City St George's, University of London
Report and Support Privacy Notice – staff and student reporting platform 

Our contact details:
Name: City, St George's, University of London
Address: Northampton Square, London EC1V 0HB, United Kingdom
Phone Number: 020 7040 4000
 ______________________________________________________________________________________________________
Who we are?

This privacy notice explains how City St George's, University of London (“City St George's,” “we”, “us” or “our”) collects, uses and shares personal data collected on the Report and Support platform and your rights in relation to any of your personal data that City St George's holds.

This notice should be read alongside City St George's general privacy notice or the relevant student or staff privacy notices depending on the relationship you have with us. The student privacy notice can be found on the main City St George's website. The staff privacy notice can be found on the Staff Hub.

It is important that you read these notices before you complete a report. This is so that you are aware of what data we will collect and how and why we are using the information that you share with us in accordance with data protection law.
 
City is a data controller in terms of the DPA 2018 and the UK GDPR. City is registered with the Information Commissioner’s Office (ICO) with the registration number Z8947127.
  
Why do we process your personal information?

The information that you provide us with will let us know of any concern that you may have about your own or someone else’s safety and wellbeing, so that we can respond to your report and where appropriate act and provide support where needed.

How do we obtain your personal information?

Most of the personal information we process is provided to us directly by you for one of the following reasons: 
  • You have completed a report with personal details, which has included personal information. 
  • You have completed a report without personal details and have disclosed personal information in the free text box when making your report. 
We may also receive personal information indirectly, in the following scenario: 
  • If you have been named in a report, we may capture personal information related to you, even though you did not disclose it to us directly.

What information do we collect?

City St George's collects, stores and processes personal data that you choose to share with us via the Report and Support platform. This means that we will process any personal data disclosed within the report. You can refer to the ICO website for information on what constitutes personal data.

If you choose to make a report with personal details, we will also collect the following:
  • Your name
  • Your email address
  • Your telephone and/or mobile number 
  • Your gender if you choose to disclose it
  • Your department/team or School

We will also process special category data if it is included in your report. Special category data can be more sensitive in nature and therefore, requires a higher level of protection. 

The UK GDPR refers to the processing of this data as ‘special categories of personal data.’ This means personal data about an individual’s:
  • Race
  • Ethnic origin
  • Political opinions
  • Religious or philosophical belief
  • Trade union membership
  • Genetic data
  • Biometric data (where this is used for identification purposes)
  • Health data
  • Sex life; or
  • Sexual orientation

Personal data can include information relating to criminal convictions and offences. This also requires a higher level of protection.

How do we use the information that you share with us?

We will use the information that you have provided to us to: 

  • Act on reports if follow up action has been requested e.g., formal disciplinary procedures.
  • If requested, connect you with support services, which may include internal resources, such as counselling services, or Dignity and Respect Advisers. 
  • Monitor the frequency of different types of incidents and develop appropriate policies and interventions to minimise these types of incidents occurring in the future.

Report and Support System Administrators (staff and students reports) may share this information with: 

  • A member of City St George's staff, who has been assigned to provide support to the individual making the report. 
  • The relevant departments involved in the administration of formal or informal Staff or Student Disciplinary processes, under existing City St George's policies and procedures (for example and not exclusive to Bullying and Harassment, Sexual Misconduct or Grievance Procedures). 
  • The reported party, and any other witnesses named (if applicable), if non-conflict-based resolution or disciplinary action arises because of a report made.
  • Law enforcement, if a safeguarding risk or imminent danger to the reporting party, reported party or any other individual has been disclosed. 

How do we store and secure your personal information?

Your information is securely stored in Culture Shift’s servers through the Report and Support system. City St George's has full control of our data in the Report and Support reporting platform and case management system. Culture Shift does not have any access to data held on the platform. 

Any data received via a staff report will be stored within the Report + Support platform and will only be viewed by members of the HR Team who have been allocated to provide support to the individual who made the report. 

Any student data received via a student report, will be managed, and stored securely within the Report and Support safeguarding case management system. 

If formal or informal staff or student processes are initiated because of a report that has been submitted through Report and Support, staff from those teams may gain access to the details of the report on a need-to-know basis.

How long do we retain your information?

Staff reports will be retained for one year from receipt on the Report + Support system after which they will be archived.

Student reports will be archived six years from 'case' closure date.

Data will only be deleted from the platform and stored on City St George's systems when City St George's chooses to end the licence with Culture Shift.

What is our ‘legal basis for processing’?

Under the UK GDPR the lawful bases we rely on for processing your data are: 

  • Your consent - We rely on your consent in certain situations only, for example, if you would like your report shared with a third party for example, your `GP or a representative.
  • It is necessary for the performance of a task carried out in the public interest - Where City St George's may use data to undertake its official functions such as delivering research and educational services under its legislative powers. 
  • It is necessary for compliance with a legal obligation – This may be in relation to processing reported information that falls under the Universities Safeguarding and Prevent statutory duty.
  • It is necessary for the performance of a contract  - This may be the contract between City St George's and its employees, or the contract formed between City St George's and students under the Terms and Conditions of Study. 
  • It is necessary as we have a legitimate interest - This is where City St George's would consider if it has a legitimate interest to process your personal data. Reliance on this lawful basis requires a legitimate interests assessment, where the purpose and necessity of the personal data processing and any impact on individuals are considered.         
  • It is necessary in order to protect the vital interests of individuals - This will be in relation to any reports that raise concerns about significant risk to life or welfare, and where processing the information is necessary to protect the vital interests of the data subject or another person.

The personal information you provide to us will not be shared outside of HR/your School/Safeguarding & Welfare Team, without seeking your consent, unless there is an immediate risk to your life, or somebody else’s life that has been identified. Information will not be shared unless there is a clear and lawful justification to do so, and sharing will be restricted only to those who need to know the information and who are trained and understand their confidentiality obligations.

Data submitted and processed as part of the Report and Support reporting process will be treated as highly confidential by City St George's. This high level of confidentiality is to protect users of the reporting platform. Please refer to the Maintaining Confidentiality guidance for further information.
 
If you choose to submit a report without personal details, we will not attempt to take any steps to identify you. Data taken from reports without personal details will be used for internal reporting purposes only.
 
Your data protection rights?
 
Under data protection law, you have various rights relating to your personal data, including:
 
  • Your right to be informed - You have the right to be informed about the collection and use of your personal data. 
  • Your right of access - You have the right to ask us for a copy of your personal data and supplementary information. 
  • Your right of rectification - You have the right to ask us to rectify information you think is in accurate. You also have the right to ask us to complete information you think is incomplete.   
  • Your right to erasure - You have the right to ask us to erase your personal information if you withdraw your report and so there is no need to continue processing your data, or if you have objected to your data being processed through legitimate interests and there are no overriding legitimate interests to continue processing your data. 
  • Your right to restrict processing - You have the right to ask us to restrict the processing of your date if you are considering withdrawing your report or want to check the accuracy of your data before your report can continue. 
  • Your right to object to processing - You have the right to object to the processing of your personal information if your personal data is being processed through legitimate interests. 
  • Your right to data portability - Your right to data portability allows you to obtain and reuse your personal data for your own purposes.

  • Rights related to automated decision making including profiling. The UK GDPR has provisions on:
  • Automated individual decision-making (making a decision solely by automated means) and profiling (automated processing of personal data to elevate certain things about an individual). Profiling can be part of an automated decision-making process.      
  •          
Further information about your rights can be found on the ICO’s website.

Who can you contact if you have a concern?

If you have any questions or concerns about how City St George's handles your personal information, you can contact City’s Data Protection Officer via email at dataprotection@city.ac.uk.

You also have a right to complain to the ICO using the contact details below: 

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire.
SK9 5AF

Helpline number: 0303 123 1113 

ICO website: https://www.ico.org.uk

There are two ways you can tell us what happened

Report with personal details or Report without personal details