Privacy Notice: Staff

How we use your personal information

This privacy notice explains how Magdalene College (“the College”, “we” and “our”) handles and uses information we collect about our staff (“you” and “your”). For these purposes, “staff” is intended to include employees, workers and casual workers (e.g. undergraduate supervisors, ad-hoc or temporary maintenance, kitchen or catering staff etc.) In broad terms, we use your information to manage your employment with the College, including your role and the performance of it, how we support you as an employer, and how you are paid, as well as other statutory requirements.

Your personal information is processed in accordance with current UK data protection legislation. When changes are made to this notice, we will publish the updated version on our website and notify you by other communications channels as we deem appropriate or necessary.

The controller for your personal information is Magdalene College, Cambridge CB3 0AG. The person within the College otherwise responsible for data protection at the time of issue, and the person who is responsible for monitoring compliance with relevant legislation in relation to the protection of personal information, is the Assistant Bursar assistant.bursar@magd.cam.ac.uk. This is the same address to contact if you want to exercise any of your data protection rights, including requesting copies of personal data the College holds about you.

The Data Protection Officer for the College is Intercollegiate Services Ltd (ISL), 64 Bridge Street Cambridge CB2 1UR; email: college.dpo@isl.colleges.cam.ac.uk. ISL should be contacted if you have any concerns about how the College is managing your personal information, or if you require advice on how to exercise your rights as outlined in this notice.

Unless otherwise stated, the legal basis for processing your personal information is that it is necessary for the performance of the employment contract we hold with you, or for statutory purposes (e.g. processing your monthly salary, tax and pension contributions).

How your informationm is used by the College

Your data is used by us for a number of purposes, including:

A. supporting your employment and your performance in your role:

Personal information includes: 

i)* personal details, including name, contact details (phone, email, postal, both work and personal) and photograph;

ii) your current and any previous role descriptions;

iii) your current and any previous contracts of employment and related correspondence;

iv) any occupational health assessments and medical information you have provided, and related work requirements;

v)* your training and development qualifications, requests and requirements.

B. ensuring that you have the right to work for the College:

Personal information includes: 

i)* your recruitment information (including your original application form and associated information submitted at that time);

ii) other information relating to your recruitment (including your offer of employment and related correspondence, references we took up on your appointment, and any pre-employment assessment of you);

iii)* evidence of your right to work in the UK (e.g. copies of your passport).

C. paying and rewarding you for your work:

Personal information includes: 

i)* your bank details;

ii)* details of your preferred pension scheme;

iii) your current and previous salary and other earnings (e.g. maternity pay, overtime), and the amounts you have paid in statutory taxes;

iv) correspondence between you and the College, and between members and staff of the College, relating to your pay, pension, benefits and other remuneration.

In addition, we maintain records of your use or take-up of any benefit schemes provided by us (e.g. healthcare, childcare vouchers), which we collate and monitor to review the effectiveness of these staff benefits.  The legal basis for this processing is that it is in our legitimate interest to ensure that any staff benefit schemes represent good value for money to both you and us, and to ensure that you do not overuse your entitlements.

D. administering HR-related processes, including records of absences and regular appraisals of your performance and, where necessary, investigations or reviews into your conduct or performance:

Personal information includes: 

i)* records of your induction programme and its completion;

ii)* records of your performance appraisals with your line manager;

iii) records, where they exist, of any investigation or review into your conduct or performance;

iv) records of absences from work (including but not limited to annual leave entitlement, sickness leave, parental leave and compassionate leave)

v) correspondence between you and the College, and between members and staff of the College, regarding any matters relating to your employment and any related issues (including but not limited to changes to duties, responsibilities and benefits, your retirement, resignation or exit from the College and personal and professional references provided by the College to you or a third party at your request).

E. maintaining an emergency contact point for you:

Personal information includes details of your preferred emergency contact, including their name, relationship to you and their contact details.*

F. monitoring equality and diversity within the College:

Personal information includes information relating to your age, nationality, gender.*

G. publication of your personal information:

We would normally publish (on our website and elsewhere) your name, photograph (if one is available), your College email and contact phone number and basic biographical information relating to your College posts. We would not normally otherwise make your personal information publicly available without your consent except in circumstances described elsewhere in this notice.

H. disclosing personal information about you to external organisations, as permitted or required by law.

If you have concerns or queries about any of these purposes, or how we communicate with you, please contact us at the address given below.

Information marked with an * relates to information provided by you, or created in discussion and agreement with you. Other information is generated by the College or, where self-evident, provided by a third party.

We would not monitor social media sites for any personal information relating to you, unless we believed there was a legitimate interest for us to do so (e.g. monitoring compliance with an agreed plan, such as a homeworking agreement) and only if we inform you we might do this in advance. Consequently, we do not routinely screen your social media profiles but, if aspects of these are brought to our attention and give rise to concerns about your conduct, we may need to consider them. Our social media guidelines are available via our website at: Policies and Procedures | Magdalene College.

We also operate CCTV, which will capture footage. Our CCTV Code of Practice can be viewed at https://www.magd.cam.ac.uk/cctv-code-of-practice.

For certain posts, we may use the Disclosure and Barring Services (DBS) and Disclosure Scotland to help assess your suitability for certain positions of trust. If this is the case, we will make this clear to you in separate correspondence. Certificate and status check information is only used for this specific purpose, and we comply fully with the DBS code of Practice regarding the correct use, handling, storage, retention and destruction of certificates and certificate information. We recognise that it is a criminal offence to pass this information on to anyone who is not entitled to receive it.

This notice is reviewed regularly to reflect any changes to the College’s processing activities, including further processing of personal data beyond the original purposes.

Who we share your information with

With the University

The College uses the University Card Services system and all relevant members of staff will be registered with this scheme. Basic personal information relating to your employment is shared with the University in order to operate the scheme effectively.

The University is a separate legal entity to the College and has its own statement about your personal information and its procedures, which you can view at: How we use your personal information (for staff and job applicants) | Information Compliance. We share your personal information where necessary and appropriate across the collegiate University. The University and its partners (including all of the Colleges) have a data sharing protocol to govern the sharing of information of staff of the College. The parties may share any of above categories of personal information, and the agreement can be viewed in full at Data sharing agreement (controller to controller). Any transmission of information between partners is managed through agreed processes that comply with UK data protection legislation.

Please also note the University’s people search function may also be widened to be accessible to the general public by changing the settings at http://www.lookup.cam.ac.uk/self: its default setting is otherwise access to all members of the University and all Colleges: we share this because we believe it helps significantly in building community relations and networks and helps others get in touch with you easily.

With other organisations

We share relevant personal information with our sub-contracting agents (health and safety) and with relevant government agencies (e.g. HMRC) and your pension provider and any other benefit providers. Information is not shared with other third parties without your written consent, other than your name, role and employment contact details which are made publically available. Generally, personal information is not shared outside of the European Economic Area.

Photography and filming

The College uses photography and videography as part of its legitimate interests to document, promote, and communicate College life, events, and activities. This includes capturing images and videos during events and other College activities, as well as general College life in public spaces. These images and videos may be used for promotional purposes, including on the College website, social media channels, publications, and other marketing materials.

Under UK data protection legislation, the College relies on Legitimate Interests as the legal basis for this processing. This approach is proportionate, respects individual privacy rights, and aligns with the College's educational and communication goals. We take reasonable steps to ensure that individual privacy is protected, including providing clear signage when filming is taking place. Individuals who wish to opt out of having their image or video included in such documentation may contact communications@magd.cam.ac.uk.

How long we keep your information for

We hold all information for the duration of your employment and for no more than twelve months after the end of your employment. After that time, we retain a small subset of personal information for up to seven years after your relationship with the College ends:

i) *personal details, including name and your preferred personal contact details (if we still have these);

ii) your previous salaries and other earnings, pensions and the amounts you have paid in statutory taxes;

iii) *details of your preferred pension scheme;

iv) records of your performance appraisals with your line manager;

v) records, where they exist, of any investigation or review into your conduct or performance;

vi) your reasons for leaving and any related correspondence;

vii) any references we have written subsequent to your employment with us.

Those marked with an * relate to information provided by you, or created in discussion and agreement with you.

We reserve the right to retain the personal information longer than the periods stated above, where it becomes apparent that there is a need to do so – for example, in the event of a major health or personal injury incident, records may need to be kept for up to forty years.

We then store in a permanent archive:

i) your full name and title;

ii) your job title(s) or College affiliation(s) and the corresponding dates of employment/membership;

iii) details of your preferred pension scheme. 

The College publishes a data retention schedule, which you can access at: Policies and Procedures | Magdalene College

Your rights

You have the right: to ask us for access to, rectification or erasure of your information; to restrict processing (pending correction or deletion); and to ask for the transfer of your information electronically to a third party (data portability). Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

Failure to provide the information reasonably requested of you may result in disciplinary action taken by the College, which could ultimately lead to your dismissal from employment.

If you wish to complain about the College’s handling of data protection issues you should do so in writing to the person responsible for College Data Protection, the Assistant Bursar assistant.bursar@magd.cam.ac.uk. You retain the right at all times to lodge a complaint about our management of your personal information with the Information Commissioner’s Office at Make a complaint about how an organisation has used your personal information | ICO.