Data privacy notice for alumni and friends of Cardiff University

How we manage, use and store your data as an alumni or friend of Cardiff University.

As alumni or friends of Cardiff University, we will use your details to contact you by post, email, phone, text and/or social media, complying with any preferences you have expressed. You may also choose to tailor how we contact you, and/or may unsubscribe from any contact by Cardiff University. Please let us know of your preferences. We contact you to keep you informed of the developments and advances being made by Cardiff University, its students and staff, and its alumni.

We will also offer opportunities for you to engage with the University as an ambassador, friend and supporter. This may include fundraising, when we may ask you to support the University’s mission of creating and sharing knowledge, and educating, for the benefit of all.

Your data is held securely and in adherence to the Data Protection Act. Your data will not be disclosed to any external organisations except for those acting as agents for the University under strict confidentiality agreements. Data is never “sold” to other charities or companies.

The information Cardiff University retains is name, address and other contact details (if known), and information about your Cardiff University (or predecessor institution) degree course(s). We may also retain data about donations made, business details, social media addresses, telephone and email contacts, and/or other specific information that you have supplied to us via such methods as survey responses etc.

In order to maintain data integrity, we may also source and retain information which is available from trustworthy public sources. Fundraising to support the University is an important element of our charitable work, so we may undertake appraisals to consider individuals’ potential to make donations.

Aim of the privacy statement

Your relationship with Cardiff University, as a Cardiff graduate (“alum”), friend or supporter, is important to us. We want to ensure that it’s a relationship built on trust, with clear information about how we collect, store, manage and protect your personal data. This privacy statement explains how the Development and Alumni Relations department does just that; it also sets out the types of data we hold, and how we use data to communicate with, and provide services to, you. We aim to be clear when we collect your personal information, and we aim only to do things you would reasonably expect.

Who we are and what we do

Cardiff’s Development and Alumni Relations department manages our relationship with alumni and supporters, through updates about Cardiff University news and research; publications; events; the offer of volunteering opportunities; and managing and promoting benefits for graduates. We are a first point of contact for alumni to engage with the University, for instance helping you access your transcript when needed. The department also fundraises to support Cardiff University students, development and research –via donations, legacy and in memoriam gifts, and community fundraising, for example through the Cardiff Half Marathon and using JustGiving. The department also helps to manage and develop Cardiff University’s strategic partnerships with industry and other organisations. To enable us to do these activities we have databases which contain personal information about our alumni, friends and supporters.

How we obtain data

Student information is passed to the Development and Alumni Relations department when their studies come to an end, in accordance with the Student and applicant data protection notice. We may obtain student data before they complete their studies if they interact with the department, for example as a fundraiser, event attendee or recipient of a scholarship we steward. In the main, the data we hold is provided by you. In addition, if you interact with other departments, colleges or schools within the University we may also receive data from those areas. We may also receive information from recognised University groups or societies. The Cardiff University Students Union may also supply us information about your student society membership, courses or achievements that are recognised on your Higher Education Achievement Record (HEAR), or about student governance or positions you may have held.

If you interact with Cardiff University through a third party (for example, supporting us via a JustGiving page or engaging with us through our alumni networking platform) then we may obtain information about you from that third party. The receipt of data by the department in this manner is subject to the third party’s own privacy policy. We may also collect geographical information (city/country) about where an electronic interaction occurred (for example, reading an email). A list of parties with whom we partner in this way is available on request. Data obtained in this way are treated no differently to any other once held by the Development and Alumni Relations department, and are bound by the terms of this privacy statement as soon as they are received.

We may augment the data we hold from the University with data from our partners and publicly available data. We use targeted internet searches and may search websites in order to obtain and maintain the accuracy of the data: The following is an example of the sources we use:

Public sources for companies (in order to find personal data of those companies' employees, etc.):

• Companies House and other business-related resources (free and subscription) for UK companies
• US Securities and Exchange Commission for US companies
• Company websites

Public sources for charities (in order to find personal data of those charities' employees, trustees, etc., and to find information about donations and support):

• Charity Commission and other internet sources for UK non-profits
• GuideStar US for US non-profits

Public sources for individuals:

• Sunday Times Rich List
• The King’s Honours Lists
• LinkedIn, to check business details
• Royal Mail’s National Change of Address database (NCOA).

Before seeking or accepting major donations we are required to conduct due diligence, including reviewing publicly available personal data relating to the donor's criminal convictions and offences. Sources used include:

• Nexis UK
• DDIQ

Please also note that some of the personal information we process may include what is known as 'special category' or 'sensitive' data about you, for example, information regarding your ethnic origin or political, philosophical and religious beliefs. We will only process such information where it is relevant to our ongoing relationship with you and you have either provided this information to us directly or you have made it publicly available.

Our responsibilities and legal bases for processing your data

The legal basis for processing your personal data, for the activities outlined in this privacy statement, is that it is necessary for the pursuit of our legitimate interests. We uphold the responsibility to handle your data securely, keeping and using only what is necessary. There is no statutory or contractual requirement to provide us with any personal data.

We also have a responsibility to use your data in conjunction with public tasks, for instance where we have a legal obligation to provide some of your information to government. An example of this is the Destination of Leavers from Higher Education (DLHE) survey, now called the Graduate Outcomes Survey.

The data we hold

The information Cardiff University retains in its Development and Alumni Relations database is name, address and other contact details (if known), and information about your Cardiff University (or predecessor institution) degree course(s). We may also may retain data about donations made to the University, business details, social media addresses, telephone and email contacts, and/or other specific information that you have supplied to us via such methods as survey responses.

As a requirement of the Data Protection Act 2018 a full data audit of types information held is available on request.  An example of the data we hold includes:

• Personal Information
  • Name(s), sex, date of birth
  • Marital Status, Spouse details and other family relationships
  • Honorary awards
• Contact information
  • Address
  • emails
  • Telephone numbers
  • Social media links
• Academic Record
  • Subject Studied
  • Year of study
  • Award
• Record of our interactions with you
  • Notes from any meetings with you
  • Communications we have sent or if we have received communication from you
  • Event invitations and any event attendance
• Record of your interactions with us
  • Event attendance
  • Communications we have received from you
  • Opens and click-through from communications we have sent you
• Business Information
  • Occupation
  • Industry
  • Employment
  • Contact Information
  • Career highlights
• Giving Record
  • Date of Gift
  • Amount
  • Intended cause
  • Gift Aid Status (as required by HMRC)
  • Bank details used for processing Direct Debits are stored by a trusted third-party, under the Direct Debit Guarantee scheme.
• Connections you may have with other alumni and supporters of the University.
• Areas of Interest o Volunteering – for Cardiff University and other organisations o Philanthropic Giving to other organisations
• Financial information  o Assessment of your income and whether particular funding appeals may be of interest to you.
• Event Related Information
  • Dietary requirements
  • Access requirements

How we use your data

Your data may be used in the alumni and friend engagement and fundraising activities we undertake. We may send communication and marketing materials via mail, email, telephone or social media including:

• Cardiff University publications (e.g. Cardiff Connect, our Alumni and Friends magazine)
• E-Newsletters
• Notifications of Cardiff University breaking news
• Event invitations
• Promotion of volunteering, student recruitment and student careers opportunities
• Promotion of services for alumni
• Processing Gift Aid claims with the HM Revenue and Customs
• Assessing your information, when considering acceptance of major donations, as part of Cardiff University’s legal obligation to prevent bribery and fraud

The data we hold is accessible to University staff members whose job role requires them to complete tasks that necessitate the use of your data.

In order to ensure that the ways we contact you, and the things we contact you about, are suitable and tailored to you we may conduct data analysis. We may also use third-party partners to support these activities. Please see “How we obtain data” for an example of the sources of data.

Fundraising

We may also undertake appraisals to consider an individual’s potential to make donations to help us understand your capacity to make donations or otherwise support the University financially, so that we can focus our limited fundraising efforts on people and organisations with greater capacity for support. To do this, we may gather information from publicly available sources such as Companies House, the Electoral Register, the internet and media.

We also use publicly available information to undertake due diligence on donors and prospective donors, in line with University policy on funders, and to meet money laundering regulations. Please see “How we obtain data” for an example of the sources of data.

Updating your contact details

You can update your contact details at www.cardiff.ac.uk/alumni/contact-us/update-your-details at any time. We may also try to establish accurate contact information for alumni who are out of touch with the University, to help keep the University is in touch with as many of its alumni as possible.

If you provide us with contact details for a particular method of communication we will assume that you have given us your consent for us to update your record and communicate with you using this information, unless you have told us otherwise.  Contact details provided directly by you will update any previous preferences in relation to this channel unless you inform us otherwise.  If you are registered with the Telephone Preference Service (TPS) or Mail Preference Service (MPS) but provide us with contact information, we will assume that we have your consent to contact you using that information.

Protecting your data

Your data is held securely and in adherence to the Data Protection Act. We use industry and government recommended security measures, as well as the University’s Information Security Policies.

Unless we have a legal obligation to do so, your data will not be disclosed to any external organisations except for those acting as agents for the University. All external entities with whom data are being shared must sign a data confidentiality agreement. Data is never sold or given away to other charities or companies.

Where data is sent outside the EEA and not to a country having been determined by the EU as having an adequate level of protection or by official agreement such as "Privacy Shield" (EU-US) then data may be transferred by adopting the Commission's standard contractual clauses, or other binding safeguards authorised by the European Data Protection Supervisor.  Alternatively data may be transferred by derogations such as an individual giving consent for their data to be transferred.

Currently no data is sent to countries that have not been determined by the EU as having an adequate level of protection or "Privacy Shield" (EU-US) agreement.

Your preferences

We work to ensure that the data we hold about you is accurate, up to date, and not excessive.

We respect your preferences and are happy to answer any questions that you may have about your data, or about how your data is stewarded.

You are welcome to contact us at any time. You may wish to:

• Update, amend or rectify the data we hold about you;
• Tell us how you would like us to communicate with you in future;
• Tell us if you wish to opt out of some, or all, communication from Cardiff University’s Development and Alumni Relations team;
• Request a copy of the data we hold about you; and/or
• Object to or restrict the processing of your information for any of the purposes outlined above.

If you are a donor or fundraiser you also have rights as outlined in our Funders’ Rights policy

Future changes

From time to time, we may use your information for new purposes not currently described in this privacy statement. If our information practices change at some time in the future, we will always post the policy changes on this page.

Contact us

Cardiff University’s Development and Alumni Relations team are happy to answer any questions that you may have about how your data is stewarded.

You can also contact us in person at:

Development and Alumni Relations
Cardiff University
5th Floor McKenzie House
30-36 Newport Road
CF24 0DE