Privacy Notice

 

This privacy notice describes how personal data is used in the context of the Report + Support tool at the University of Cambridge. It supplements the University’s wider privacy notices for University students and staff, which should be read in conjunction with it.

 

The Report + Support tool provides students with a portal to report and/or seek support in respect of inappropriate behaviours of other students and staff.

 

When an individual makes a report, their name and contact details are collected, in addition to names or other information provided by them that identify third parties. Reports are assessed securely by a small group of authorised staff within the Office of Student Conduct, Complaints & Appeals who have been trained and granted access to the Report + Support tool. Where appropriate, and normally following consultation with the person making the report, reports may be shared with relevant colleagues where necessary (e.g. HR School Team, Colleges, Department or Faculty colleagues etc.). On rare occasions, where there might be for example a threat to the individual or another person’s safety, or where there is evidence of potential criminal behaviour, the University may need to take action immediately, without the consent of the person making the report. 

 

If a report is made, we will use, store, and share different kinds of personal data about the person making the report as well as any other individuals named or otherwise identifiable within it. This will include basic details (e.g. name, contact details, department), demographic information (which the person making the report may choose not to provide), and details about the issue/incident/concern being reported.  This may involve the collection and use of some special categories of personal data, such as information about the health, ethnicity or political beliefs of the person making the report or other individuals named within it. 

 

The main purposes for which we process personal data in respect of reports are as follows: 

Under data protection legislation, we are required to have a legal basis for personal data processing for the above purposes.  The legal bases we rely upon are as follows: that individuals have consented to the processing; that the processing is necessary for the performance of our contractual obligations to students or staff; or that the processing is required to meet legal obligations (e.g., under health and safety legislation) or forms part of our wider public interest tasks and legitimate interests in creating a safe and supportive study and working environment.  On rare occasions the processing may be necessary to protect someone’s vital interests (e.g., if a report revealed a situation requiring the involvement of the emergency services or other external authorities).  For special categories of personal data (e.g., information about health or ethnicity) we rely either on explicit consent, or on the need to meet specific employment law obligations, or on various data processing conditions in the substantial public interest (e.g. about safeguarding, counselling, or the prevention of criminal behaviour).
 
Data sharing with external organisations
In the context of the Report + Support tool, it may occasionally be necessary to share personal data with our third-party service provider, Culture Shift, such as to investigate and remediate security incidents or to provide technical support.  Such access will be coordinated on a case-by-case basis and subject to strict controls. Culture Shift staff do not routinely have access to personal data contained in reports submitted via the Report + Support tool. 
There may also be circumstances in which we may share personal data on a considered basis where we are permitted or required by law to do so, such as with your College or a simultaneous employer or (should it ever be relevant and necessary to do so) funding bodies, the police, the court system, other service providers to the University (e.g. auditors). This is most likely to happen in circumstances where there is a safeguarding concern and/or where providing information to third parties is required under or consistent with our duty of care. While not envisaged, such sharing in theory may involve the transfer of personal data outside the UK/EU – should this ever be the case, we will put safeguards in place to ensure that the data is secured appropriately following that transfer.

Data storage and retention
At all times we will handle personal data collected via the Report + Support tool confidentially and securely.  We will retain and use it only for as long as necessary to meet the purposes listed above, including to satisfy any formal regulatory or legal requirements.  In general, we will keep records of all reports for three years following the closure of the case on the Report + Support tool.  Personal data collected initially via the Report + Support tool but then used in connection with formal University procedures will be retained in accordance with the standard periods for such procedures set out in the University’s records management documentation. Anonymised information in connection with the Report + Support tool may be retained for longer to monitor and assess our work in this area.

Your data protection rights
Under data protection legislation you have the right to access the personal information that is held about you, to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, or to object to processing or to receive an electronic copy of the personal information you provided to us.  Please note that all of these rights are qualified in various ways.  More information about exercising these rights is included in the wider privacy notices for students and staff referred to at the start of this notice.

Questions and complaints
If you have any questions about the information in this notice, please contact ReportandSupport@admin.cam.ac.uk in the first instance.  The wider privacy notices referred to at the start of this notice contain further details about the formal routes of internal and external complaint on data protection matters.

Changes to this notice
This notice was last updated on 3 June 2021. We keep it under regular review to make sure it remains up-to-date and accurate, and all changes are published here.