodic reviews of its efficacy (commissioned by the Bursars’ Committee);
Relevant to persons commissioned to do work for either a College or an intercollegiate body as data subjects
- payments to individuals appointed to specific intercollegiate roles (commissioned by the Senior Tutors’ Committee);
- Initial Payments to new undergraduate supervisors (on behalf of all Colleges, and commissioned by the Senior Tutors’ Committee);
- the Scheme for managing the placement of University Teaching Officers in Colleges (commissioned by the Colleges’ Committee);
- management of the Colleges’ Committee, Bursars’ Committee, Senior Tutors’ Committee and the College Development Directors’ Committee and their associated sub-committees, document repositories and mailing lists (commissioned by those committees respectively);
- management of intercollegiate surveys commissioned by the committees listed in (8) above, or by any of the more informal intercollegiate communities operated by the Colleges collectively;
Relevant a wider range of people as data subjects
- the commissioning of OIS to act as the Colleges' statutory Data Protection Officer, if required under the UK GDPR, and the provision of advice on particular cases, including personal data breaches and subject access requests (commissioned by the Bursars’ Committee);
- to act as an advisor for Freedom of Information Act requests received by the Colleges, either individually or collectively and the provision of advice on particular cases (commissioned by the Bursars’ Committee);
- support for a range of intercollegiate and College-specific IT packages, (currently badged under the identity of CASC (commissioned by the Colleges collectively for some packages and individually for others).
Further details are provided in the Annex. If you have concerns or queries about any of these purposes, please contact us on 01223 768745 or admin@ois.cam.ac.uk.
How OIS shares your personal data
The OIS shares your personal data only with the data controller that has provided that information, unless specified otherwise in the Annex. Personal data is not shared to institutions other than the University of Cambridge, the Cambridge Colleges or the Colleges of the Cambridge Theological Federation, unless under specific instruction from the relevant data controller.
The University and each of the Colleges have their own data protection statement and procedures.
Your rights
You have the right: to ask us for access to, rectification or erasure of your data; to restrict processing (pending correction or deletion); to object to communications or direct marketing; and to ask for the transfer of your data electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
You retain the right at all times to lodge a complaint about our management of your personal data with the Information Commissioner’s Office at https://ico.org.uk/concerns/
ANNEX
We collect and process your personal data, as specified below, for a number of purposes, including:
1. Requests from students for the extraordinary transfer from one College to another:
We retain personal data (provided by your College) from the point of enquiry to OIS by the College until the end of the calendar year next following the date of receipt and formal acceptance of the request. The personal data during this period includes:
i) your completed request form and associated data;
ii) any decisions in relation to your request;
iii) in the event of a transfer request being approved for wider circulation to Colleges, reasons from individual Colleges for accepting or not accepting the transfer;
iv) copies of correspondence with your College about your request.
After this period, we retain in a permanent record your name, your course and Colleges, a general reason for the transfer request, the date of your request and the outcome for statistical purposes.
2. Advice on complaints and disciplinary investigations being conducted by a College:
Where OIS is approached by a College to provide advice on the nature, content or conduct of an internal complaint or disciplinary investigation, OIS may receive copies of any documents submitted to any investigating authority and any subsequent correspondence as a result of the findings of any investigation. OIS retains copies of information for at least 12 months after the resolution of the corresponding investigation, and until the end of the calendar year following that period. After that time, no information is retained.
3. The Graduate Fee Agreement intercollegiate redistribution of fees:
In order to manage the intercollegiate redistribution of the Graduate Fee Agreement, OIS receives from the University a list of all tuition fee liabilities of all postgraduate students (along with your name, student number, course and mode of study, fee status and College) registered with the University: OIS uses this data to audit and validate and to identify the portion of fees each College is entitled to. The personal data is retained until the end of the calendar year following the end of the academic year of the fees in question.
4. The Cambridge Bursary Scheme intercollegiate redistribution:
In order to manage the intercollegiate redistribution of the finances relating to the Cambridge Bursary Scheme, OIS receives from the University a list of all amounts in bursaries and scholarships processed through the Student Loan Company (along with your name, student number, course and mode of study, household income and College): OIS uses this data to audit and validate and to identify the amounts of monies distributed between the University and each College. The personal data is retained until the end of the calendar year following the end of the academic year of the bursaries in question.
5. Payments to individuals appointed to specific intercollegiate roles:
OIS manages payments to individuals who are appointed by the Colleges collectively for specific roles, including some offices of the company and a number of self-employed contractors. To enable the processing of those payments, OIS collects and retains from you personal details and relevant banking information in order to pay you for your work or services. Financial records are then retained for seven financial years.
6. Initial Payments to new undergraduate supervisors:
OIS manages payments to individuals who are recruited in any capacity to provide undergraduate supervisions for one or more Colleges. To enable the processing of those payments, OIS uses personal and financial data collected through one of its products (CamCORS), using your preferences as set out there for such payments. Financial records are then retained for seven financial years.
7. The Scheme for managing the placement of University Teaching Officers in Colleges:
OIS receives from the University a list of University Teaching Officers who also hold a Fellowship in one of the Colleges, and verifies this data with the relevant Colleges. The personal data includes your name, and your College and University affiliations. The data is retained until you are no longer a University Teaching Officer of the University of Cambridge, as advised by the University or your College.
For new University Teaching Officer appointments, we receive and hold detailed biographical information (in the form of a CV), usually provided by you. We retain this until such time that you have secured a College Fellowship through the Scheme or otherwise pass the deadline of the consideration of your application by the Scheme.
We may also hold biographical data of other University Teaching Officers not covered explicitly by the Scheme, but who have requested OIS to circulate those details to the Colleges.
8. Management of the Colleges’ Committee, Bursars’ Committee, Senior Tutors' Committee and the College Development Directors’ Committee and its associated sub-committees, working groups and mailing lists:
OIS is responsible for the management of a number of intercollegiate committees, which may include members of the Colleges and of the University. It therefore retains sufficient personal data to maintain effective communications with and between committees and committee members, including the maintenance of a number of membership and phone and email lists. The personal data includes persons delegated by committee members to receive information or communications on their behalf (e.g. personal assistants). Personal data is usually obtained through the University’s person search facilities and verified with individuals, and is retained in a permanent record of previous and current membership of committees (including in archived minutes and papers).
9. Management of intercollegiate surveys:
OIS is commissioned by one or more of the intercollegiate committees to undertake surveys, where it acts as an independent data controller. In some cases, the surveys may include personal data of members of the Colleges. OIS acts at all times to treat such data confidentially (see our statement at: Intercollegiate Matters: Privacy and Confidentiality Statement | Office of Intercollegiate Services (cam.ac.uk)) and does not normally produce survey outputs where individuals can be identified. Where this is exceptionally the case, the outputs of the surveys are restricted to those members of the Colleges and/or the University who have the need to know for overriding legitimate interests.
10. The commissioning of OIS to act as the College’s statutory Data Protection Officer:
OIS acts as the statutory data protection officer for all Colleges, as it is defined in current UK data protection legislation. Consequently, there are occasions where OIS advises Colleges on individual cases (e.g. subject access requests, reportable personal data incidents). In providing such advice, OIS may receive copies of information relating to the data subject of a College. OIS retains copies of information for no more than twelve months after the concluding provision of advice, except in the case of records of personal data breaches, where personal data is retained for no more than three years. After that time, only anonymised statistics relating to those records is retained.
11. To act as an advisor for Freedom of Information Act requests received by the Colleges:
OIS provides advice and guidance on information requests under the Freedom of Information Act. In doing so, it retains a record of requests referencing these internally the surname of the requester. These records are retained for ten years, but it is noted that the retention of surname alone is not considered by OIS to make an individual identifiable. The retention period is used to enable common request themes to be identified, and to locate and re-issue relevant guidance for similar or related requests.
12. Support for a range of intercollegiate and College-specific IT packages:
OIS provides a limited number of software packages for the Cambridge Colleges and acts as a data processor for the storage and retention of personal data. Further information about CASC products is available at: https://www.ois.cam.ac.uk/casc/services
Information about personal data management for CASC systems should be directed to the College (data controller) that holds and processes the personal data within CASC systems. Further support can be obtained by contacting the CASC helpdesk at: casc@ois.cam.ac.uk
If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us on 01223 768745 or admin@ois.cam.ac.uk.