Privacy Notice

This privacy notice describes how personal data is used in the context of the Report + Support platform at Swansea University. It supplements the University’s wider privacy notice for University students, which should be read in conjunction.

Swansea University is the Data Controller, as we determine the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. This means that we are legally responsible for the personal data we collect and hold about you. 

The Report and Support platform at Swansea University provides students with a portal to report and seek support in respect of issues of inappropriate behaviour.

Reports may be either:

(a) anonymous, whereby no names or other information that could identify the individual making the report are provided. Swansea University acknowledges that there may be circumstances when the reporting party, may provide certain details, that could identify a third party, such as a name. If Swansea University receives a report that identifies individuals other than the reporting party, a risk assessment will be conducted to determine whether those persons(s) should be contacted, or action taken; or 

(b) named, whereby the names and contact details of the individual making the report are included. 

Further details on the data collected and how we will use that data in each of the above circumstances is set out below.

If an anonymous report is made, the Report and Support platform is designed to anonymise the identity of the person who has made the report. However, if such information is shared, Swansea University will use that information to review and process the report. 

If a named report is made, we will use, store, and share different kinds of personal data including some special categories about the person making the report as well as any other individuals named or otherwise identifiable within it. This may include basic details (e.g. name, contact details, department), demographic information (which the person making the report may choose not to provide), and details about the matter being reported.  

We will also process any third party information provided.

The main purposes for which we process personal data in respect of reports are as follows: 

Under data protection legislation, we are required to have a legal basis for personal data processing for the above purposes.  

We process your personal data, including any special categories of personal data, based on your consent, which you give by submitting the report. You have the right to withdraw your consent if you wish to do so. However, if the University deem the information provided pertinent to ensure safeguarding, it may still be used but would be anonymised, removing all content that could identify the reporting person.

In some circumstances, we may also process personal data where the processing is necessary for the performance of our contractual obligations to students; or that the processing is required to meet legal obligations (e.g., under health and safety legislation) or forms part of our wider public interest tasks and legitimate interests in creating a safe and supportive study environment.  On rare occasions the processing may be necessary to protect someone’s vital interests (e.g., if a report revealed a situation requiring the involvement of the emergency services or other external authorities).  For special categories of personal data (e.g., information about health or ethnicity) we rely either on explicit consent, or on various data processing conditions in the substantial public interest (e.g., safeguarding, counselling, or the prevention of criminal behaviour).

At all times we will handle personal data collected via the Report + Support platform confidentially and securely.  In line with GDPR legislation Swansea University will retain personal data from R+S for as long as is necessary. Retention will be assessed on a case-by-case basis and will vary according to various factors such as: 

(a) the date on which the report was made.

(b) the conclusion of any investigation and subsequent disciplinary action by Swansea University; or

(c) live criminal investigations and prosecutions.

All cases will be subject to an annual review and will remain active/closed/archived accordingly. 

Anonymised information in connection with the Report + Support platform may be retained for longer to monitor and assess our work in this area.

Third parties with whom we may share your personal data include: -

In the context of the Report and Support platform, we will share your data with third party service providers that help us provide the platform, such as Culture Shift. This enables us to make the Report and Support platform available to you. Please see Culture Shift’s Knowledge Base for further information on the security measures adopted by Culture Shift, which are designed to help keep personal data secure. 

There may be circumstances when we may share personal data on a considered basis where we are permitted or required by law to do so. This is most likely to happen in circumstances where there is a safeguarding concern. 

While not envisaged, data sharing may involve the transfer of personal data outside the UK/EU – should this ever be the case, we will put safeguards in place to ensure that the data is secured appropriately.

Data protection legislation provides individuals with a number of different rights in relation to their data. For further information regarding your rights please see: https://www.swansea.ac.uk/about-us/compliance/data-protection/your-rights/  

If you are unhappy with the way in which your personal information has been processed, you may in the first instance contact the University Data Protection Officer at dataprotection@swansea.ac.uk.

If you remain dissatisfied, then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: -

Information Commissioner’s Office,

Wycliffe House,

Water Lane,

Wilmslow,

Cheshire,

SK9 5AF