Alumni Association Privacy Notice
Updated 12th November 2026
This Privacy Notice relates to personal data processed by the NSPC Alumni Association. The following statement sets out how the Alumni Association uses your data. It should be read in conjunction with our general privacy notice.
How does the Alumni Association collect personal data?
The Alumni Association collects personal information from you both directly and indirectly.
Occasions when information is collected directly include:
- Filling out a sign-up form.
We collect information indirectly:
- Basic details of your award title and graduation date may be transferred from your prior student record as part of the onboarding process to verify your status as a graduate.
What personal data we collect
In order to sign up to the mailing list we will ask for the following information about you:
- Your name;
- Your award title;
- Your Middlesex ID number (this helps us to match your record with our graduate record);
- Your email address.
We will also create a basic alumni record for you automatically on graduation which includes details of your progression and award. This is separate from the alumni association, and more details can be found in our general privacy notice.
How your data is stored
We use the following service providers to store and process your data on our behalf. They may only use it on our instructions.
- On signing up your details will be stored on Brevo, our mailing list provider;
- Our alumni database is hosted on Microsoft 365 cloud services (including SharePoint and Dataverse), where data is currently stored in Microsoft’s United Kingdom data centres and encrypted both in transit and at rest.
Access to both is controlled on a least-privilege basis and protected by multi-factor authentication. Data is backed up regularly to secure infrastructure, and our backup and restore procedures are tested at regular intervals by our IT providers. All company devices are protected by endpoint cyber-security software, and NSPC holds Cyber Essentials certification, which we renew annually. For more information about how Brevo processes personal data, please see Brevo's Privacy Policy.
International transfers
Microsoft 365 stores your data in the UK. Brevo primarily stores data in the EU.
Where data is transferred to the European Economic Area (for example through Brevo), this is covered by the UK’s adequacy regulations. Where data is transferred outside the UK or EEA, we ensure an appropriate safeguard is in place, such as the International Data Transfer Agreement.
How we use your data
We will process your personal data in accordance with the framework laid out in this privacy notice, and ensure that it is treated with respect.
Data that we do store is used to stay in touch with our alumni community in order to:
- Ask for feedback about your experiences during your studies in order to improve the organisation;
- Invite you to events being held by the school;
- Invite you to share any career updates with us either privately or for circulation to the wider NSPC student/alumni community;
- Notify you of any third-party opportunities that may be of interest to you such as graduate jobs that the school has been notified about;
- Notify you of relevant workshops and graduate discounts from our sister company, the Existential Academy (we do not share your data with the Existential Academy, but we do share their news with you on their behalf);
- Notify you of relevant NSPC news such as new courses and updates from our alumni.
We use digital tracking tools to monitor the impact of our communications for example email tracking to record when an email we send to you has been opened, or you have clicked a particular link. This information helps us to ensure that our communications are as relevant and engaging as possible.
We will never sell your data to other organisations.
Our lawful basis
| What we do | Lawful basis |
|---|---|
| Sending you alumni emails, including NSPC news, event invitations, new courses, requests for feedback on your studies, and invitations to share career updates | Consent. You give this when you join the mailing list. |
| Telling you about graduate jobs and other opportunities from third parties, and about workshops and graduate discounts from our sister company, the Existential Academy | Consent. You give this when you join the mailing list. We do not pass your details to the Existential Academy or any other third party. |
| Using email tracking to see whether our emails are opened and which links are clicked | Consent. You give this as part of your mailing list subscription. You can also block tracking by turning off automatic image loading in your email app. |
| Sharing your career news with the wider NSPC student and alumni community | Consent. We will always ask you first, each time, and will only share what you agree to. |
| Checking your award and graduation details against your student record to confirm you are an NSPC graduate | Legitimate interests. It is in our and our alumni’s interests that the Alumni Association is open only to genuine graduates. |
| Keeping a record of when and how you gave consent, and keeping your email address on a “do not contact” list after you unsubscribe | Legal obligation. We must be able to show that we had your consent to send marketing emails, and make sure we do not contact you again after you have opted out. |
Withdrawing consent. You can withdraw your consent at any time by clicking “unsubscribe” in any of our emails or by emailing [email protected]. This does not affect anything we did before you withdrew it.
Objecting to legitimate interests. Where we rely on legitimate interests, you have the right to object, and we will stop unless we have compelling grounds to continue.
Data controller and contact details
NSPC Ltd is the data controller for the personal data described in this notice.
If you have any questions about this notice or wish to exercise your rights, please contact:
Data Protection Lead: Danny van Deurzen-Smith
NSPC Ltd, 61–63 Fortune Green Road, London NW6 1DR
Email: [email protected]
How long we keep your data
We keep your details for as long as you are subscribed. If you have not opened or clicked any of our emails for two years, we will contact you to ask whether you would like to stay subscribed, and remove you if you do not reply.
If you unsubscribe, we will delete your details within one month, except for your email address and a record of your consent and unsubscribe, which we keep on a “do not contact” list so that we do not email you again by mistake.
You can unsubscribe at any time using the link in our emails, and request deletion of your data by contacting our Data Protection Lead at [email protected].
Your rights
Under data protection law you have the following rights, some of which apply only in certain circumstances:
- the right to be informed about how we use your data;
- the right of access to the personal data we hold about you;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure of your data;
- the right to restrict our processing;
- the right to object to our processing;
- the right to data portability;
- the right to withdraw consent, where our processing is based on consent.
We may be entitled to refuse a request where an exception applies. To exercise any of your rights, please contact our Data Protection Lead using the details above.
If you object to us using your data for direct marketing, we will always stop.
If you believe your request has not been handled properly, or you have any other data protection concern, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
Our responsibilities
All staff and students who handle personal data for which NSPC is responsible must follow our Data Protection Policy and any related guidance issued by NSPC or Middlesex University.
Changes to this notice
We may update this notice from time to time. The current version, and the date it was last reviewed, is shown at the top of this document and published on the NSPC website.