Legal
Privacy notice
What we ask for when you register, what happens to it, and how to get it back or have it removed. Written to be read, not skimmed past.
Who we are
The Chevening Alumni Community is an independent group of volunteers, all of them Chevening Scholars or Fellows, who maintain this website and the alumni directory behind it. We are the data controller for the information described below.
We are not operated by, funded by, or affiliated with the Chevening programme, the Foreign, Commonwealth & Development Office, or any UK government department.
What we collect
When you register through the join form, we ask for:
- Your name — required.
- Your email address — required, so the committee can contact you about your registration.
- Your phone number — optional.
- Your country of residence — required.
- Your Chevening cohort year — required.
- A copy of your Chevening certificate — entirely optional, as a PDF, JPEG or PNG up to 10 MB.
We also store any notes a committee member writes while reviewing your registration, and the date it was submitted.
Why we collect it
We use your details for two purposes only: to confirm that you are a Chevening alum before adding you to the directory, and to produce the aggregate figures shown on our homepage — the total number of approved members and the number of countries they live in.
Those public figures are totals and nothing else. No name, cohort year or country is ever published against an individual, and the totals cannot be traced back to any one person.
We rely on your consent, given by ticking the box on the registration form, as our lawful basis for holding this information. You can withdraw it at any time — see your rights.
How it is protected
In transit. Every page and form submission on this site travels over an encrypted HTTPS connection.
At rest. When your registration reaches our server, your name, email address, phone number and any committee notes are encrypted with AES-256-GCM before being written to the database. Anyone reading the database directly sees unreadable data, not your details. An uploaded certificate is encrypted the same way, and even its original filename is stored encrypted.
Where the key lives. The encryption key is held only as a server-side secret. It is never sent to your browser, never written into our source code, and never included in any response from our website.
Uploaded files have no public address. Certificates are stored in a private bucket with no public URL of any kind. The only way to open one is through the committee's protected console, which decrypts it on demand for that one view.
Two pieces of information are deliberately not encrypted: your country and your cohort year. They are needed to produce the public totals and to let the committee sort registrations, and on their own they do not identify you.
Who can see it
Only named committee volunteers. The admin console is protected by Cloudflare Access, which means a reviewer must sign in with an email address that has been added to an allow-list; there is no shared password, and there is no way to reach the console without passing that sign-in.
Every time a committee member opens a member record or views an uploaded certificate, that action is logged with their email address and a timestamp. Access to your data leaves a trail by design.
We do not sell your data, we do not share it with advertisers, and we do not pass it to any third party for their own purposes. Our website and database are hosted on Cloudflare, which processes the data on our behalf and under contract.
Cookies and tracking
This website sets no cookies on public pages, runs no analytics, and embeds no third-party scripts, fonts, or tracking pixels. There is nothing to consent to, which is why you will not find a cookie banner here.
The one exception is the committee's own admin console, where the sign-in service sets a session cookie for the reviewer who is signing in. That never applies to visitors of the public site.
How long we keep it
We keep your details for as long as you want to be part of the alumni directory. If your registration is rejected, or you ask to be removed, your record and any certificate you uploaded are deleted.
Your rights
You can ask us at any time to:
- give you a copy of everything we hold about you;
- correct anything that is wrong or out of date;
- delete your record entirely, including any uploaded certificate;
- withdraw the consent you gave when registering, which means we delete your record.
Email the committee using the address below and we will action it. There is no charge, and you do not need to give a reason. If you are unhappy with how we have handled a request, you have the right to complain to your national data protection authority.
Contact
Write to the committee at committee@example.org for anything relating to your data or this notice.
If we change this notice, we will update the date at the top of this page.