Privacy notice
How camsocs uses personal data, and your rights. Last updated 9 Oct 2026.
Who is responsible
camsocs is run by Joshua Fehn as an individual. He is the controller of the personal data described here under the UK GDPR and the Data Protection Act 2018. camsocs is not run by, and does not speak for, the University of Cambridge, its colleges or Cambridge SU.
Contact for anything in this notice: the request form or camsocs@joshua-fehn.de.
What we collect, and from where
Most of camsocs is about organisations, not people. Personal data comes in only in the ways below.
Role contact addresses (public)
Listings show the contact addresses societies publish for a role, such as president@society.org. Such an address can point to whoever holds the role. Addresses that name an individual student (a personal Cambridge CRSid address) are never shown in public listings.
Names in descriptions (replaced before publishing)
Descriptions copied from public pages sometimes name committee members, performers or other students. Before a description is published, such names are replaced by the person's role or a neutral phrase, for example “contact our President”. The original wording is kept privately, with the record of where each fact came from, for as long as the listing exists. Speakers announced for public talks are shown by name, as the organiser published them.
Committee members (private, never published)
Where a society names its committee on its own public pages, the operator may keep the names and roles in private notes, used to contact societies and to make introductions between them and possible partners. These notes are not public, are marked out of date after each year's handover, and are deleted on the schedule below.
Society mailing lists
Messages sent to society mailing lists that the operator subscribes to are forwarded to camsocs so that the events they announce can be listed. They contain the sender’s name and address. The messages are kept privately; only the events taken from them are shown, and only to visitors signed in with a verified @cam.ac.uk address.
When you contact us
If you use the request form, we keep your email address, any role you give and your message.
When you sign in
Signing in is optional. If you sign in with a @cam.ac.uk email link, we keep that address and a session record. The operator signs in with a Google account.
Sources
Apart from what you send us, the data comes from publicly accessible sources: the Cambridge SU society directory, the Proctors' register, Sport Cambridge, Camdram, CUCBC, college and JCR/MCR websites, societies' own websites, Linktree pages and public calendars, talks.cam and Playwaze; and from society mailing lists as described above. The full list and our collection rules are on the About page.
Why we use it, and on what lawful basis
- Publishing the directory and calendar so students can find societies and their events: our legitimate interests, and those of students and societies (UK GDPR Article 6(1)(f)). We have weighed these against the interests of the people concerned, which is why public listings are limited to role addresses.
- Private notes for contacting societies and making introductions between them and possible partners: legitimate interests. We do not send marketing email without the consent the law requires, and every message says how to opt out.
- Answering requests and complaints: legitimate interests, and our legal obligation to respond to data protection requests (Article 6(1)(c)).
- Sign-in and the Cambridge-only tier: legitimate interests, to show events shared on Cambridge mailing lists only to Cambridge members.
We do not infer anyone's religion, politics, ethnicity, health or sexuality, and we make no automated decisions about people.
How long we keep it
- Public listings: while the organisation is active. Listings are refreshed every academic year; one with no sign of activity for two years is archived and then removed.
- Private committee notes: until the end of the academic year in which they were collected (30 June), then deleted within 30 days unless the person has agreed to more.
- Mailing-list messages: their text and attachments are deleted 30 days after we have read them for events, and the rest of the message after 90 days (we keep only its date, its list and which events it gave, without sender or subject).
- Events: deleted a year after they took place.
- Notes of our own contacts with a society: three years after the last contact.
- Requests and complaints: two years after they are closed (a request we turned down: 90 days). If you ask us to remove a listing, a detail or an address, we keep a minimal record — the listing's key, the field, or only a one-way hash of the address — so it is not added back.
- Sign-in accounts: until you ask us to delete them, or after two years unused.
- Copies of public web pages read by the harvester: 90 days.
Your rights
You have the right to:
- object to our use of personal data about you (Article 21). We will stop unless we have compelling grounds that override your interests; an objection to direct marketing is always upheld;
- ask for a copy of personal data we hold about you;
- have it corrected, or deleted;
- ask us to restrict its use while a question is resolved;
- complain to us, and to the Information Commission.
To use any of these rights, use the request form or camsocs@joshua-fehn.de. We reply within one month. We acknowledge a complaint within 30 days and tell you the outcome.
You can also complain to the UK regulator, the Information Commission (formerly the Information Commissioner's Office), at ico.org.uk.
Changes to this notice
If we change how we use personal data, we update this page and its date. Societies whose role addresses we list are told directly about the listing and how to object.