Events privacy notice

The Events team is part of the University of Surrey. We are registered as a data controller with the Information Commissioner’s Office and are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. We have a named Data Protection Officer, James Newby, who can be contacted via

What information do we collect from you?

The Events team collects and processes the following data about people it keeps on its mailing list: 

  • Name and address
  • Email address (if provided)
  • Phone number (if provided).

We only collect the data we need and keep that data up to date. 

We have this data about you on our mailing list because you were previously invited to an event, you previously accepted an invitation to an event or you provided it when booking for an event.

Why do we collect this information?

The University collects only the data we need and we keep the data up to date and only for as long as it is needed. 

We collect your personal data in order to:

  • Send you a personal invitation to a University event.
  • Send you information about events that may be of interest to you and inviting you to register for them.
  • Send you newsletters to keep you up to date about forthcoming events taking place at the University or organised by the University.
  • Enquire if you have received an invitation to a particular event and if you will be attending.
  • Ask for feedback about University events you may have attended which includes surveys.

We do not use the data we collect to make decisions about individuals or to analyse information on an individual level.

We take our obligations for data handling very seriously and it is therefore important for you to know that the lawful basis for us processing your information is that consent has been provided by the data subject and they have given his or her consent for the processing of their personal data for one or more specific purposes.

What do we do with your information?

We collect the data about you from the forms you complete when registering for events, or purchasing tickets for events, or completing online forms, or from the information you provide when contacting us by e-mail or telephone to book to attend an event. The data is then kept in a database and used to contact individuals to achieve the purposes listed above. Some analysis of the data is also undertaken but only in an aggregate form to provide information about the success of events and never in ways in which individuals can be identified.

How long do we keep your information?

We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for 5 years and then destroyed. 

Who do we share your information with?

We may share your personal data with the following departments within the University:

  • The University’s Advancement team (who support the University’s alumni community) who work with us to plan events.
  •  The Marketing team who may use the information in an aggregated and anonymous form to assess the effectiveness and success of events.
  • Departments and schools within the University’s academic faculties who may wish to invite you to an event of interest.

Your data will not be shared with any external organisations.

What rights do you have in relation to the way we process your data?

You can find detailed information about your rights as a data subject on the University’s data protection page.

You have the right to ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.

Where the data we hold on you is inaccurate, you may request that we rectify these inaccuracies. 

You have the right to have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the data subject rights information on the University’s webpage. 

You have the right to restrict the ways in which we process your data. This means that, if requested, we will only store your data.