Privacy Notice – Report + Support
The University is committed to looking after any information that you make available to us. We aim to be clear about what we will do with your data. This privacy notice explains when and why we collect personal information about you and how we will use this information including the ways we might share this with others. It also explains how we keep your information secure as well as the rights you have in relation to the information we hold about you.
The headings below set out the main information we need to give to you.
The privacy notice will be regularly reviewed to make sure it contains the most up-to-date information. We will let you know if we make significant changes to this privacy notice.
If you have any questions about any of the information contained in this privacy notice then you can contact us at dataprotection@uws.ac.uk
Who are we?
The University of the West of Scotland (referred to in this Privacy Notice as the “University”, “we”, “our” or “us”) is the Data Controller under the data protection legislation. This Privacy Notice sets out how we process the personal data we collect about you (referred to in this Privacy Notice as “you” or “your”).
What type of information do we collect about you?
You can make a report using Report + Support either anonymously or by making a report with your contact details.
If you choose to submit an anonymous report without sharing any identifying information about yourself then no direct action can be taken. We will use the anonymised data gathered only to establish and monitor trends to better inform our decision making and to help us identify whether there are patterns of behaviour that we should address. We will not take any action to identify individuals from anonymous reports but in order for us to be able to help you fully we encourage you to report with your personal details. If you choose to make an anonymous report then we would ask that you do not include the names or other information that could be used to identify a third party (such as the alleged perpetrator or witnesses).
If you choose to submit a report with contact details rather than an anonymous report then we will process the following personal data about you:-
The University is committed to looking after any information that you make available to us. We aim to be clear about what we will do with your data. This privacy notice explains when and why we collect personal information about you and how we will use this information including the ways we might share this with others. It also explains how we keep your information secure as well as the rights you have in relation to the information we hold about you.
The headings below set out the main information we need to give to you.
The privacy notice will be regularly reviewed to make sure it contains the most up-to-date information. We will let you know if we make significant changes to this privacy notice.
If you have any questions about any of the information contained in this privacy notice then you can contact us at dataprotection@uws.ac.uk
Who are we?
The University of the West of Scotland (referred to in this Privacy Notice as the “University”, “we”, “our” or “us”) is the Data Controller under the data protection legislation. This Privacy Notice sets out how we process the personal data we collect about you (referred to in this Privacy Notice as “you” or “your”).
What type of information do we collect about you?
You can make a report using Report + Support either anonymously or by making a report with your contact details.
If you choose to submit an anonymous report without sharing any identifying information about yourself then no direct action can be taken. We will use the anonymised data gathered only to establish and monitor trends to better inform our decision making and to help us identify whether there are patterns of behaviour that we should address. We will not take any action to identify individuals from anonymous reports but in order for us to be able to help you fully we encourage you to report with your personal details. If you choose to make an anonymous report then we would ask that you do not include the names or other information that could be used to identify a third party (such as the alleged perpetrator or witnesses).
If you choose to submit a report with contact details rather than an anonymous report then we will process the following personal data about you:-
- Your name
- Your status (i.e. student or staff)
- Your school/ department
- Your gender and age
- How many incidents you would like to tell us about
- The type of incident(s) (i.e. sexual harassment/ bullying/ hate crime)
- When and where the incident(s) occurred
- Whether you know the alleged perpetrator of the incident(s) or not; and
- Your e-mail address if you decide you want further contact with us about the matter
We will also process the names and other details of any third parties who are involved in the issues reported. Information relating to an individual’s criminal convictions or past offences (including alleged offences) must not be included in any report. If it is included then we will delete this before the report is progressed.
Where you name a member of staff, student or third party within the report then this information may be used to start one of our formal processes if you choose to do so, or for the University to take action if we have safeguarding concerns. You do not have to provide information that will identify others involved in the incident if you do not want to.
What are the sources of the information we hold about you?
The only information we collect will be the information you have chosen to provide to us when you submit your report via the reporting tool.
How will we use your information?
The main purposes for which we will process the information you have provided are:
Where you name a member of staff, student or third party within the report then this information may be used to start one of our formal processes if you choose to do so, or for the University to take action if we have safeguarding concerns. You do not have to provide information that will identify others involved in the incident if you do not want to.
What are the sources of the information we hold about you?
The only information we collect will be the information you have chosen to provide to us when you submit your report via the reporting tool.
How will we use your information?
The main purposes for which we will process the information you have provided are:
- To help us identify the best person for you to speak to in relation to your report and to provide you with appropriate support in respect of the incident and/ or concern;
- To allow us to take further action under the relevant University procedure, such as our disciplinary procedure;
- Compiling statistics or analysing trends from arising reports to inform our proactive and preventative work; and
- Meeting our duty of care to provide a safe environment for our staff and students.
Why do we need to process your personal data?
When you submit information using the Report + Support tool, you consent to us using this for the purposes set out in this notice. At any time you may withdraw this consent and we will safely and securely delete the information that you have provided to us. For more information about withdrawing your consent and other choices you have in relation to your information, see our data protection pages at https://www.uws.ac.uk/about-uws/compliance/information-records-management/data-protection/.
It may also be necessary because the University has a legitimate interest in ensuring staff and students at the University are safe and receiving support for incidents and/ or concerns affecting them and to allow us to create a safe and supportive working and study environment.
We will not generally take steps such as investigating the report, initiating disciplinary proceedings or passing information to third parties in order to take the report further unless: (a) you have made a report with contact details and (b) you agree to this action. On rare occasions, the processing may be necessary to protect your vital interests or the vital interests of another individual. For example, because a report reveals a situation that needs the involvement of the emergency services or another external agency. Our Duty of Care and Confidentiality guidelines provide further information on this.
How long will we keep your information?
The information you provide will be retained in Report + Support for a period of two years following the end of the academic year in which the report is made. Where personal data initially collected via the Report + Support tool is then used in connection with a formal process, then the data will be retained in line with the standard retention period for that process. You can find further information about this in our record retention schedules.
We may retain some anonymised data from your report in order to monitor our work in this area but you will not be identifiable through this information.
Who has access to your information and who will we share your information with?
We will always make sure that when we share information about you that we do this in line with the legislation and that we only share the minimum amount of information that is needed.
Access to personal information submitted through Report + Support will be strictly limited to a small number of University staff in Student Services (for reports affecting UWS students) or People & Organisational Development (for reports relating to UWS employees). Where the University carries out a formal investigation following a report we may share limited data about the report with certain university employees, for example the Dean of the School or the Director of a professional services department. We will aim to notify you in advance of sharing data with these University employees.
Report + Support is a third-party platform that has been developed by Culture Shift and they host the reporting tool for us. The University will act as the Data Controller for the information you provide. We have an agreement in place with Culture Shift to make sure that they handle your data in line with our instructions and the data protection legislation. Culture Shift does not routinely have access to personal data contained in reports made using the Report + Support tool. However, there are times when it may be necessary for UWS to grant access to Culture Shift, for example, to investigate and remedy security incidents or to provide technical support to us. Such access will be coordinated on a case by case basis, and subject to strict controls.
There are certain circumstances where we may provide information about the matters raised in a report, including personal data, to third parties. This may include providing personal data about you without your consent. For example where there is a legal obligation to provide information in respect of a court case. There may also be times where we share information provided to us with the police or other social care services. Our duty of care guidance sets out how personal data may be shared in these circumstances.
Personal data included in a report may have to be disclosed by us in response to a Subject Access Request (SAR). This is where the individual who the data is about exercises their right under the law to request a copy of their personal data from us. A request may be made by the person submitted the report, the person to whom the complaint relates or by a third party referred to in a report. The University has policies and procedures in place to deal with these requests and will uphold its confidentiality obligations in respect of the report.
We are not obliged to comply with a request if this would mean disclosing information about another individual who can be identified from that information unless (1) the other individual has consented to that disclosure, or (ii) it is reasonable to comply with the request without the other individual’s consent.
Where possible, given the nature of the information in the reports, we will try to avoid disclosing personal information other than that of the individual who has submitted the request, unless explicit consent to the disclosure is given by the other relevant individuals. However, there may be circumstances in which disclosure may enable the requestor to determine the identity of the person who has made the report, e.g. if a specific event is referred to. In these cases, we will consider our response carefully and will endeavour to balance the requestor's right under data protection law to receive their information against the confidentiality obligations we have towards the person making the report to us.
What choices do you have in relation to your information?
Under the legislation you have certain rights in relation to the information we hold about you:
When you submit information using the Report + Support tool, you consent to us using this for the purposes set out in this notice. At any time you may withdraw this consent and we will safely and securely delete the information that you have provided to us. For more information about withdrawing your consent and other choices you have in relation to your information, see our data protection pages at https://www.uws.ac.uk/about-uws/compliance/information-records-management/data-protection/.
It may also be necessary because the University has a legitimate interest in ensuring staff and students at the University are safe and receiving support for incidents and/ or concerns affecting them and to allow us to create a safe and supportive working and study environment.
We will not generally take steps such as investigating the report, initiating disciplinary proceedings or passing information to third parties in order to take the report further unless: (a) you have made a report with contact details and (b) you agree to this action. On rare occasions, the processing may be necessary to protect your vital interests or the vital interests of another individual. For example, because a report reveals a situation that needs the involvement of the emergency services or another external agency. Our Duty of Care and Confidentiality guidelines provide further information on this.
How long will we keep your information?
The information you provide will be retained in Report + Support for a period of two years following the end of the academic year in which the report is made. Where personal data initially collected via the Report + Support tool is then used in connection with a formal process, then the data will be retained in line with the standard retention period for that process. You can find further information about this in our record retention schedules.
We may retain some anonymised data from your report in order to monitor our work in this area but you will not be identifiable through this information.
Who has access to your information and who will we share your information with?
We will always make sure that when we share information about you that we do this in line with the legislation and that we only share the minimum amount of information that is needed.
Access to personal information submitted through Report + Support will be strictly limited to a small number of University staff in Student Services (for reports affecting UWS students) or People & Organisational Development (for reports relating to UWS employees). Where the University carries out a formal investigation following a report we may share limited data about the report with certain university employees, for example the Dean of the School or the Director of a professional services department. We will aim to notify you in advance of sharing data with these University employees.
Report + Support is a third-party platform that has been developed by Culture Shift and they host the reporting tool for us. The University will act as the Data Controller for the information you provide. We have an agreement in place with Culture Shift to make sure that they handle your data in line with our instructions and the data protection legislation. Culture Shift does not routinely have access to personal data contained in reports made using the Report + Support tool. However, there are times when it may be necessary for UWS to grant access to Culture Shift, for example, to investigate and remedy security incidents or to provide technical support to us. Such access will be coordinated on a case by case basis, and subject to strict controls.
There are certain circumstances where we may provide information about the matters raised in a report, including personal data, to third parties. This may include providing personal data about you without your consent. For example where there is a legal obligation to provide information in respect of a court case. There may also be times where we share information provided to us with the police or other social care services. Our duty of care guidance sets out how personal data may be shared in these circumstances.
Personal data included in a report may have to be disclosed by us in response to a Subject Access Request (SAR). This is where the individual who the data is about exercises their right under the law to request a copy of their personal data from us. A request may be made by the person submitted the report, the person to whom the complaint relates or by a third party referred to in a report. The University has policies and procedures in place to deal with these requests and will uphold its confidentiality obligations in respect of the report.
We are not obliged to comply with a request if this would mean disclosing information about another individual who can be identified from that information unless (1) the other individual has consented to that disclosure, or (ii) it is reasonable to comply with the request without the other individual’s consent.
Where possible, given the nature of the information in the reports, we will try to avoid disclosing personal information other than that of the individual who has submitted the request, unless explicit consent to the disclosure is given by the other relevant individuals. However, there may be circumstances in which disclosure may enable the requestor to determine the identity of the person who has made the report, e.g. if a specific event is referred to. In these cases, we will consider our response carefully and will endeavour to balance the requestor's right under data protection law to receive their information against the confidentiality obligations we have towards the person making the report to us.
What choices do you have in relation to your information?
Under the legislation you have certain rights in relation to the information we hold about you:
- To obtain access to, and copies of personal data we hold about you;
- To require us to stop processing your personal data if the processing is causing you damage or distress;
- To require us to stop sending you marketing communications;
- To require us to correct any personal data we hold about you that is incorrect;
- To require us to erase your personal data;
- To require us to restrict our data processing activities;
- To withdraw your consent to our data processing activities (without affecting the lawfulness of our processing before you withdrew your consent);
- To receive the personal data that we hold about you, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another controller; and
- To object, on grounds relating to your particular situation, to any of our particular
processing activities where you feel this has a disproportionate impact on your rights.
Many of the rights above are not absolute so there may be times when you make a request to us and we are unable to meet it in full but if this is the case we will explain to you fully why we have not been able to do what you have asked.
More detailed information about the rights you have and how you can make a request can be found at https://www.uws.ac.uk/about-uws/compliance/information-records-management/data-protection/
How will we keep your information safe?
As mentioned above Report + Support is a third party platform developed by Culture Shift. You can find out more about how your information is kept safe by them in here
In addition, the University will make sure that any staff who are accessing the information you have provided have received appropriate training about their data protection obligations and their duty to keep the information about you safe.
Will we transfer your information outside of the EEA?
The information you provide will not be transferred out of the EEA.
Who is the University’s Data Protection Officer?
The Head of Legal Services is the UWS Data Protection Officer. If you have any concerns about how we handle your personal data then you can contact the Data Protection Officer directly by e-mail dataprotection@uws.ac.uk or by post at Data Protection Officer, University of the West of Scotland, Legal Services, High Street, Paisley, PA1 2BE
How can I complain about your use of my information?
If you remain unhappy then you have a right to complain to the Information Commissioners Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
e-mail:casework@ico.org.uk and telephone 0303 123 1113
More detailed information about the rights you have and how you can make a request can be found at https://www.uws.ac.uk/about-uws/compliance/information-records-management/data-protection/
How will we keep your information safe?
As mentioned above Report + Support is a third party platform developed by Culture Shift. You can find out more about how your information is kept safe by them in here
In addition, the University will make sure that any staff who are accessing the information you have provided have received appropriate training about their data protection obligations and their duty to keep the information about you safe.
Will we transfer your information outside of the EEA?
The information you provide will not be transferred out of the EEA.
Who is the University’s Data Protection Officer?
The Head of Legal Services is the UWS Data Protection Officer. If you have any concerns about how we handle your personal data then you can contact the Data Protection Officer directly by e-mail dataprotection@uws.ac.uk or by post at Data Protection Officer, University of the West of Scotland, Legal Services, High Street, Paisley, PA1 2BE
How can I complain about your use of my information?
If you remain unhappy then you have a right to complain to the Information Commissioners Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
e-mail:casework@ico.org.uk and telephone 0303 123 1113