Skip to content Accessibility statement
Home>Alumni>Privacy Policy

Privacy Policy

The Office of Philanthropic Partnerships and Alumni (OPPA) is here to support you, keep you in touch with the University and provide you with services, benefits and opportunities – whether you are an alumnus/a, a supporter, a volunteer, a scholarship holder, a researcher, or any other student or staff member.

It’s important you know as much as possible about your data and how it is used. So this privacy policy is designed to:

  • explain what we do with your data and why we do it
  • help you take control of your data and make informed decisions about how we use it
  • show how your data is safeguarded: – e.g. we never sell your data.

Quick Summary

You should read this policy in full, but here are the key points we hope you will remember:

  • We’re open about what data we keep about you. Your record may contain contact details, education and business details, and a record of your interactions with us. Most of this was provided to us by you, with some additions from third parties or public sources. You can update your details here: Update your details. You can also request a full copy of your personal data.
  • We use your records to provide you with services and keep you in touch with the University. We also use them to offer opportunities, such as events, networking, giving and volunteering opportunities.
  • We want to talk to you about things you’re interested in. We use your records to personalise our communications with you and the services we offer.
  • You’re in control. You can decide how we communicate with you, and whether we personalise our communications, here: Communication Preferences.
  • We never sell your data.
  • We never share your data for marketing or fundraising by third parties. The limited data sharing we do is fair, transparent, safe, and prioritises your interests and our legal duties.
  • We want you to understand what we do, and why we do it. This privacy policy goes into more detail about how we keep and use data and the purposes we use it for. You can also contact with any questions.


This privacy notice is for supporters, volunteers, alumni and other contacts of the Office of Philanthropic Partnerships and Alumni (OPPA) at the University of York, including Hull-York Medical School (HYMS) alumni. It sets out the ways in which the University gathers, uses, stores and shares data held by OPPA (‘alumni records’). It also sets out how long we keep your data and what rights you have in relation to your data under the General Data Protection Regulation (GDPR).

The University has additional records and privacy notices for student and staff data. For more information, please read the Student Privacy Notice and Staff Privacy Notice.

Alumni records includes any personal data kept by OPPA about alumni, donors, volunteers, staff, students and other contacts. Alumni records for HYMS are also included.

‘Alumni records’ is how we describe all personal data kept by OPPA for the University of York and Hull-York Medical School. Alumni records are kept by OPPA for the following groups of people: 

  • Alumni and current or former students of undergraduate, postgraduate and accredited programmes delivered or part-delivered by the University of York.
  • Donors and volunteers for the University of York and the University of York in America.
  • Current and retired staff of the University of York.
  • University of York event registrants and attendees.
  • Students, alumni and staff of Hull-York Medical School.
  • Others in contact with OPPA, including prospective donors and volunteers.

Where do we get your alumni records from?

Most of your alumni records were provided to us by you, either directly or when you gave the University information as an applicant or student/staff member. Some additional information may come from third parties or from public sources such as LinkedIn.

  • From you: Your alumni records contain the information you provide when you interact with us, e.g. through surveys, sign-up forms, and other contact with us before, during and after graduation.
  • From the University or HYMS: Some parts of your alumni records are taken from student and staff records, e.g. your name, contact details and details of your award. Much of this data originally comes from your undergraduate or postgraduate application form. Additional information may also have been provided by you as part of your interactions with the University/HYMS, e.g. when enrolling for your course or applying for scholarships.
  • From third parties: Some parts of your alumni records may be drawn from data given to us by a third party, e.g. your sponsor, agent, referee or previous employer, college or university, family member or classmate.
  • From publicly available sources: Some relevant information may be added to your alumni records from information you have chosen to publish in the public domain, e.g. your LinkedIn profile.

What kinds of data are included in your alumni records, and for how long?

Your alumni records contain your contact details and preferences, education and business details, and a record of your interactions with us. We may also have some payment details or information about your interests, if you have given these to us. We delete or archive your data once it is no longer needed.

Your alumni record contains personal data about you including the following:

  • Basic details e.g. name, title, gender, date of birth and student number. We need these to identify you when we are communicating and so we know how to address you.
  • Addresses and contact details e.g. phone, email and LinkedIn profile. We need these to contact you in accord with your Communication Preferences.
  • Consent, privacy and communications preferences including Telephone Preference Service (TPS) registrations. We need these to make sure we only contact you in ways that are acceptable to you.
  • Course and educational attainment details, e.g. what qualification you received and some of the extracurricular opportunities you participated in. We need this to identify you when we are communicating, to confirm your achievement when asked (e.g. by employers seeking a reference), and to personalise our communications to you.
  • Professional details, e.g. the profession you work in and your employer. We need this for statistical and research purposes and to personalise our communications to you.
  • Information about your interests you provide to us. We need this to personalise our communications to you.
  • Payment and financial data you provide to us. We need this to process payments, e.g. a donation or an event booking, to claim Gift Aid, and to carry out other processes related to finance and taxation.
  • A record of your engagement with us e.g. enquiries, event participation, volunteering, donations, and any other interactions you have with us. We need these to respond to your enquiries, process your payments, provide you with services and handle complaints or problems.

Special category data – which is especially sensitive data such as health records, ethnicity and religious views – is not kept as part of your alumni records.

We keep your data in line with legal requirements or where there is a business need. Retention timeframes are determined in line with the University’s Records Retention Schedule.

Our services are not directed at children, and we do not have alumni records for you if you are under the age of 16.

How do we use your alumni records?

Your alumni records are primarily used to keep you up to date with the University and alumni community and offer you services and opportunities, including to volunteer or give to the University. We also keep data to target our services and for auditing, reporting and monitoring. If you visit campus or a University event, your image may be captured in a photo or video.

We keep and use your alumni records, including your contact details, for the following purposes:

  1. to distribute publications, newsletters and other communications from the University, Departments, Colleges and clubs and societies;
  2. to promote University events, benefits and services;
  3. to provide information about alumni groups and professional opportunities; to operate surveys, censuses and research projects for the benefit of the University and alumni community;
  4. to promote and manage University volunteering opportunities;
  5. to carry out University fundraising operations, except where you have asked not to be included;
  6. to provide you with and manage your use of University facilities and services and your participation at events;
  7. to administer the financial aspects of our relationship with you and any funders including processing any payments made by you to the University;
  8. to manage academic progress (including the provision of references and the processing of student complaints and appeals, academic misconduct investigations and student disciplinary cases);
  9. to operate the University’s quality assurance processes and arrangements;
  10. for legal, personnel, administrative and management purposes;
  11. to enable effective communication with you including without limitation, providing you with information relating to University services and products, funding and/or sponsorship opportunities as well as links to relevant surveys and information on York student organisations;
  12. to identify ways to enhance learning, teaching, assessment and the broader student experience;
  13. to monitor equal opportunities;
  14. to compile statistical and personal returns which the University may be required to publish or pass to government bodies or the Higher Education Statistics Agency (HESA).

You can control which communications and information you receive from us here: Communication Preferences.

In addition, please note:

  • Photography: While on campus or at events you may be captured in photographs or video footage as part of a wider group shot. These images/recordings may be used by the University for promotional purposes e.g. in the development of the University’s alumni magazine. If you have any concerns about the use of your image, please contact the Data Protection Officer for more information at 
  • Profiling: We analyse alumni records to target and personalise our communications with you and to promote our services to those who are most likely to be interested. You can opt out of this here: Communication Preferences.

What is our legal basis for keeping and using your data?

We keep and use your alumni records because that is necessary for our legitimate interests. Some specific uses of your data have a different legal basis, such as contractual requirements, legal obligations or because you have consented.

The University needs to collect and retain alumni records in order to fulfil its functions as an education provider and to maintain its lifelong relationship with its alumni community. Our legal basis for doing so is the legitimate interests of the University community and wider societal good, except in these cases:

  • on the grounds of contractual requirement or to take steps to enter into a contract with you e.g. to allow you to access a University event;
  • because it is necessary for the performance of a task carried out in the public interest (for information on our public task see our function as set out in our charter);
  • because it is necessary for a third party’s legitimate interests;
  • to allow us to comply with our legal obligations;
  • to protect your or another person’s vital interests;
  • to monitor equality and diversity;
  • because you have given us your consent.

How are alumni records stored, transferred and kept secure?

Our alumni community is international, so we operate globally to support the community and offer our services. This means that your records may be stored or transferred outside the UK. All storage and transfers are secure.


Alumni records may be stored outside of the UK and EU, with appropriate safeguards and security provisions such as the EU–US Privacy Shield. At the time of writing, most alumni records are stored in the United States.

We take information security extremely seriously. We have both technical and organisational measures in place to protect your alumni records. Access to your records are restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information see IT Security.


Your alumni records may also be transferred to other countries in certain circumstances, e.g. to allow staff and volunteers to access records when working internationally.

Any storage or transfer of your alumni records will comply with our obligations under data protection law, and we will ensure an adequate level of protection for all transferred data.

How can you manage your alumni records?

Your contact details and communication preferences can be edited in My Account. Contact to make any other changes to your alumni records or exercise your rights under data protection law.

Under the General Data Protection Regulation, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw any consent you have given.

Basic details

You can view and update your basic details, including contact details, on the here

Preferences and Consent

You can update your communications preferences and what you have consented to here: Communication Preferences

Updating alumni records:

You can check and correct any part of your alumni records by contacting us at

Right of access:

You can receive a copy of your full alumni records by submitting a Subject Access Request. To do this, email your request to

Right to object:

In instances where we keep or use your data without explicitly asking for consent, you have the right to object. To do this, email your objection to Please give as much information as possible – the right to object is not absolute, so by stating your reasons for objecting you can help us to handle your objection appropriately.

Right to object to marketing:

You have the absolute right to object to our use of your data for direct marketing. If you do this, you will not receive any kind of newsletters, event invitations, appeals, career opportunities or other marketing contacts from us. To object to all direct marketing, email your objection to Alternatively, you can use the Communication Preferences page to opt out of specific types of communication from us while still keeping the communications you are interested in.

In addition to the above options for your alumni records, you can verify or correct information in your student record at any time by following the guidance here: Your Student Record. For all other requests, see GDPR Individual Rights.

How are your alumni records shared?

Parts of your alumni records may be shared with selected organisations the University works with and with current and potential employers. We do not sell your alumni records or share them with other fundraising organisations.

Your alumni records may be shared with:

  • organisations that process data on behalf of the University to support it in fulfilling its obligations and responsibilities to and relationship with you (such as software and system providers);
  • other organisations involved in delivery of services to you, such as partners in events you attend;
  • employers and other organisations (such as professional and regulatory bodies) to confirm your qualifications and other activities on your course, with your permission;
  • government departments/agencies and other relevant authorities to fulfil our legal duties (see How do we respond to legal requests? below);
  • current or potential employers of our students or current or potential providers of education (to provide references and verify details of your qualifications). The University is a member of the Higher Education Degree Datacheck Service: a shared service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you, having sought your consent. These checks are most commonly made if you register with an employment agency or are offered a job.
  • The University may also disclose parts of your alumni records to other third parties not listed above on a case-by-case basis. Disclosures will be made in full accordance with data protection legislation and only where necessary. Consent will be sought from you where appropriate and you will be told about such disclosures where possible, unless exceptional circumstances apply.

    Parts of your student records may also be shared by the University after you have graduated. This is documented in the Student Privacy Policy.

How do we respond to legal requests?

We are also required by law to share your records in some circumstances with government and law enforcement agencies. If you are a Canadian national, additional sharing with the CRA applies.

In addition to our usual information-sharing arrangements (see above), we may be required by law to share your records with:

  • government departments/agencies to whom we have a statutory obligation to release information (including the Office for Students, Higher Education Statistics Agency, the UK Research Councils, the Education and Skills Funding Agency, the Quality Assurance Agency for Higher Education, the Home Office UK Visas and Immigration, HM Revenue and Customs and Council Tax and Electoral Registration Offices;
  • current or potential employers of our students or current or potential providers of education (to provide references and verify details of your qualifications). The University is a member of the Higher Education Degree Datacheck Service: a shared service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you, having sought your consent. These checks are most commonly made if you register with an employment agency or are offered a job;
  • law enforcement agencies such as the police or relevant authorities dealing with emergency situations (only as required or appropriate and in line with Data Protection legislation). 

If you are a Canadian National: For the purposes of maintaining our Prescribed University status with the Canadian Revenue Agency (CRA) to enable donors in Canada to give tax efficiently, your information will also be passed to the CRA. This information is required by the CRA as proof that the University of York educates Canadians. The data will remain with the Canadian Revenue Agency and is given solely for purposes of verification. To opt out of this process please contact the OPPA Information Manager at

How will you be notified of changes to this policy?

We may email you from time to time if we significantly change how we use alumni records.

We may revise this privacy policy from time to time. 

If we make a change to the policy that we believe to be significant, we will notify you by email (unless you have asked us not to or we do not have your email address) and announce the change on our website, You can update your email address and contact preferences here.

How to contact us with questions

We want you to understand and be happy with how we use your data. Please contact if you have any questions or concerns.

If you have any questions about this privacy notice or concerns about how your data is being processed, please contact the OPPA Information Manager at You can also contact the University’s Data Protection Officer at

If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see

For the purposes of this privacy notice, University of York is the Data Controller as defined in the General Data Protection Regulation. We are registered with the Information Commissioner’s Office and our entry can be found here: University of York Data Protection Register entry. Our registration number is: Z4855807.

Our contact details are:

Information Manager
Office of Philanthropic Partnerships and Alumni
University of York
YO10 5DD
United Kingdom
Phone: +44 (0)1904 324467

Data Protection Officer
Information Governance Office
University of York
YO10 5DD
United Kingdom