University of Cambridge staff and students – How we use your personal information

This page provides information about the use of personal information while you are a service user of Cambridge Enterprise, as a University of Cambridge staff or student member.

1. What is ‘personal information’?

‘Personal information’ means any information which relates to or identifies you as an individual.

2. How does this web page relate to other information about data protection?

Please see further information on our Data Protection pages.

3. Who will process my personal information?

The information published here applies to the use, sharing and disclosure of your personal information by Cambridge Enterprise Ltd.

Cambridge Enterprise is a wholly-owned subsidiary of the University of Cambridge.  In order to provide you with our services, there are a number of predefined legitimate purposes for which we will share your personal data with the University of Cambridge.  Our assessment of our legitimate interests has established the following business reasons for sharing the data:

  • Contractual compliance with Cambridge Enterprise’s obligations to the University within the context of the University’s IP Policy requirements and Cambridge Enterprise’s Memorandum of Understanding with the University;
  • Access to specialist University services will enable Cambridge Enterprise to gain appropriate business advice concerning the business activity and the commercialisation of specific intellectual property; and
  • Sharing commercialisation data with the University to enable Cambridge Enterprise to report our activity more effectively to University management, including REF team, Heads of School and Department, and keep the University better informed about commercialisation activity.

Further information on how the University uses your personal information can be found here.

4. What personal information will be processed?

When you start to use the services of Cambridge Enterprise on any route to commercialisation, you provide us with personal information via contact, disclosure or agreement forms.  Cambridge Enterprise will keep a record of the details you provided via the form/s, together with any supporting documents requested.

This personal information will be held in a ‘case file’ and will include data such as your name, home address, email address, citizenship/nationality, education and research history, commercialisation strategy and, if applicable, your ideas that you wish to commercialise.

There may be times, according to your case, when we seek additional details that will form part of the case file (for example information from the University’s Research office about research grants,  research sponsors and research collaborators, or further information from your PI).

Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats, including a case management database system.  Access to your personal information is limited to staff who have a legitimate interest in it for the purpose of carrying out their contractual duties, and our use of your personal information will not be excessive.

5. What is the purpose and legal basis of the processing?

Cambridge Enterprise will process your personal information for a range of contractual, statutory or public interest purposes, including the following (where appropriate for your case):

  • To deliver services (e.g. commercialisation via consultancy services, technology transfer services including IP protection, business creation and Seed Fund services )
  • To communicate effectively with you by post, email and phone in order to enable us to contact you about your case
  • To share relevant newsletters and circulars
  • To compile statistics and conduct surveys and research for internal and statutory reporting purposes
  • To operate security (including CCTV), governance and quality assurance arrangements
  • Contractual compliance (i.e. IP Policy, research funding or collaboration contracts, student agreements)
  • To comply with statutory requirements (i.e. Patent law, export control including providing citizenship information, REF reporting)

We consider the processing of your personal information for these purposes to be necessary either for legitimate purposes, or for the performance of our contractual obligations with you (e.g. to manage your IP or consultancy contracts), or necessary for the performance of tasks we carry out in the public interest (e.g. non-statutory reporting or research).

We require you to provide us with any information we reasonably ask for to enable us to administer your case.

If we require your consent for any other specific use of your personal information, we will collect it at the appropriate time. You may request to withdraw this at any time, (within the context of the University’s IP Policy requirements and Cambridge Enterprise’s Memorandum of Understanding with the University).   We will not use your personal information to carry out any wholly automated decision-making that affects you.

6. Who will my personal information be shared with?

Your personal information is shared as permitted or required by law, on a considered and confidential basis, with a range of external organisations, including the following:

  • Where necessary to provide services, (following the assessment of our legitimate interests), the University of Cambridge.
  • Where necessary to provide services (following the assessment of our legitimate interests), the following third party service providers: patent attorneys, prototype engineers, market analysts, lawyers and accountants, mentors Cambridge Enterprise invites to coach academic entrepreneurs; as well as investors, including Cambridge Innovation Capital, who may invest or co-invest in seed funding opportunities.
  • Prospective and actual research funders or sponsors.
  • Relevant Government Departments (e.g., the Department for Business, Innovation and Skills), executive agencies or non-departmental public bodies (e.g. (e.g. UK Research and Innovation, Higher Education Statistics Agency).
  • Relevant professional or statutory regulatory bodies (e.g. General Medical Council).
  • Any relevant simultaneous employers (e.g. NHS Trusts).
  • On occasion and where necessary, the police and other law enforcement agencies.
  • On occasion and where necessary, auditors.

On occasion, the above types of sharing may involve the transfer of your personal information outside of the European Economic Area (e.g. to report to an overseas research funder or sponsor). Such transfers usually are necessary in order to meet our contractual obligations with you, and are carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information.

Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).

7. How can I access my personal information?

You have the right to access the personal information that is held about you by Cambridge Enterprise. Further details can be found here.

You also have the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, (within the context of the University’s IP Policy requirements and Cambridge Enterprise’s Memorandum of Understanding with the University), or to object to processing or to receive an electronic copy of the personal information you provided to us.  Please contact contact enquiries email address with the Subject header ‘Data Protection’ if you believe we hold some inaccurate personal information about you.

8. How long is my information kept?

As a subsidiary of the University of Cambridge, we follow the University’s guidance on information retention. Information about how long different types of information are retained by the University is published here.

9. Who can I contact?

If you have any questions about how your personal information is used, or wish to exercise any of your rights , please contact enquiries email address with the Subject header ‘Data Protection’ for more information.

10. What is the external complaints process?

If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (

11. Are changes made to this page?

This web page was last updated in May 2019. It is reviewed when necessary and at least annually. Any changes will be published here.

Back to Core Privacy Notices