Privacy Policy

1. Who we are

The data controller is the Cambridge University German Society, a student society at the University of Cambridge, The Old Schools, Trinity Lane, Cambridge CB2 1TN, United Kingdom. The Society is run by an elected committee of students. For anything relating to your data, email [email protected].

2. What we collect

• Membership: name, email address, CRSid, college, course, graduation year, membership type and date, and your choices about the newsletter, the alumni newsletter and being contacted about recruitment opportunities.
• Tickets and shop orders: name, email address, the tickets or items you bought, the answers you give to questions at checkout, promo or ballot codes used, and check-in status at the event.
• Payments: handled by Stripe. We see the amount, date and status of a payment and the last digits and type of the card, but never your full card details.
• Newsletter: email address, name if given, which lists you subscribed to, and whether you confirmed your subscription.
• Contact form and emails: your name, email address and whatever you write to us.
• Photos and videos taken at our events (see section 4).
• Technical data: our servers keep short-lived logs (IP address, browser, pages requested) for security and to fix problems. Our website does not use analytics or advertising trackers.

3. Why we use it and on what legal basis

• To run your membership and sell you tickets and products: to process orders and payments, send tickets and confirmations, check you in and apply member prices. Legal basis: contract.
• To keep financial records of payments and refunds. Legal basis: legal obligation and legitimate interests.
• To send newsletters, only if you subscribed. Legal basis: consent, which you can withdraw at any time using the unsubscribe link in every newsletter.
• To pass on recruitment opportunities from our sponsors, only if you opted in. Legal basis: consent. We do not sell your data and do not give sponsors your contact details unless you have agreed to this.
• To answer your messages and run the Society, for example to tell you about changes to an event you booked.
• To keep our systems secure.

4. Photos and videos

We take photos and videos at many events and may use them on our website, social media and in promotional material. If you would rather not appear, tell the photographer or a committee member at the event, or email us afterwards and we will remove published images of you where we reasonably can.

5. Who processes data for us

We use the following service providers. They process data only on our instructions:

• Hetzner Online (Germany): hosting of our servers, which run our website, ticket shop, membership database, newsletter system and email.
• Cloudflare (USA/global): network security and delivery of our websites.
• Stripe (Ireland/USA): payment processing.
• Mailjet (France) and Amazon Web Services (UK region): sending emails and newsletters.
• Google (USA): address search when we enter event venues. No data about ticket buyers is sent to Google.
• Microsoft and Google: office tools used by committee members, for example for spreadsheets and documents.

Where data is transferred outside the UK, it goes either to a country the UK considers adequate (such as EU countries) or under appropriate safeguards such as the UK International Data Transfer Addendum or the UK–US Data Bridge.

Committee members can access the data they need for their role. Committee members change every year; access is removed when someone leaves the committee.

6. Security

Our systems are only accessible over encrypted connections, access is limited to committee members who need it, and backups are encrypted.

7. How long we keep it

• Membership records: membership is for life, so we keep your membership record until you ask us to delete it.
• Orders and payment records: up to six years, for our accounts.
• Event attendee lists and check-in data: up to two years after the event, then deleted or anonymised.
• Newsletter subscriptions: until you unsubscribe.
• Contact form messages and emails: up to two years, unless needed for longer for Society business.
• Backups: up to six months, after which they are overwritten.

8. Your rights

Under UK data protection law you have the right to access the data we hold about you, have it corrected, have it deleted, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. To use any of these rights, email [email protected]. We will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ico.org.uk).

9. Cookies

Our website and ticket shop only use cookies that are needed for them to work, for example to keep your shopping cart, keep you logged in and protect against fraud during payment (Stripe). We do not use analytics or advertising cookies.

10. Changes

We may update this policy, for example when we change service providers. The date at the top shows the latest version.