About this privacy notice
Aberystwyth University (“we” “us”, or “our”) respects your privacy and is committed to protecting your personal data.
Please read this privacy notice carefully – it describes why and how we collect and use personal data when you engage with the Report + Support tool, and provides information about your rights.
This privacy notice applies to personal data provided to us by individuals themselves, or by third parties, and supplements the wider student privacy notice.
What is 'personal data'?
'Personal data' means any information which identifies you as an individual. It may include your name, but it may also be other information such as your date of birth, nationality, and gender which, when combined, identify you.
It does not include information which does not relate to an identified or identifiable individual, or to personal data that has been anonymised so that the individual is no longer identifiable.
'Special category data' is personal data that is granted more protection under data protection law because it is sensitive. This includes information about racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health, sexual life, and sexual orientation.
Personal data relating to criminal convictions and offences are also treated as requiring additional protections.
It does not include information which does not relate to an identified or identifiable individual, or to personal data that has been anonymised so that the individual is no longer identifiable.
'Special category data' is personal data that is granted more protection under data protection law because it is sensitive. This includes information about racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health, sexual life, and sexual orientation.
Personal data relating to criminal convictions and offences are also treated as requiring additional protections.
Purpose – why do we collect personal data?
If you use Report + Support to report an incident experienced or witnessed by you in relation to, for example, hate crime, racism, or gender-based violence, we may collect personal data about you.
The primary purpose of Report + Support is to enable our students and staff to access support.
You have two options on how you can submit a report – a named report with your contact details or an anonymous report. In a named report, we are in a better position to respond to the incident and offer you support. In an anonymous report, where you have chosen not to provide us with your name and contact details, we are unable to directly support you in relation to the incident.
We may use information provided in reports for monitoring trends or patterns to inform our proactive and preventative work, and to help inform our decision-making, for example, policy or procedure change or development.
What is our legal basis for processing personal data?
Data protection laws require us to meet certain conditions before we are allowed to collect or use your personal data as described in this notice, including having a "legal basis" for the processing. Where we process special category personal data, we are required to establish an additional condition for processing that data.
The main legal basis on which your personal data are normally processed in relation to the Report + Support tool are explained below.
The main legal basis on which your personal data are normally processed in relation to the Report + Support tool are explained below.
For all personal data
Legitimate interests We process this information because the University has a legitimate interest in ensuring staff and students and the wider community are safe and receive support for incidents or concerns affecting them.
The University’s legitimate interest is determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data.
Performance of a contract Where a report is made by or about a member of staff or student, we may process personal data to fulfil our obligations under our contract with that staff member or student.
Legal obligation It may be necessary for us to process your personal data, in the context of Report + Support, for us to comply with statutory obligations under the Equality Act 2010 or other legislation, or to satisfy other legal or regulatory requirements. We also consider that processing personal data in the context of the Report + Support tool is necessary for the University to comply with its common law duty of care for the health, safety and wellbeing of its staff and students.
For special category data
Equality of opportunity or treatment We process certain types of special category data to monitor equality of opportunity/treatment.
Employment law obligations We may also process certain special category data where this is necessary so that we can meet our obligations in the field of employment law.
Statutory and government purposes We may process special category data to fulfil our duties under the Equality Act 2010.
Safeguarding of children and of individuals at risk We may process special category data to safeguard children or individuals at risk.
Preventing or detecting unlawful acts We may process special category data to prevent or detect an unlawful act.
Establishment, exercise or defence of legal claims It may be necessary to process your special category personal data in relation to establishing, exercising, or defending legal claims.
Consent Where you have made a report and we cannot rely upon any other appropriate legal basis, we will normally seek your consent to the processing of your special category personal data when reviewing and processing that report and sharing your special category data.
What do we collect?
The only information we collect about you is the information you have chosen to share with us when you submit a report via Report + Support. There are two ways of making a report:
Anonymous reports
Whereby no names or other information that could be used to identify the individual making the report are provided. If the report includes names or other information that could be used to identify a third party, we will use that information to review and process the report.
Whereby no names or other information that could be used to identify the individual making the report are provided. If the report includes names or other information that could be used to identify a third party, we will use that information to review and process the report.
Named reports
Whereby the names and contact details of the individual making the report are included, in addition to names or other information which could be used to identify third parties.
In a named report, we may collect, use, store and transfer various kinds of personal data about the person making the report. This may include:
- Your name, contact details and other information about you such as your department (where applicable) and your age;
- ‘Special category’ personal data about you (this may include details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health etc.); and
- The nature (e.g., hate crime) and detail (e.g., location, time) of the incident
Information relating to an individual’s criminal convictions or past offences (including alleged offences) must not be included in any report. If it is included, then we will delete this information before the report is progressed
Who might we share it with?
Within the University
Your identity and any other personal data you provide will be treated confidentially and will only be shared with relevant staff of a need-to-know-basis.
Outside the University
The University will not share your personal data without your consent unless there are legitimate reasons requiring us to do so, such as where the information you have provided indicates a risk to your, or someone else’s, health and safety.
In these circumstances, we may share your personal data with the police, the NHS, social care services or other similar bodies.
Third party service provider
The Report + Support tool is hosted by a company called Culture Shift. Culture Shift have limited access to some information, but not full reports, on the tool as part of their provision of services.
Transfers outside the EEA
We will not share your personal information outside of the European Economic Area.
How do we look after your information and how long do we keep it for?
Only a limited number of University staff, where it is relevant to their role, have access to reports submitted through the Report + Support tool.
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
All reports will be held securely on the Report + Support tool for 12 months following the end of the academic year in which the report is submitted. Any personal data is then removed, and the report archived. Archived reports are held on the Report + Support tool for three years and then they are deleted.
We may retain some anonymised information to allow us to monitor our work in this area, but no-one will be identifiable from this information.
Your rights
Under data protection legislation you have certain rights in relation to how the University manages and uses your personal information:
- The right to be informed (this is the Privacy Notice)
- The right to access your personal data
- The right to rectification if the personal data we hold about you is incorrect
- The right to restrict processing of your personal data
In addition, the following rights apply only in certain circumstances:
- The right to withdraw consent at any time (if consent is our legal basis for processing your data)
- The right to object to our processing of your personal data
- The right to request erasure (deletion) of your personal data
- The right to data portability
- The right not to be subject to automated decision-making including profiling.
Complaints or concerns
If you have any issues about this notice or the way the University has handled your personal information, please contact our Data Protection Officer in the first instance: infogovernance@aber.ac.uk