Data Retention Policy for the University Card Service

The University Card system holds information about current and past requests for University cards. The information held in relation to each Card request contains potentially identifiable personal information as follows:

• An image of the front of the requested Card. This includes the cardholder’s photograph
• An image of the back of the requested University Card
• The CRSid of the person who ordered the card
• CRSid: The Common Registration Scheme unique identifier assigned to the card holder.
• Staff Number (optional): The HRN unique identifier used by CHRIS
• Student Number (optional): The USN unique identifier used by CamSIS
• Barcode: The unique library barcode assigned to the cardholder
• UCam Card ID: The unique ID generated by the University to identify the Card assigned to a user
• Legacy cardholder identifier: The University’s legacy Card system unique identifier associated with a specific card
• Card UUID: A unique identified for the Card record in the card system
• Manufacturer Card UID: The Card manufacturer’s unique ID associate with a specific card.

University Cards are issued, renewed and cancelled in accordance with the University Card eligibility policy. Information held by the Card System is needed to support this functionality. Please note that any personal information associated with each Card request was correct on the date and time that a Card was issued only.

1. The University will hold the information listed above in the University Card System for all Cards issued to a cardholder for the duration of a person’s current association with the University.
2. A 'current' association is determined by the existence of an active entry in the University’s Lookup directory.
3. Previous images of cardholders are retained to assist with confirming that new Card requests are for the same cardholder. Such images, including those contained on the image of the front of revoked University’s Cards can be deleted at the cardholder’s request.
4. The Card history, including images of any previous Cards issued by the University, will be deleted 2 years after a cardholder’s record becomes inactive in Lookup.
5. If a cardholder still holds Cards that have not reached their expiry date at the point the cardholder no longer has an association with the University, records of these Cards will be maintained until the Card expires or has been returned and destroyed.