Overview
The University (“we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data.
Please read this Privacy Notice carefully, as it describes how and why we collect and use personal data obtained through Report and Support, and provides you with information about your rights.
This Privacy Notice applies to personal data provided through Report and Support by individuals themselves or third parties, and should be read alongside the University’s wider general privacy notice.
For the purposes of this privacy notice, University of York is the Data Controller as defined in the General Data Protection Regulation. We are registered with the Information Commissioner’s Office and our entry can be found here. Our registration number is: Z4855807.
What is “personal data”?
“Personal data” means any information which is about or identifies an individual. It may include a name, but also information such as date of birth, nationality and gender, which, when combined, identify an individual.
It does not include information which does not relate to an identified or identifiable individual, or to personal data rendered anonymous in such a manner that the individual is not, or is no longer, identifiable.
“Sensitive personal data” or “special category of personal data” such as information about racial or ethnic origin, political opinions, religious beliefs or other similar beliefs, trade union membership, physical or mental health and sexual life, are given a high level of protection under data protection law. Personal data relating to criminal convictions and offences are also treated as requiring additional protections.
The University's data protection obligations
Under data protection laws, the University of York is a controller, as we determine the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. This means that we are legally responsible for the personal data we collect and hold.
One of our responsibilities is to tell individuals about the different ways in which we use personal data – what information we collect (and our legal basis for doing so), why we collect it, where we collect it from and whether (and with whom) we will share it. We also need to tell people about their rights in relation to the information we hold about them. This notice provides further details about all of these issues in respect of the Report and Support tool.
About the Report and Support tool at the University of York
The Report and Support tool at the University of York provides a means to make a report and also seek support in respect of issues including harassment and sexual misconduct.
Reports may be made (a) on an anonymous basis, whereby no names or other information that could be used to identify the individual making the report or a third party are provided; or (b) including names and contact details.
Further detail on the data collected and how we will use that data in each of the above circumstances is set out below.
Please note that where you make a report through the Report and Support tool, the University will usually disclose information to a limited number of relevant staff members on a need to know basis only. We will not generally take steps such as investigating the report, initiating disciplinary proceedings or passing information on to third parties in order to take the report further unless: (a) you have made a named report; and (b) you agree to this action.
However, there are certain circumstances in which the University may take steps such as those listed above even where: (a) an anonymous report is received (in which case action will be taken on a 'no names' basis); or (b) you have made a named report but you do not wish to take your report further.This is usually where there are concerns for your safety or another person’s safety. Please see our Duty of Care Guidance and Confidentiality Guidance for further information on this point.
How we process the report you submit
Anonymous reports
If you choose to make an anonymous report, the Report and Support tool is set up so that we do not know who has made the report and you will be instructed as part of the tool when making your report not to provide any personal data such as names or contact details relating to you or to any third parties. This means that anonymous reports should not include any information that could be reasonably used by us to identify someone.
Named reports
If you choose to make a named (rather than an anonymous report), we may collect, use, store and transfer different kinds of personal data about you.
This may include:
This may include:
- Your name, contact details and other information about you (e.g. your department, age);
- ‘Special category’ personal data about you (e.g. your health, race or ethnicity, sexual orientation, etc.); and
- Detail regarding your experience of the issue you are reporting and its effect on you.
We will also process the names and other details about third parties who are involved in the issues you have chosen to report.
Purposes for which we process your personal data and the legal basis for processing
The main purposes for which we process your personal data when you make a named report are set out in more detail below.
Data protection laws require us to meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "legal basis" for the processing. Where we process special category personal data or criminal convictions information, we are required to establish an additional legal basis for processing that data. We take our responsibilities under data protection laws extremely seriously, including meeting these conditions.
The University needs to review and process reports submitted through Report and Support as described in this privacy notice and keep records of the actions it takes in relation to any person identified.
Typically, data will be processed:
- on the grounds of contractual requirements with students and staff and any applicable regulations;
- because it is necessary for the performance of a task carried out in the public interest (for information on our public task see our function as set out in our charter which can be found here);
- because you have given us your consent or, in the case of special category data, your explicit consent.
- to allow us to comply with our legal obligations;
- to protect your or another person’s vital interests;
- to monitor equality and diversity;
Third parties with whom we may share details from your report
This section applies to both anonymous and named reports.
Third party service providers
The Report and Support tool is provided by Culture Shift who process the data you submit on behalf of the University. Details of their privacy policy can be found here: https://www.culture-shift.co.uk/privacy-notice.html.
The police/social care services/local authorities/other similar bodies
There are certain circumstances in which the University may provide information about the matters raised in a report, including personal data, to third parties such as the police and social care services. This may include providing personal data about you without your prior knowledge or consent.
These circumstances include:
These circumstances include:
- An allegation about behaviour by a staff member or student towards a student who is under the age of 18;
- An allegation about behaviour by a staff member or student towards an adult at risk;
- An allegation about behaviour by a staff member or student towards another staff member or student over the age of 18; or
- An allegation about behaviour by a staff member or student towards anyone else who is under the age of 18;
Courts
In the event that a report results in legal proceedings being issued, the University may share personal data with the relevant courts.
Further information
Note that the list of third parties in this section is not exhaustive – data may also be shared in accordance with the privacy policies listed at section 1 above, as applicable.
Please see our separate Duty of Care Guidance for further information on the third parties with whom information may be shared in the above circumstances, including the police and/or social care services (as appropriate).
Please also see the Confidentiality Guidance for further information on the circumstances in which the University may be required to share your information with third parties.
Transfers outside the European Economic Area
In certain circumstances, it is necessary to transfer your Personal Data (including Special Category Data) outside the European Economic Area. In respect of such transfers, the University will comply with our obligations under Data Protection Law and ensure an adequate level of protection for all transferred data.
Information security
The University takes information security extremely seriously and has implemented appropriate technical and organisational measures to protect personal data and special category data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information see, https://www.york.ac.uk/it-services/security/.
Retention periods
The University will retain your data in line with legal requirements or where there is a business need. Retention time frames will be determined in line with the University’s Records Retention Schedule.
We may retain some anonymised information in order to monitor our work in this area but you will not be identifiable from this information.
Your rights
Under the General Data Protection Regulation, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw consent. For more information, see https://www.york.ac.uk/records-management/generaldataprotectionregulation/individualsrights/.
If you are a student, you can verify or correct information in your student record at any time by following the guidance here, https://www.york.ac.uk/students/studying/manage/student-record/.
Automated processing
The University of York does not use automated processing and decision making without manual intervention. This includes in relation to data received in the context of the Report and Support tool.
Who do I contact about the use of my personal information?
If you have any questions about this privacy notice or concerns about how your data is being processed, please contact the University’s Data Protection Officer at dataprotection@york.ac.uk.
If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns.