Introduction
This page explains how and why we collect, and use, your personal information when you visit the University of Cambridge’s ‘For Staff’ website (staff.admin.cam.ac.uk).
Who will process my personal information?
When you view or use www.staff.admin.cam.ac.uk, the University of Cambridge (‘we’, ‘us’ and ‘the University’) is the data controller.
The information published here applies to the use of your personal information (also known as ‘personal data’) by the University of Cambridge when you view or use this site.
If you follow a link from this website to another website, we recommend that you read the privacy policy on that website to find out what it does with your information.
What personal information is collected and why?
For site security and performance
When you visit our website, we use cookies and page-tagging techniques to collect the request made by your browser to the server hosting the website. This includes your IP address, the date and time of connection, the version of the web browser you are using, and the page you ask for. We use this information to ensure the security of our websites and to balance the load on our web servers. We may need to use and disclose it as necessary in the event of a security concern or incident, and we delete it after a maximum of three months.
To improve our service to you
When you visit our website, we use the third-party Google Analytics service to collect standard internet log information. We do this to find out how visitors use University websites and to improve our websites’ usability. All information is anonymised before it is logged or stored by Google’s servers. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our site. Full IP addresses are not recorded but Google does derive the City, Country and Continent of each recorded visit from the first parts of the IP address. For EU-based traffic, IP-address data is used solely for geolocation data derivation before being discarded. When Analytics collects measurement data, all IP lookups are performed on EU-based servers before forwarding anonymised data to Google Analytics’ servers in the USA for processing. Data about web sessions is deleted after 14 months. For more information about how Google Analytics uses this information, please see the Google privacy policy.
On the ‘For Staff’ website and the Staff Hub SharePoint site, we also use Matomo Analytics. This is a website usage analysis tool to help us understand what content our site’s users need most frequently and how they navigate to that content. IP addresses are not recorded but Matomo does derive the City, Country and Continent of each recorded visit from the first parts of the IP address. We also use Matomo’s 'heatmaps' and 'scrollmaps' functionality to identify where content is failing to meet our users’ needs, or where our page layouts are unclear and people are trying to click something that does not respond as they would expect. We use Matomo’s split-testing functionality to improve page layouts, in order to incrementally improve the user experience of this website over time. Data collected using our Matomo Analytics account is not shared with any third parties and remains the property of the University of Cambridge. All visits and actions raw data are deleted no later than 366 days after they are recorded. For more information, please refer to Matomo’s privacy policy.
Additionally, where you are using a University-managed device, we may record anonymised web browsing sessions on the ‘For Staff’ website and the Staff Hub SharePoint site. We do this to sample at random ‘real-life’ interactions with key web and SharePoint pages, such as: clicks, mouse movements, scrolls, window resizes and page changes. This method helps us to understand where users do not find what they are looking for as smoothly as we would like. We do not have access to information about the identity of users whose sessions are randomly sampled in this way, this sampling does not happen on any authentication pages (such as the Microsoft account or Raven sign in pages), and recorded sessions will be deleted no later than 366 days after they are made.
What should you expect to happen with the information?
We are committed to respecting the information you trust us with and to making sure that we keep it safe. Our websites collect very little personal information and we use it in ways that are compatible with your individual rights and freedoms.
The use of your personal information in the ways described above is necessary for the legitimate interests of the University in operating and improving its websites, analysing their use and ensuring their security.
Where we do need to collect any additional personal data not listed above via our website, you will be told at that time about the use we will make of that information and asked for your consent. For example, if you are a member of staff with a University account password, you may complete the online form to submit a request for an award notice to be published.
Our services are not designed for, or intentionally targeted at, children 13 years of age or younger. We do not intentionally collect or maintain data about anyone under the age of 13.
Transferring your information outside the United Kingdom
We may need to transfer your personal information outside of the UK in order to provide you with the services you require or as necessary for our legitimate interests. This will most likely occur when our third-party providers are based outside the UK. Where we need to transfer your data outside of the UK, those transfers are protected either by 'adequacy regulations' issued by the UK Government (declaring the recipient country as a 'safe' territory for personal data) or by standard contractual clauses issued by the UK Information Commissioner's Office (which give obligations for the recipient to safeguard the data).
How do I get further information?
For full details of how we use cookies on our website, including those that do not collect personal data, please see our cookie notice.
For more information about how we handle your personal information, for contact details and to understand your rights under data protection legislation, please see our general data protection notice.
Page last updated: 31 August 2023