Skip navigation

Student Privacy Notice

Student Privacy Notice: How we use your personal information at the Students' Unions' Advice Service (SUAS)

This page provides information about the use of your personal information by the Students' Unions' Advice Service which is provided by CUSU and the Graduate Union, whether this is as part of the service-user data we collect to process a case/enquiry, a single survey or statistical reports. For statements regarding the CUSU and the Graduate Union, please see their respective websites: and

1. What is 'personal data'?

'Personal data' means any information which relates to or identifies you as an individual. 'Sensitive personal data' means any information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

2. How does this information relate to other information about data protection?

The Students' Unions' Advice Service engages with you in a number of ways in the course of its legitimate activities as a service-provider. In the course of your interaction with the SUAS your data will be retained, and the SUAS will be able to demonstrate a legal basis for doing so and will, wherever required, inform you of its collection. This page outlines how SUAS processes data and aims to notify you of how your data is processed.

3. Who will process my personal information?

The information published here applies to the use, sharing and disclosure of your personal information by the Students' Unions' Advice Service (SUAS) which is hosted by Cambridge University Students' Union ('CUSU'). CUSU is a separate legal entity from both the University of Cambridge (, and each of the 31 Cambridge Colleges for these purposes. The University and your College will provide you with their own statement setting out how they will use, share and disclose your personal information while you are a student.

4. What personal data will be processed?

We use your personal information to ensure you are eligible to use the Service, to provide you with appropriate advice and support and to contact you.

We process your personal data when you complete a SUAS Registration form. The information we ask you to provide includes your name, surname, CRSid, telephone number, email address, college, faculty/department, course, status (undergrad or postgrad), year of study, enrolled (full-time, part-time, extended study), tuition fee status.

We also process your sensitive personal data when you complete a SUAS Monitoring form. You do not have to complete this form in order to access the SUAS but it may limit the extent to which we can support you. The information we ask you to provide if you wish to includes your date of birth, gender, ethnic origin, first language, whether or not you consider yourself to be disabled, whether or not you have caring responsibilities.

On your first contact with the SUAS, we create a confidential secure electronic file that will contain the personal information we process as part of the service, for example: a copy of the SUAS Registration form, a copy of the SUAS Monitoring form, any email correspondence we have had with you, notes of sessions or meetings we have attended with you, any other contact or correspondence you have with the Service, or contact with others on your behalf. Having a complete account of your involvement with us helps us to support you as a user of our Service.

We also record how you found out about the SUAS and whether or not you would like to be invited to take part in the anonymous SUAS feedback and Impact surveys. We may also supplement personal information from you with information made available by the University and Colleges.

The information is held on a confidential case management system (Student Case Manager). All access to the confidential case management system is password protected and limited explicitly to the individuals who work within CUSU to support the legitimate activities of the SUAS for the purpose of carrying out their role in providing advice and support to you.

We also use data to compile anonymous statistics about the use of the SUAS, for research purposes, equalities monitoring and to identify trends and patterns that may contribute to the Unions' mission to improve the student experience at the University of Cambridge. This data is held securely on the CUSU file server in a confidential folder with access limited to SUAS staff members. All access to the CUSU File Server is password protected.

Our use of your personal information will not be excessive or unwarranted.

5. What is the purpose and legal basis of the processing?

The SUAS has a legitimate interest (Article 6 GDPR) in processing service-user data, including personal data and sensitive personal data.

Sensitive personal data is recorded on the SUAS Monitoring form. Completing this form is not a requirement for accessing the SUAS, and this is clearly indicated on the form.

This data may also be used for equalities monitoring and student welfare, and as this processing is in the course of the official duties of the SUAS, the law does not require your consent for us to use your data in this way. However, your data will not be processed in such a way as to make you as an individual identifiable to any external or unauthorised parties, except where your explicit consent is given.

We consider the processing of your personal information for these purposes to be either necessary for the performance of our contractual obligations with you (e.g. to provide you with advice and support), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. representation of student interests to the University).

We will not use your personal information to carry out any wholly automated decision-making that affects you[1].

We will ensure that:

  • data is kept safe and secure;
  • data is handled legally, responsibly, and ethically;
  • we are open and transparent about what data we are using and why; and
  • all legal requirements are met regarding data privacy.

6. Who will my personal information be shared with?

We do not share your data with individuals beyond the SUAS unless (i) you ask us to do so or (ii) there is a serious and imminent risk to your own or to other's safety, or when we are legally obliged to do so, or (iii) with your separate and clear consent.

In the course of its legitimate activities, the SUAS may share your information with service-providers contracted to support its operations. For example, the SUAS engages the services of a confidential case management system (Student case Manager). In addition, the SUAS may engage the services of an email client to process its email; may utilise online storage services; or may engage in services that help to securely manage sensitive datasets such as survey data. In the course of engaging with any third party services your data will only ever be shared for legitimate administrative purposes and for the SUAS' own legitimate activities; your data will never be sold to third parties and strict contractual provisions will be in place, along with internal management controls, to ensure contracted services facilitate the SUAS' legitimate use of your data only.

On occasion, the above types of sharing may involve the transfer of your personal information outside the European Economic Area. For example, we may engage a secure email client or research platform to undertake our service and as such we may need to share your information. Any engagement with third parties is carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information and shall follow ordinary data security and practices by the SUAS as set out in this document.

Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).

7. How long is my information kept?

We retain this information for six academic years beyond the end of the academic year of your last involvement with the Service. After this time, the data will be securely destroyed. Anonymised forms of your data will be kept beyond this for statistical purposes.

8. How can I access my personal information?

You have the right to access the personal information that is held about you by the SUAS. You can ask the staff member you are working with about this, contact the SUAS by email ( or complete the Cambridge University Students' Unions' Data Subject Access Request Form:

You also have the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, object to processing or to receive an electronic copy of the personal information you provided to us. The SUAS may need to retain information due to us having a legal obligation to do so or because to not hold the information may impact on our ability to help you in the future or to document the work we have done to support you if there is any dispute about this. To ask about this, please contact

10. Who can I contact?

If you have any questions about how your personal information is used, or wish to exercise any of your rights, you can discuss this with the staff member you have been working with or contact the Data Protection Representative for the Students' Unions' Advice Service - Lisa Dery at

11. How do I complain?

If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (

[1] Automated decision making is the ability to make decisions without human involvement. In practice, profiling can often be a precursor to automated decision making. 'Profiling' is a form of 'automated processing' of personal data used to analyse or predict matters relating to an individual.