How we use your personal information – University of Cambridge staff and students

This policy explains what personal information we gather about you while you are a service user of Cambridge Enterprise, as a University of Cambridge staff member or student, and details how that information is used.

Please take a moment to read and understand this policy. This policy supplements our other privacy policies and notices and is not intended to override them.

We (Cambridge Enterprise Limited) are a wholly owned subsidiary of the University of Cambridge (the University). Reference to the University includes its spin-out and proto-companies and any reference to academics, researchers, staff, students and alumni are to those of the University.

Cambridge Enterprise Limited (Cambridge Enterprise) is a company registered in England and Wales with registered company number 01069886.

Cambridge University Technical Services Limited, a company registered in England and Wales with registered company number 05749230, is a wholly owned subsidiary of Cambridge Enterprise Limited. Cambridge University Technical Services Limited has no employees and uses the same infrastructure as Cambridge Enterprise Limited to deliver consultancy services on behalf of Cambridge Enterprise Limited. Reference to Cambridge Enterprise includes Cambridge Enterprise Limited and Cambridge University Technical Services Limited.

Cambridge Enterprise is the data controller responsible for the personal information that you agree to share with either Cambridge Enterprise Limited or Cambridge University Technical Services Limited and any actions as a consequence of being a service user of Cambridge Enterprise Limited or Cambridge University Technical Services Limited, as a University of Cambridge staff or student member. By being a service user of Cambridge Enterprise Limited or Cambridge University Technical Services Limited, you agree that your personal information may be shared with the University.

The named person responsibility for data protection compliance for Cambridge Enterprise Limited and Cambridge University Technical Services Limited is our Deputy Director. If you have any questions about how your personal information is being used, or wish to exercise any of your rights, please contact:

The named person within Cambridge Enterprise with responsibility for data protection compliance is our Deputy Director. If you have any questions about how your personal information is being used, or wish to exercise any of your rights, please contact:

Cambridge Enterprise Limited, University of Cambridge

Hauser Forum, 3 Charles Babbage Road, Cambridge CB3 0GT

Email us

What is ‘personal information’?

How does this web page relate to other information about data protection?

Who will process my personal information?

What personal information will be processed?

When you start to use the services of Cambridge Enterprise on any route to commercialisation, you provide us with personal information via contact, disclosure or agreement forms. Cambridge Enterprise will keep a record of the details you provided via the form/s, together with any supporting documents requested.

This personal information will be held in a ‘case file’ and will include data such as your name, home address, email address, citizenship/nationality, education and research history, commercialisation strategy and, if applicable, your ideas that you wish to commercialise.

There may be times, according to your case, when we seek additional details that will form part of the case file (for example information from the University’s Research office about research grants, research sponsors and research collaborators, or further information from your PI).

We record, store and securely transmit your personal information in paper and electronic formats, in email and voice recording. We limit access to your personal information to your personal information to our employees and those at the University who have a need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We may combine the information you submit with other information we have collected from you, whether online or offline, and on your usage of our website.

We may collect certain information automatically as you navigate around our website.

Please see our Cookie Policy and How we use your personal information – website users for further details.

What is the purpose of the processing?

Cambridge Enterprise will process your personal information for a range of contractual, statutory or public interest purposes, including the following (where appropriate for your case):

To deliver services (e.g. commercialisation via consultancy services, technology transfer services including IP protection, business creation and Seed Fund services)
To communicate effectively with you by post, email and phone in order to enable us to contact you about your case
To share relevant newsletters and circulars
To compile statistics and conduct surveys and research for internal and statutory reporting purposes
To operate security (including CCTV), governance and quality assurance arrangements
Contractual compliance (i.e. IP Policy, research funding or collaboration contracts, student agreements)
To comply with statutory requirements (i.e. Patent law, export control including providing citizenship information, REF reporting)

We consider the processing of your personal information for these purposes to be necessary either for legitimate purposes, or for the performance of our contractual obligations with you (e.g. to manage your IP or consultancy contracts), or necessary for the performance of tasks we carry out in the public interest (e.g. non-statutory reporting or research).

We require you to provide us with any information we reasonably ask for to enable us to administer your case.

If we require your consent for any other specific use of your personal information, we will collect it at the appropriate time. You may request to withdraw this at any time, (within the context of the University’s IP Policy requirements and Cambridge Enterprise’s Memorandum of Understanding with the University). We will not use your personal information to carry out any wholly automated decision-making that affects you.

What is the legal basis for processing?

In order to provide you with our services, there are a number of predefined legitimate purposes for which we will share your personal data with the University of Cambridge. Our assessment of our legitimate interests has established the following business reasons for sharing the data:

Contractual compliance with Cambridge Enterprise’s obligations to the University within the context of the University’s IP Policy requirements and Cambridge Enterprise’s Memorandum of Understanding with the University
Access to specialist University services will enable Cambridge Enterprise to gain appropriate business advice concerning the business activity and the commercialisation of specific intellectual property
Sharing commercialisation data with the University to enable Cambridge Enterprise to report our activity more effectively to University management, including REF team, Heads of School and Department, and keep the University better informed about commercialisation activity

Further information on how the University uses your personal information can be found here.

We set out in the table below, details of the lawful basis for which we process your personal information.

If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time. We will not use your personal information to carry out any wholly automated decision-making that affects you.

Purpose	Legal basis for processing including basis of legitimate interests
To deliver services to and manage our relationship with you	a) Performance of our agreement with you b) Necessary to comply with a legal obligation c) Necessary for our legitimate interests (to keep our records updated and to support commercialisation via consultancy services, technology transfer services including IP protection, business creation and Seed Fund services for academics, researchers, staff, students and alumni)
To communicate with you via digitally, by post and in person to effectively process and manage your case	a) Performance of our agreement with you b) Necessary to comply with a legal obligation c) Necessary for our legitimate interests (to commercialise intellectual property, grow our business and support academics, researchers, staff, students and alumni)
To measure or understand the effectiveness of our provision of services	Necessary for our legitimate interests (to study how academics, researchers, staff, students and alumni use our services, to develop them, to commercialise intellectual property, and to inform our marketing strategy)
To compile statistics and conduct surveys and research for internal and statutory reporting purposes	a) Necessary to comply with a legal obligation b) Necessary for our legitimate interests (to commercialise intellectual property, grow our business and support academics, researchers, staff, students and alumni)
To interact with our business teams	Necessary for our legitimate interests or to perform our obligations under our agreement with you (to ensure that cases are managed in an efficient and effective way)
To protect the vital interests of academics, researchers, staff, students and alumni using our services	Necessary for our legitimate interests (in order to protect the vital interests of academics, researchers, staff, students and alumni)
To protect our vital interests	Necessary for our legitimate interests (in order to establish, exercise or defend any legal claims)
To collect and share any necessary feedback connected with your commercialisation opportunity	Necessary for our legitimate interests (in order to better serve academics, researchers, staff, students and alumni)
To comply with our legal obligations concerning the services we provide	Necessary for compliance with a legal obligation (in order to disclose your personal information to legal or regulatory authorities, with whom we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to comply with any legal obligation, or to protect the rights, property, or safety of us, academics, researchers, staff, students and alumni and third parties)
To fulfil contractual compliance (including IP Policy, research funding or collaboration contracts, student agreements)	a) Necessary for our legitimate interests (contractual compliance with Cambridge Enterprise’s obligations to the University within the context of the University’s IP Policy requirements and Cambridge Enterprise’s Memorandum of Understanding with the University) b) Necessary for compliance with a contractual obligation (in order to disclose your personal information to other parties, with whom we are under a contractual duty to disclose or share your personal data in order to comply with any contractual obligation, or in order to comply with any legal obligation, or to protect the rights, property, or safety of us, academics, researchers, staff, students and alumni and third parties)
To comply with statutory requirements (including Patent law, export control including providing citizenship information, REF reporting)	Necessary for compliance with a statutory obligation (in order to disclose your personal information to legal or regulatory authorities or funding bodies, with whom we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to comply with any legal obligation, or to protect the rights, property, or safety of us, academics, researchers, staff, students and alumni and third parties)
To administer and protect our business, and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data) and to operate security, governance and quality assurance arrangements	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation

Who will my personal information be shared with?

Your personal information is shared as permitted or required by law, on a considered and confidential basis, with a range of external organisations, including the following:

Where necessary to provide services, (following the assessment of our legitimate interests), the University of Cambridge
Where necessary to provide services (following the assessment of our legitimate interests), the following third party service providers: patent attorneys, prototype engineers, market analysts, lawyers and accountants, mentors Cambridge Enterprise invites to coach academic entrepreneurs; as well as investors, including Cambridge Innovation Capital, who may invest or co-invest in seed funding opportunities
Prospective and actual research funders or sponsors
Relevant Government Departments (e.g., the Department for Business, Innovation and Skills), executive agencies or non-departmental public bodies (e.g. (e.g. UK Research and Innovation, Higher Education Statistics Agency)
Relevant professional or statutory regulatory bodies (e.g. General Medical Council)
Any relevant simultaneous employers (e.g. NHS Trusts)
On occasion and where necessary, the police and other law enforcement agencies
On occasion and where necessary, auditors

On occasion, the above types of sharing may involve the transfer of your personal information outside of the European Economic Area (e.g. to report to an overseas research funder or sponsor). Such transfers usually are necessary in order to meet our contractual obligations with you, and are carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information.

Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).

Links to other websites

Our website may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control those third-party websites and not responsible for their privacy policies or statements.

This Privacy Policy does not apply to any website operated by a third party. If you visit a third party website, please read its Privacy Notice or privacy statement to find out how it uses your personal data.

Your rights

You have the right to access the personal information that is held about you by the Cambridge Enterprise. Further details can be found at Making a Subject Access Request.

You also have the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, or to object to processing or to receive an electronic copy of the personal information you provided to us. Please email us via the button below if you believe we have some inaccurate personal information held about you.

If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at Wycliffe House, Water Lane, Wilmslow, SK9 5AF. We would however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.