Privacy Policy

This statement explains how the Girton College Spring Ball 2027 Committee ("GSB 2027", "GSB", "we", "our" or "us") collects and handles personal data about you as a user of our ticketing platform and our reasons for doing so.

The latest version of this statement can be found on our website at ticketing.girtonspringball.com/privacy . The GSB 2027 committee is the data controller for data held under this privacy statement. The GSB 2027 IT & Ticketing Officer is the designated data protection contact, and are in charge of data protection matters. They can be contacted at springballticketing@girton.cam.ac.uk

"Personal data" or "personal information" means information relating to you that can be used in some way to identify you, either on its own or in combination with other such information available to its holder.

"Processing" of personal data is any action taken on that data, such as storage, retrieval, organisation, transmission or erasure, and/or as defined by relevant legislation.

"University" means the University of Cambridge.

A "CRSid" is a unique identifier issued to a person by the University. According to the University, CRSids are never reissued, so we assume that a CRSid will uniquely identify the same person forever. Usernames on our computer systems are also assigned to match a person’s CRSid.

The GSB 2027 committee usually processes attendees’ personal data on the basis that it is a legitimate interest of the platform and the Ball. Where we process your personal information for a purpose falling outside those listed in this statement or our other privacy statements (if applicable to you), we will seek your explicit consent before doing so.

The GSB 2027 committee collects and processes members’ personal data for a number of purposes, including:

• Maintaining accurate ticket records (comprising full name, CRSid, registered contact email address, join date, last login date, ticket details, responses to custom ticket questions);
• Keeping records of communications made to or from the GSB 2027 executive, the IT & Ticketing officer and any members of its committee;
• Maintaining historical records to enable us to research and analyse our own activities over time;
• Keeping logs relating to security incidents.

All of the above activities are carried out as a legitimate interest of the Ball.

Please get in touch with the designated data protection contact if you have concerns or queries about any of these stated purposes.

We primarily obtain your personal data through you providing it to us, for example when you sign up to the platform to purchase a ticket. However, this initial signup process also involves automatic retrieval of information available to any computer on the University network. Our systems look up this information using your CRSid, which is provided to us by the University's Raven service, which itself is used to authenticate to our platform. When signing up, you will have a chance to correct and amend any or all of this automatically-obtained information.

Your personal data is not usually shared outside the GSB 2027 committee and its members. However, the GSB 2027 committee may otherwise be required to share (with or without your consent) your personal data with the University, or become subject to a legal requirement to share it with a third party. Where possible in either situation, we will notify you in advance of our intention to do so, but this may sometimes be prohibited, for example by law or an injunction.

Your information is securely stored in a datacenter managed by our hosting provider. Additionally, all transactions involving the sharing of your personal data are carried out over secure networks (as far as is technically possible on our end). We retain your personal information for 3 months after the date of the Ball, which is March 20th 2027. After this, the only data we hold about you will be anonymized and turned into numerical data for future statistical analysis. Any identifiable information will be disposed of.

You have the right to ask for:

• access to your personal information;
• the correction of any errors in your personal information;
• the erasure of your personal information;
• restriction on processing of your personal information pending correction or erasure; and
• the transfer of your personal information to a third party by electronic means.

Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

If you have any questions or concerns about your personal information, please get in touch with the designated data protection contact listed at the top of this document. Please note that in dealing with your request, we may also need to share details of your request with entities with whom we have shared your personal data.

If you remain unhappy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF or online at https://ico.org.uk/.