Privacy Notice - Alumni and Supporters

This privacy notice provides a general description of the processing activity done by Durham University’s Development and Alumni Relations Office (DARO) and applies to alumni, friends and supporters of Durham University in addition to the University’s General Privacy Notice.

Data Controller

The Data Controller is Durham University. If you would like more information about how the University uses your personal data, please see the University’s Information Governance pages or email info.access@durham.ac.uk.

Data Protection Officer

The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it. If you have any concerns regarding the way in which the University is processing your personal data, please contact the Data Protection Officer:

Andrew Ladd, info.access@durham.ac.uk

Retention

The University keeps personal data for as long as it is needed for the purpose for which it was originally collected. Most of these time periods are set out in the University Records Retention Schedule.

How we collect your data

Most of the personal information we process is provided to us directly by you. Often this will be actively provided by you, e.g. when you submit contact details updates, register for events and volunteering opportunities, make donations, etc.

If you are a student/graduate of Durham University, some of your personal data, collected by the University during your time of application and/or study, is transferred from your student record to the University’s alumni and supporter database.

The University may hold personal data relating to your professional history. This data may have been provided by you, or it may have been obtained publicly available sources.

The University may hold personal data that has been created by Durham University from other personal data that we already hold through internal or external research/profiling.

When we obtain personal data about you from third party sources, we will look to ensure that the third party can lawfully provide us with your personal data.

Data handling

We are process data using trusted cloud-based services or platforms and work with affiliated parties to support and provide services to our alumni and supporters. In cases where data is shared/transferred, appropriate protections will be in place before the transfer of data (such as contractual arrangements designed to protect data and secure file transfer protocols). Data is never sold on to third parties.

If you are a member of the alumni community of, or have donated to, either of the independent colleges of St John’s and St Chad’s (which are charities in their own right) your personal data held by Durham University will be shared with those colleges under a Data Sharing Agreement which requires the colleges to provide assurances of protection of the data.

What we use your data for

You have the right to be provided with information about how and why we process your personal data. We will only process data where we have a lawful reason to do so. Our main reasons are as follows:

Accessing your personal data

You have the right to be told whether we are processing your personal data and, if so, to request a copy of it. This is known as the right of subject access. Find out more on the University’s Subject Access Requests webpage.

Right to rectification

If you believe that personal data we hold about you is inaccurate, please contact us and we will investigate. You can also request that we complete any incomplete data. Once we have determined what we are going to do, we will contact you to let you know.

Right to restriction of processing

You may ask us to restrict the processing of your personal data in the following circumstances:

• You believe that the data is inaccurate and you want us to restrict processing until we determine whether it is indeed inaccurate.
• The processing is unlawful and you want us to restrict processing rather than erase it.
• We no longer need the data for the purpose we originally collected it for, but you need it to establish, exercise or defend a legal claim.
• You have objected to the processing and you want us to restrict processing until we determine whether our legitimate interests in processing the data override your objection.

Once we have determined how we propose to restrict processing of the data, we will contact you to discuss and, where possible, agree this with you.

Right to erasure

You may ask us to erase your personal data in any of the following circumstances:

• We no longer need the personal data for the purpose it was originally collected.
• You withdraw your consent and there is no other legal basis for the processing.
• You object to the processing and there are no overriding legitimate grounds for the processing.
• The personal data was unlawfully processed.
• The personal data must be erased for compliance with a legal obligation.
• The personal data was collected in relation to the offer of information society services (information society services are online services such as banking or social media sites).

Once we have determined whether we will erase the personal data, we will respond to your request.

Further information

If you have any questions or wish to exercise any of your rights, please do not hesitate to contact us.

Last updated November 2025