Privacy Policy

2.1 Information you provide

• Name
• Email address
• Institution, department and course
• Profile photo(s) and additional photos
• Text responses to Yearbook questions
• Social media links (optional)
• Contact details such as address or phone number (optional)
• Other content you choose to include in your Yearbook profile

2.2 Information collected automatically

• IP address
• Browser type and version
• Device information
• Pages visited and actions taken on our website
• Log data and activity timestamps collected via Google Analytics 4 and essential cookies

2.3 Payment information

Payments are processed securely by Pay360 (PayPoint). We do not receive or store your full card details.

2.4 Additional sources

• Email communications sent to and from us
• Address lookup data (via Google) if used during ordering
• Emails delivered through SendGrid

6.1 With service providers

We may share data with trusted third-party providers who help us deliver our services, including:

• Hosting.uk – website hosting (UK-based servers)
• I-finity.co.uk – UK web development services
• Microsoft Azure (UK regions) – Yearbook database infrastructure
• Pay360 / PayPoint – payment processing
• SendGrid – transactional email delivery
• Google – address lookup tool
• ISO 27001 accredited and UK-based production of physical books
• Google Analytics 4 – site usage data (anonymised)

These providers act as data processors and may only use your data in accordance with our instructions.

6.2 Sharing with your institution (university / college / school)

We only share your content with your institution if you have opted in during signup. Sharing may be used for alumni engagement, marketing, or institutional archives.

6.3 Legal and compliance requirements

We may share information when required to comply with the law or to defend legal claims. We never sell your personal data.

7.1 Microsoft Azure (UK regions only)

Our Yearbook database and platform infrastructure are hosted on Microsoft Azure, using UK-based data centres only (Azure regions UK-West and UK-South). This means that the core personal data we collect (including Yearbook content, profiles, and account details) is stored and processed exclusively within the UK.

Azure may provide remote technical support from outside the UK; where this occurs, access is strictly controlled and protected by Standard Contractual Clauses and equivalent safeguards.

7.2 When international transfers may occur

Some of our service providers operate globally or use systems located outside the UK/EEA. As a result, limited personal data may be transferred internationally — for example:

• SendGrid (Twilio) (transactional emails; USA-based infrastructure): name, email address, communication metadata
• Google Analytics 4 (pseudonymised analytics data processed globally): IP addresses, browser and device information, geolocation data, and user interactions with the website (page views, clicks, conversions)

These services do not host your Yearbook content. We only use providers that implement robust compliance frameworks. Relevant Data Protection Agreements can be found here:

• Google Cloud: https://cloud.google.com/terms/data-processing-addendum
• SendGrid (part of Twilio): https://www.twilio.com/en-us/legal/data-protection-addendum

7.3 Safeguards we apply to transfers

Whenever your data is transferred outside the UK, we ensure that one or more of the following legally recognised safeguards are in place:

1. UK Adequacy Regulations – transfer to countries the UK Government recognises as providing an adequate level of protection

2. Standard Contractual Clauses (SCCs) with the UK Addendum – contractual terms approved by the UK ICO ensuring equivalent data protection standards

3. Binding Corporate Rules – for providers operating a global internal data protection framework

4. Technical safeguards, such as:

• encryption in transit and at rest
• pseudonymisation
• strict access controls
• audit logging and monitoring

These measures help ensure that any international transfer affords protection essentially equivalent to UK data protection law.

7.4 Transfer Risk Assessments (TRAs)

Where required, we conduct Transfer Risk Assessments in accordance with UK GDPR and ICO guidelines. This includes evaluating:

• the laws of the destination country
• the provider's security standards
• the likelihood of unauthorised access
• the nature of the personal data transferred
• whether the transfer is necessary for the service we provide

We only proceed where we determine that your data can be protected to an appropriate standard.

7.5 Publication of Digital Yearbooks (global accessibility)

Yearbook content you submit for publication — such as your name, photo, and written profile — may be included in printed and/or digital Yearbooks.

Digital Yearbooks are accessible online to individuals with valid authentication. However, because they are published on the internet, they may be accessed from anywhere in the world.

Once published, we cannot fully control:

• how other authorised users view or use your content
• downloads, screenshots, or onward sharing by others

By submitting content for publication, you acknowledge that your information will be accessible internationally.

7.6 Summary

Although some personal data may be transferred outside the UK, we ensure that:

• transfers are limited
• data is minimised
• strong technical and contractual protections are in place
• processing always complies with the UK GDPR