Privacy Notice: How your personal data is handled within Report + Support
This form is used to collect information from you regarding incidents and/or concerns.
The University of Surrey is registered as a controller with the Information Commissioner’s Office (our notification number is Z6346945) and we are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. We have a named Data Protection Officer, who can be contacted via dataprotection@surrey.ac.uk.
One of our responsibilities is to tell you about the different ways we collect and use your personal data. This statement provides details about these uses. In addition to this statement, you may be given further information about the uses of your personal data when you use certain services offered by the University of Surrey.
What information do we collect from you?
You have the option to give as much or as little information as you want in response to the questions asked in this form.
Why do we collect this information?
The University collects only the data we need and we keep the data up to date and only for as long as it is needed.
We collect your personal data in order to…
- Helping us to identify the best person for you to speak to in relation to your report;
- Providing the person with your contact details (if you have provided them) and some useful background information that will enable them to understand the nature of your concern or the incident you are reporting;
- Where applicable, reviewing your report and taking further action if required. For example, an investigation could lead to us carrying out student disciplinary action. You can read more about this on the webpage for the Office of Student Complaints, Appeals and Regulation at www.surrey.ac.uk/oscar. We will always talk to you to discuss your report before taking any formal action.
We will write to you to keep you informed about what we are doing.
- Once we have concluded any actions we have taken, we will write to you to inform you of the outcome.
- Monitoring patterns or trends in data that will be used to inform our proactive and preventative work.
When reporting anonymously, we will not ask you for any personal identifiable details. We will not be able to offer direct advice or take any action on the report.
We will keep an anonymised record of your report to identify whether there have been/are other similar reports and whether there is a pattern of behaviour or trends that should be addressed.
We collect this information because the University has a legitimate interest in ensuring staff and students at the University are safe and receive support for incidents and/or concerns affecting them.
The University’s legitimate interest is determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data.
You may disclose data considered to be special category data (data revealing health or wellbeing, racial or ethnic origin, political opinions, religious or philosophical beliefs) in this form. When you do this, we process your data with your consent, which we capture at the end of the form.
What do we do with your information?
The University processes personal data and special category data in accordance with data protection legislation and its own Data Protection Policy.
Access to the data you give is limited to six members of University staff who complete an initial triage step (two HR staff, two staff from OSCAR and two staff from Campus Safety).
Following an initial triaging, OSCAR will normally review data relating to student complaints; HR will normally review data relating to staff complaints. Anonymised data is also used to identify any worrying themes or trends to enable the University to respond to these and formulate preventative action.
How long do we keep your information?
We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for 6 months where no action is taken and for 15 months where action is taken in case you wish to ask questions or appeal the decision. After then, we will delete what personal data you have provided. We may retain some information in order to monitor our work in this area but you will not be identifiable from this information.
Who do we share your information with?
Your identity and your other personal data will be disclosed within the University of Surrey on a need to know basis only and will not be disclosed to any third parties without your consent unless there are legitimate reasons requiring us to do so, for example, where the information you have provided highlights a potential risk to a person’s health and safety.
What rights do you have in relation to the way we process your data?
As an individual whose data we process (a data subject), you have certain rights in relation to the processing. You can find detailed information about your rights as a data subject on the University’s webpage.
You have the right to:
- Withdraw your consent for us to process your personal data
- To ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.
- Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete
- To have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the data subject rights information on the University’s webpage
- To restrict the processing of your personal data in certain ways
- To obtain your personal data for reuse
- To object to certain processing of your personal data
To exercise any of these rights, please contact dataprotection@surrey.ac.uk.
You also have the right to complain independently to the Information Commissioner’s Office about the way in which we process your personal data, if you are not satisfied with our response to your concerns.
You also have the right to complain independently to the Information Commissioner’s Office about the way in which we process your personal data, if you are not satisfied with our response to your concerns.