About our service
This Privacy Notice outlines how Canterbury Christ Church University (the Data Controller) collects, uses, and protects personal data in relation to managing Alumni affiliation with the University.
It applies to any individual who was previously a student at or has graduated from the University.We are committed to handling your personal data responsibly and transparently, in accordance with the Data Protection Act 2018 and UK General Data Protection Regulations (GDPR) and any other relevant legislation. This notice is intended to ensure you are fully informed about how your personal information is used and the rights you have in relation to it.
You can access our Data Protection Policy here.
1. Information we collect about you
When you engage with the University in relation to alumni activities, we collect and retain relevant personal data. This information is used for the purposes set out in Section 3 of this Privacy Notice.
We may process the following categories of personal data about you:
- Your contact details (address, email and telephone).
- Your title and full names. We also record any previous marital names and date of birth as we need these to help identify you definitively.
- The qualification you obtained.
- Basic details about your employment history (job title and employers)
- Mailing preferences
- Records of voluntary support provided to the University
- Tracking and monitoring of engagement with correspondence we send you
- Photographs sent to us of group cohorts to use in publicity materials and/or on the web. The University captures and stores photographs of alumni at events it organises. To find out more about this, see our separate Photography, Videography & Digital Marketing Content Privacy Notice.
If you would like to advise us of a change to your contact details or withdraw your consent to receive direct marketing communications you can contact us at alumni@canterbury.ac.uk.
Your contact details will be updated on the Salesforce database as quickly as possible and no later than 1 month after receipt.
If you withdraw your consent for us to use your data for marketing purposes, we will stop sending you communications as soon as we have processed your request.
2. How do we collect your information?
The University may collect your personal data through a range of methods and sources, depending on your relationship with us and the nature of our interaction. We may collect your personal information:
- Directly from you – when you fill in forms, submit applications, contact us, use our services or attend University events.
- From third parties – from third party emailing systems to help us understand which communications are relevant to you. This includes tracking whether you have opened the emails we have sent to you and which links you clicked on. When third parties nominate you for the Alumni Award.
- Publicly available sources – to conduct due diligence on donors in line with Our Gift Acceptance Policy, the Financial Procedure for the Acceptance of Donations including Due Diligence and Anti Money Laundering Procedure.
3. How do we use your personal data?
The University may process your personal data for the following purposes:
- To respond to requests and instructions, made by you or with your agreement with regards to confirming that you studied with the University, providing you with references for work or further study, providing you with duplicate transcripts.
- To comply with our statutory obligation to supply data to the Higher Education Statistic Agency (HESA). HESA conduct a nationwide survey on behalf of the Government to find out the employment destinations of all University leavers. Read about the way in which HESA processes your data in its collection notice.
- To send you alumni magazines and newsletters, personalised invitations to specific events and information about events, new courses, job vacancies, volunteering and fundraising opportunities and discounts on postgraduate study and other services exclusive to former students of CCCU.
- Internal profiling and analysis for fundraising
- To conduct due diligence checks
- To prevent and detect fraud, bribery, corruption, or other unlawful activities in accordance with the University's internal policies and legal obligations;
- To comply with statutory and regulatory requirements, including those under the Data Protection Act 2018 and UK GDPR and Privacy and Electronic Communications Regulations 2003.
4. The lawful basis we use to process your data
Data protection law sets out reasons for collecting and processing your personal data. In this section, we outline the legal bases the University uses.
We will be processing your data under:
- Article 6(1)(e) Public Task "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller"
- Article 6(1) (f) Legitimate Interests "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child"
It is in the University’s legitimate interest to maintain contact with its former students. Your contact details may be used by the University for direct marketing purposes. We may send you correspondence by post or electronic means.
If you would like to find out more about this, see our Direct Marketing Privacy Notice.
We may need to process your data in order to ensure we are complying with our statutory obligations and legal requirements.
- Article 6(1)(c) Legal obligation "processing is necessary for compliance with a legal obligation to which the controller is subject"
If you are qualifying from a degree level programme, the University has a statutory obligation to retain your data for 15 months after you qualify in order to supply this information to Higher Education Statistics Agency (HESA). Read about the way in which HESA processes your data in its collection notice.
It is also necessary for the University to keep your data in order to respond to requests and instructions, made by you or with your agreement, with regards to confirming that you studied at the University, providing you with references for work or further study and providing you with duplicate transcripts.
We will also need to process your personal data under this legal basis to comply with anti-fraud, anti-money laundering and anti-bribery legislation, including the detection and reporting of suspected fraud or corrupt activity; or for responding to lawful requests from regulatory bodies or law enforcement agencies such as the Office for Students (OfS) or the Police.
5. Who do we share your personal data with
We may share your personal data with trusted third-party service providers who act as data processors on our behalf. These partners are Prospecting for Gold, who gather publicly available information about you on our behalf for the purposes of conducting profiling and analysis. This helps us understand more about you so we can focus our conversations about fundraising and volunteering and ensure that we provide you with the most appropriate experience as a donor or potential donor.
Other third parties include Salesforce and Handshake who support with the delivery and operation of alumni operations, such as enabling the University to engage with alumni. All third parties are required to handle your data securely and in accordance with data protection legislation.
We may also disclose your personal data where necessary to meet our legal or statutory obligations under the Data Protection Act 2018 and UK GDPR and the Privacy and Electronic Communications Regulations 2003. This may include sharing information with government departments, regulatory bodies, funding agencies, or law enforcement authorities where disclosure is legally required.
Whoever we share your information with, we will only share what is relevant and necessary to perform the specific task or to meet our legal obligations.
6. How long do we keep your personal data
We retain personal data only for as long as is necessary to fulfil the purposes set out in this Privacy Notice, including to satisfy legal, regulatory, and contractual obligations. This includes our obligations under the Data Protection Act 2018 and UK GDPR and the Privacy and Electronic Communications Regulations 2003.
In relation to maintaining alumni relations, we retain personal data indefinitely in the interest of analysing engagement and for the purpose of fundraising. When identifiable records are no longer required for the purposes set out in this Privacy Notice, they are either anonymised or securely disposed of according to our Confidential Waste Policy.
7. How do we protect and store your personal information
We are committed to safeguarding the personal data we process and have robust internal policies and controls to prevent unauthorised access, accidental loss, destruction, misuse, or disclosure of personal data. Access to personal information is strictly limited to authorised University personnel who require it for the performance of their duties in connection with alumni activities.
Where personal data is shared with third-party processors, such parties are contractually required to act solely on our instructions, implement appropriate technical and organisational safeguards, and comply fully with the requirements of the Data Protection Act 2018 and UK GDPR.
8. The Data Controller and further information
Canterbury Christ Church University is the Data Controller for this personal data.
Please click the link below to access further information regarding:
Version control
| Title: | Alumni Privacy Notice |
| Applicable to: | Alumni, Students |
| Process Owner: | Alumni Relations Manager |
| Department responsible: | Graduate Futures |
| Approved By: | Marketing |
| Date approved: | 28th July 2026 |
| Date of review: | 28th July 2028 |
| Date last amended: | 28th July 2026 |