University of Nottingham Report + Support Privacy Notice 
 
1.     About this privacy notice 
2.     What is 'personal data'? 
3.     UoN's data protection obligations 
4.     About the Report and Support tool at UoN 
5.     Personal data we collect about you 
6.     Purposes for which we process your personal data and the legal basis for processing 
7.     Third parties with whom we may share your personal data 
8.     Transfers outside the UK/European Economic Are 
9.     Information security 
10.  Retention periods 
11.  Your rights 
12.  Automated processing 
13.  Who regulates the use of my personal information? 
14.  Who do I contact with questions? 
 
1.     About this privacy notice 
 
The University of Nottingham (“UoN”, “we” “us”, or “our”) respects your privacy and is committed to protecting your personal data. 
 
Please read this notice carefully – it describes why and how we collect and use personal data in the context of the Report and Support tool and provides information about your rights under data protection laws. 
 
This privacy notice applies to personal data provided to us either by the individuals themselves or by third parties in the context of the Report and Support tool. It should be read in conjunction with the following documents: 
 
 
We keep this privacy notice under regular review. We may withdraw or modify this notice at any time, and we may supplement or amend it by reference to additional policies and guidelines from time to time. Any changes we make to this privacy notice in the future will be posted to this website and on the University’s main Privacy Notices at https://www.nottingham.ac.uk/utilities/privacy/privacy.aspx 
 
This privacy notice was created on 08/04/2021. 
 
2.     What is 'personal data'?  
 
Legally, ‘personal data’ is defined as “any information relating to an identified or identifiable natural person”. 
 
Personal data therefore includes any information, in recorded form, from which it is possible to identify you as an individual and which ‘relates’ to you as an individual; that is, it is information which allows you to be distinguished from other individuals and allows UoN or a third party to record or learn something about you as an individual or where our or a third party’s use of that information impacts on you as an individual (e.g. it allows us or a third party to make decisions about you). In most cases, the same pieces of information both identify you and relate to you e.g. your name, date of birth and gender identity, can both distinguish you from other individuals and tells us/allows us to record something about you as an individual. 
 
Personal data includes information that directly identifies you, including, not only your name, but also other factors relating to you (such as your date of birth, nationality and gender identity) that, either alone or in combination, can be used to identify you as an individual. 
 
Personal data also includes information from which you can be indirectly identified. This means that information we hold, but which, by itself, may not be sufficient to directly identify you as an individual, will be personal data when that information can be combined with other available information and you become indirectly identifiable from the combination of information and that combination of information ‘relates’ to you (e.g. tells us or a third party something more about you). This ‘other available information’ could be information UoN or a third party already holds about you, or information available to us or a third party from other sources (e.g. publicly available information on the internet or information based on background knowledge). 
 
Personal data also includes ‘online identifiers’ – i.e. information provided by individuals’ devices, applications, tools or protocols, such as internet protocol (IP) addresses, cookie identifiers and MAC addresses. In addition to the more technical information relating to devices, etc, online identifiers also include things such as social media account handles and usernames. 
 
Personal data does not include information which does not relate to an identified or identifiable individual, or to personal data rendered anonymous in such a manner that the individual is not or no longer identifiable. 
 
 ‘Special categories of personal data', such as information about racial or ethnic origin, political opinions, religious beliefs or philosophical beliefs, trade union membership, physical or mental health, sex life and sexual orientation, are given a high level of protection under data protection law. This is because, in addition to data falling within these categories being seen as inherently sensitive or private in many cases (e.g. data concerning someone’s health or sex life), data within these categories are closely linked with individuals’ other fundamental rights and freedoms, such as: freedom of thought, conscience and religion; freedom of assembly and association; the right to bodily integrity; the right to respect for private and family life; and freedom from discrimination. 
 
Personal data relating to criminal convictions and offences are also treated as requiring additional protections. 
 
3.     UON's Data Protection Obligations 
 
UON is a controller of personal data, as defined in the General Data Protection Regulation (GDPR), because it chooses how and why it collects and processes personal data of staff, students, research participants, alumni, visitors and other individuals. This means that we are legally responsible for the personal data we collect and hold about you in the context of the Report and Support tool at UoN. 
 
 
One of our responsibilities as a controller is to tell you about the different ways in which we use your personal data – what information we collect (and our lawful basis for doing so), why we collect it, where we collect it from and whether (and with whom) we will share it. We also need to tell you about your rights in relation to the information. This privacy notice provides further details about all of these issues in respect of the Report and Support tool at UoN. 
 
 
4.     About the Report and Support tool at UoN 
 
The Report and Support tool at UoN provides students, staff (including employees, secondees, consultants, contractors, and agency and casual workers), alumni, and third parties within UoN’s reasonable control (such as suppliers or visitors to our premises) with a portal to report and also seek support in respect of issues of bullying, harassment, victimisation, abuse, assault, sexual misconduct, domestic violence, and other forms of unacceptable or threatening behaviour. 
 
Reports made by users of the Report and Support tool at UoN may be either: 
 
(a) Anonymous: whereby no names or other information that could be used to identify the individual making the report are provided. UoN encourages individuals making an anonymous report not to include names or other information that could be used to identify a third party (such as the alleged perpetrator or witnesses). Nevertheless, we acknowledge that there may be circumstances in which it is appropriate to make an anonymous report containing such information; or 
 
(b) Named (i.e. reporting with contact details): whereby the names and contact details of the individual making the report are included, in addition to names or other information which could be used to identify third parties. 
 
Further detail on the data collected and how we will use that data in each of the above circumstances is set out below. 
 
Please note that where you make a report through the Report and Support tool, UoN will usually only disclose information to its staff members and only on a ‘need to know’ basis. We will not generally take steps such as investigating the complaint, initiating disciplinary or other formal proceedings (including litigation) or passing information on to third parties in order to take the report further unless: (a) you have made a named report; and (b) you agree to this action. 
 
However, there are certain circumstances in which UoN may take steps such as those listed above even where an anonymous report is received (in which case action will be taken on a 'no names' basis); or you have made a named report but you do not wish to take your report further. This is usually where there are concerns for your safety or another person’s safety or where a criminal act or other seriously improper conduct is alleged to have taken place (or may be about to take place). Please see section 7 below for further information on this point. 
 
Please also note that information relating to an individual's criminal convictions or past offences (including alleged offences) must not be included in any report. Any criminal convictions information or information relating to past offences/alleged offences included in a report will be removed before the report is processed. 
 
 
5.     Personal data that we collect about you 
 
Anonymous reports 
 
If an anonymous report is made, the Report and Support tool is set up so that we do not know who has made the report. UoN encourages any individual who wishes to make an anonymous report not to include names or other information that could be used to identify themselves or a third party. 
 
Please note that if a member of staff, a student or other individual is named and/or identifiable within the report, their name and/or other identifiable information will be stored on the system in line with the UoN Records Retention Schedule and in most instances, no action will be taken. The only exception to this is where an alleged perpetrator is identified in an anonymous report and the incident or pattern of behaviour reported gives rise to a safeguarding risk in accordance with our Safeguarding Policy
 
The main benefit to UoN of the anonymous reporting route is that it enables the data collected via this route to be analysed for the purposes of identifying patterns of various types of unacceptable behaviour across our institution. This allows us to target our efforts and resources effectively with a view to eliminating such behaviour. 
 
The main benefit to individuals of the anonymous report route is that it allows the privacy of the individual making the report (and others who would otherwise be identified) to be maintained, while at the same time, assisting UoN to reduce the type of behaviour complained of, with a view to reducing the likelihood of such behaviour continuing or recurring. 
 
Please note, while reasonable efforts have been made to avoid individuals being identifiable via the anonymous reporting route, there is a possibility that certain information or combinations of information that you provide by this route my lead to you be directly or indirectly identifiable. 
 
Named reports 
 
If a named rather than an anonymous report is made, we may collect, use, store and transfer different kinds of personal data about the person making the report. This may include:
 
  • Your name, contact details and other basic information about you, such as your gender, your age, your department (where applicable) and/or staff or student ID number (where applicable); 
  • ‘Special categories of personal data’ about you. This may include information revealing your race or ethnicity, political opinions, religious or philosophical beliefs, or trade/student union membership, as well as information concerning your health, sex life and/or sexual orientation; 
  • Details concerning your experience of bullying, harassment, victimisation, abuse, assault, sexual misconduct, domestic violence, or other form of unacceptable or threatening behaviour; and 
  •  Other information that is otherwise highly sensitive or private, to the extent such information is relevant to the report, but strictly excluding information relating to any individual's criminal convictions or past offences, including alleged offences (as stated above, the only processing of any criminal convictions or past offences information that will take place will be the removal of such information from the report, prior to it being further processed). 
 
We will also process the names or other identifiable information of other individuals who are involved in the issues reported (such as the alleged perpetrator, witnesses or other members of staff or students), together with other information falling within some or all of above the categories that relates those individuals. 
 
The information referred to above may be collected by us at the point of reporting and/or may be inputted during the processing of a report by one of the Report and Support system administrators at UoN (who will be members of UoN’s Campus Life or HR team) or by a member of UoN staff in one of the specified ‘Advisor’ roles to whom a case may be assigned. 
 
6.     Purposes for which we process your personal data and the lawful basis for processing 
 
The main purposes for which we process your personal data in respect of both named reports and, where applicable, anonymous reports are set out in further detail below. 
 
Data protection laws require us to meet certain conditions before we are allowed to use your personal data in the manner described in this notice, including having a "lawful basis" for the processing. Where we process special categories of personal data, we are required to establish that we can meet an additional legal condition for processing that data. 
 
We take our responsibilities under data protection laws extremely seriously, including meeting these requirements. The main lawful basis and legal conditions on which your personal data are generally processed in relation to the Report and Support tool are also explained below. 
 
Relevant Data Processing Activities: 
 
A non-exhaustive list of the processing activities, in respect of personal data, that may take place in the context of the Report and Support tool at UoN includes the following: 
 
  • Reviewing and processing a report submitted via the Report and Support tool, including creating a case report file and undertaking a ‘safeguarding check’ 
  • Contacting an individual in relation to their named report – for example, to advise on next steps or in order to obtain additional necessary information. 
  • Inputting any further information received into a case report file. 
  • Recording, securely storing and retrieving personal data in the case report file throughout the reporting process. 
  • Consulting the information contained in a case report file throughout the reporting process and using that information to make decisions about next steps to be taken and/or advice to be provided in relation to a given case.
  • Sharing your personal data with members of UoN staff on a need to know basis – for example, relevant staff in HR and/or Student Support Services/Registry – for the purposes of initiating informal or formal HR or Student Support/Registry processes under existing UoN policies and procedures on bullying and harassment, student cause for concern, grievances (staff), student complaints (students), etc. 
  • Where appropriate, sharing your personal data with third party controllers. 
  • Anonymising and aggregating personal data contained in reports so that analysis of trends of unacceptable behaviour can take place 
  • Retaining personal data contained in a case report file for the applicable retention period (see section 10 below), following case closure. 
  • Securely deleting and destroying personal data at the end of the applicable retention period, unless limited further retention, storage and/or use is justified in a given case (e.g. for evidence in ongoing legal proceedings). 
 
Lawful basis relied on for processing activities (for all personal data): 
 
(i) Performance of a task carried out in the public interest or in the exercise of official authority vested in UoN 
 
UON’s Royal Charter empowers us to perform certain functions to operate as a higher education institution. UON processes personal data in its capacity as a public authority in connection with its core purposes of research and education, as laid down by law, and its responsibilities to its staff, students and others in relation to these core purposes. 
 
We consider that processing personal data in the context of the Report and Support tool is a reasonable, targeted and proportionate way of handling reports of unacceptable and/or threatening behaviour towards our staff, students and others, with a view to eliminating such behaviour across our institution, so as to better serve our core purposes. 
 
(ii) Performance of a contract between UoN and the individual(s) named in a report 
 
Where a report is made by or about a UoN member of staff or student, UoN may process personal data in order to fulfil our obligations under the contract with that staff member or student, or enforce that staff member or student’s counter-obligations to us. 
 
UON Staff: 
Where you have entered into an employment contract or another type of contract to perform work for UoN, we will process your personal data so that both parties can perform that contract. 
 
Specifically, in the context of the Report and Support tool at UoN, the relevant obligations under our contract with you include us managing our human resources processes in relation to dealing with allegations of unacceptable and/or threatening behaviour perpetrated by or against members of our staff, enforcing UoN policy on bullying and harassment (together with other related policies), and providing advice and support to staff members reporting and/or impacted by such behaviour. 
 
Students: 
If you accept an offer to enrol as a student at UoN, you must accept our student terms and conditions. Once you have accepted these terms, it creates a contract between you and UoN. From that point onward, we process your personal data so that we can meet our contractual obligations to you, and enforce your obligations to us. 
 
Specifically, in the context of the Report and Support tool at UoN, the relevant obligations under our contract with you include us managing disciplinary issues or complaints relating to allegations of unacceptable and/or threatening behaviour perpetrated by or against our students, enforcing UoN policy on bullying and harassment (together with other related policies), managing absence and academic engagement (if due to bullying, harassment, etc), and providing advice and support to students reporting and/or impacted by such behaviour. 
 
We consider that processing personal data in the context of the Report and Support tool is a reasonable, targeted and proportionate way of handling reports of unacceptable and/or threatening behaviour perpetrated by or against our staff or students, for the purpose of meeting our contractual obligations to these individuals and/or enforcing their contractual obligations to us. 
 
(iii) Compliance with a legal obligation to which UoN is subject 
 
As a public authority, UoN is subject to the ‘public sector equality duty’ under the Equality Act 2010. This means that UoN must, in the exercise of its functions, have due regard to the need to: 
 
a)    eliminate discrimination, harassment, victimisation and any other conduct that is prohibited by or under this Act; 
b)    advance equality of opportunity between persons who share a relevant protected characteristic and persons who do not 
        share it; 
c)    foster good relations between persons who share a relevant protected characteristic and persons who do not share it. 
 
Further information concerning the public sector equality duty is available here. We consider that processing personal data in the context of the Report and Support tool at UoN is a reasonable and proportionate way of achieving compliance with this legal obligation. For example, we would not be able to fully provide the tool, and thereby to assist individuals to report harassment, victimisation, and other conduct prohibited by the Equality Act 2010, with the aim of eliminating such conduct within our institution, if we were unable to process personal data in order to so. 
 
In addition, it may be necessary for us to process your personal data, in the context of Report and Support, in order for us to comply with other statutory obligations under the Equality Act 2010 or other legislation, or to satisfy other legal or regulatory requirements. 
 
We also consider that processing personal data in the context of the Report and Support tool is necessary for UoN to comply with its common law duty of care for the health, safety and wellbeing of its staff and students. 
 
(iv) To protect your vital interests and/or those of another person 
 
In exceptional circumstances, UoN may process your personal data in the context of the Report and Support tool where we consider this is necessary in an emergency to protect your own and/or other people’s vital interests (i.e. protecting your or another person’s life or preventing serious and immediate physical harm to you or another person). 
 
One example of this would be if UoN needed to release information about you to the police or emergency services where we reasonably believe that you are in immediate risk of causing harm to yourself. Another example would be if UoN needed to release information about you to the police and/or social care services in circumstances where a child or adult at risk is in immediate danger or is at risk of harm. 
 
(v) Consent 
 
While we do not expect it to be the case, there may be some rare circumstances where we need to process your personal data outside the lawful bases set out above. 
 
If this happens, we will seek your consent to process your personal data for that specific purpose. We will take all reasonable steps to ensure the any consent you provide is freely given (i.e. you have a genuine choice), specific, informed and unambiguous. We will explain to you how you can withdraw your consent at the time of you giving it. If you do withdraw consent, this will not affect the lawfulness of processing based on your consent before your withdrawal. 
 
It is important to understand that references to ‘your consent’ in this privacy notice and other documents relating to the Report and Support tool do not, in general, refer to UoN relying on consent as a lawful basis for processing your personal data under the data protection legislation. This is because, as both a public authority and an employer – and in line with guidance from the Information Commissioner’s Office – UoN endeavours to avoid the use of consent in order to lawfully process individuals’ personal data and instead relies, wherever possible, on another lawful basis for doing so, such as those referred to above. 
 
In circumstances where we seek your consent to a course of action in connection with the Report and Support tool – for example, to sharing a named report you have made with an external third party (e.g. the police) – this is so that, to the extent possible, we are not taking any steps that you feel uncomfortable about. As stated above, however, there may be circumstances where our other duties to you or other individuals necessitate us taking steps in relation to a report without your consent. 
 
Legal conditions relied on for the processing of special categories of personal data: 
 
(i) ‘Substantial Public Interest’ conditions 
 
The data protection legislation allows special categories of personal data to be processed where this is necessary for reasons of substantial public interest. Under this legislation, there are a variety of specific purposes that are automatically considered to be of substantial public interest, as well further specific purposes where the processing activities in a particular context may be shown to have substantial public interest benefits. 
 
The specific ‘substantial public interest’ conditions UoN relies upon for the purposes of processing special categories of personal data in the context of Report and Support are set out below: 
 
Statutory and government purposes 
 
Statutory duties under the Equality Act 2010, etc 
 
UON may process personal data, including special categories of personal data, in order to fulfil our statutory duties under the Equality Act 2010 and other legislation. 
 
In particular, as described in detail above, as a public authority, UoN is subject to the ‘public sector equality duty’ under the Equality Act 2010. 
 
We consider that processing personal data, including special categories of personal data, in the context of the Report and Support tool is a reasonable and proportionate way for us to work towards fulfilling this statutory duty. As well as the clear substantial public interest of compliance with statutory duties in general, we consider that providing a mechanism for individuals to report harassment, victimisation, and other conduct prohibited by the Equality Act 2010, with the aim of eliminating such conduct within our institution, in itself has substantial public interest benefits. 
 
Public functions conferred by law 
 
Separately, and as previously described in this notice, UoN will process personal data in the context of the Report and Support tool in its capacity as a public authority (i.e. a higher education institution) in connection with its core purposes of research and education, as laid down by law (i.e. by UoN’s Royal Charter), and its responsibilities to its staff, students and others in relation to these core purposes. 
 
We consider that processing personal data, including special categories of personal data, where relevant, in the context of the Report and Support tool is a reasonable, targeted and proportionate way of handling reports of unacceptable and/or threatening behaviour towards our staff, students and others, with a view to eliminating such behaviour across our institution, so as to better serve our core purposes of research and education, which themselves have substantial public interest benefits 
 
Moreover, we consider that it is of substantial public interest for the university sector, as a whole, to implement appropriate measures to address issues of unacceptable and/or threatening behaviour among university staff and student populations. The Report and Support tool provides UoN (along with other higher education institutions who have implemented this or similar tools) with a mechanism for addressing these issues, insofar as they affect our institution, and for working towards achieving these substantial public interest benefits. 
 
In order to properly provide the Report and Support tool at UoN, and to achieve the various substantial public interest benefits referred to in this section, this will, in many cases, necessarily involve the processing of special categories of personal data. For example, in order to receive and process a report of racial harassment, provide appropriate support to the individual(s) concerned, and identify and take steps to prevent similar incidents occurring again, it will generally be necessary for us to process personal data revealing the victim’s racial or ethnic origin. 
 
Preventing or detecting unlawful acts 
 
UON may process special categories of personal data where this is necessary for the purposes of preventing or detecting an unlawful act and this processing must be carried out without the consent of the individual(s) concerned so as to avoid prejudicing these purposes – e.g. where notifying individuals against whom allegations of conduct likely to amount to an unlawful act and seeking their consent to process their personal data would give them the opportunity to destroy evidence, interfere with witnesses, etc. 
 
Where a report of conduct that is likely to amount to an unlawful act is received via the Report and Support tool, it may be necessary for us to process special categories of personal data of the individuals concerned for the purposes of investigating the allegations made and/or taking steps to prevent future unlawful acts from occurring. 
 
Such processing may include informing the police, local authority/social care services and other relevant third parties. 
 
We believe that there are substantial public interest benefits to processing special categories of personal data for these purposes – including, for example, identifying and taking appropriate action against perpetrators of unlawful acts, supporting the victims, and the prevention of similar unlawful acts, as well maintaining public trust and confidence in UoN so that the wider substantial public benefits we perform through our research and education are not impacted. We consider that the Report and Support tool, by providing a portal for individuals to report conduct that, in certain cases may amount to an unlawful act, is a reasonable and proportionate way of achieving these benefits. 
 
Regulatory requirements 
 
In certain circumstances, we may process special categories of personal data where this is necessary for the purposes of complying with, or assisting third parties to comply with, a regulatory requirement which involves UoN or a third party taking steps to establish whether an individual who is the subject of a report submitted via the Report and Support tool: 
 
(a) has committed an unlawful act, or been involved in other seriously improper conduct; and 
 
(b) in the circumstances, UoN cannot reasonably be expected to obtain the consent of the individual concerned to the processing (e.g. because doing so would ‘tip them off’ and/or give them the opportunity to interfere with UoN’s or a third party’s investigation, or because consent would not meet the requirement of being ‘freely-given’). 
 
For these purposes, a “regulatory requirement” means either: 
 
  • a requirement imposed by legislation or by an organisation performing a function conferred by legislation (such as the police, a regulatory body, a local authority/social services, etc); or 
  • a requirement forming part of generally accepted principles of good practice relating to a type of body or an activity, such as universities or other public authorities investigating allegations of unlawful acts or seriously improper conduct made by and/or against members of staff, students or others. 
 
Where it is necessary for special categories of personal data to be processed in the context of the Report and Support tool for these purposes, we believe there is a substantial public interest for doing so. In particular, we consider that it is in the public interest: 
  • for regulatory requirements to be complied with; 
  • for allegations relating to unlawful acts or seriously improper conduct perpetrated by or against our staff, students or others to be properly investigated; and 
  • for public trust and confidence in UoN to be maintained, so that the wider substantial public benefits we perform through our research and education are not impacted. 
Safeguarding of children and of individuals at risk 
 
We may process special categories of personal data where this is necessary: 
 
(a) for the purposes of safeguarding children or adults at risk – that is, protecting individuals in these categories from neglect or physical, mental or emotional harm, or protecting the physical, mental or emotional well-being of individuals in these categories; and 
 
(b) there are closely-defined justifiable reasons why this processing of data can or has to be done without the consent of the individual(s) concerned (including both those individuals being safeguarded and other individuals). 
 
The specific reason that applies as to why processing can or needs to take place without consent will vary depending on the circumstances, but will include circumstances where consent to the processing cannot be given by the individual(s) concerned (e.g. due to age or incapacity) or where we cannot reasonably be expected to obtain the consent of the individual(s) to the processing. In addition, these circumstances will include situations where the processing must be carried out without the consent of the individual(s) concerned because obtaining consent would prejudice the provision of the safeguarding protection referred to above. 
 
Further information concerning the situations in which UoN may need to process special categories of personal data for these purposes, and of the types of processing activities that may be involved, are contained in our Duty of Care Guidance. 
 
Equality of opportunity or treatment 
 
We may process certain types of special category personal data in order to monitor equality of opportunity or treatment. 
 
The specified special categories of personal data which may be processed for these purposes are: 
 
  • Personal data revealing racial or ethnic origin; 
  • Personal data revealing religious or philosophical beliefs; 
  • Data concerning health; and 
  • Personal data concerning an individual's sexual orientation. 
 
In doing so, we shall ensure that such processing is not carried out for the purposes of taking measures or making decisions with respect to a particular individual, nor will such processing be carried out in a manner that is likely to cause substantial damage or substantial distress to an individual. 
 
(ii) Employment law obligations and rights 
 
UON may also process certain special categories of personal data in the context of the Report and Support tool, in our role as an employer (or the organisation receiving the benefit of a staff members’ work), where this is necessary so that we can meet our obligations, or give effect to our or an individual’s rights, in the field of employment law. 
 
Examples of this are where processing special categories of personal data is necessary for UoN to meet our obligations as an employer, or to give effect to our or a staff member’s rights, under the Equality Act 2010 and related legislation. 
 
Alternatively, we may need to process special categories of personal data where this is necessary for UoN to comply with our common law duty of care, as an employer, for the health, safety and wellbeing of our employees. 
 
(iii) Establishment, exercise or defence of legal claims 
 
It may be necessary to process special categories of personal data relating to you for the purposes of establishing, exercising or defending legal claims. This includes processing necessary for the purposes of: 
 
·         actual or prospective court proceedings; 
·         obtaining legal advice; or 
·         establishing, exercising or defending legal rights in any other way. 
 
(iv) Explicit Consent 
 
Again, while we do not expect it to be the case, there may be some exceptional circumstances where we need to process special categories of personal data relating to you outside the legal conditions set out above. 
 
If this happens, then as well as taking all reasonable steps to ensure that any consent you provide is freely given, specific, affirmative (via an opt-in, rather than opt-out) and unambiguous, and is able to be withdrawn at any time, we shall put extra measures in place in order protect your rights and to ensure that the consent is ‘explicit’. These extra measures will include some or all of the following: 
 
  • insofar as possible, explicit consent shall be confirmed in a clear statement, rather than by any other type of affirmative action; 
  • any consent requested will specify the nature of the special category personal data to be processed; and 
  • consent to process special categories of personal data will be separate from any other consents requested. 
 
If you do withdraw your explicit consent, this will not affect the lawfulness of processing based on such consent before your withdrawal. 
 
 
7.     Third parties with whom we may share your personal data 
 
Third party service providers 
 
In the context of the Report and Support tool, we will share your data with third party service providers that help us provide the tool, such as Culture Shift. This enables us to make the Report and Support tool available to you. 
 
Please note that Culture Shift staff themselves do not routinely have access to personal data contained in reports submitted via the Report and Support tool. On occasion, however, it may be necessary for UoN to grant access to certain personal data contained in reports to Culture Shift staff – for example, to investigate and remediate security incidents or to provide technical support, where required. Such access will be coordinated on a case-by-case basis and subject to strict controls. 
 
The police/social care services/local authorities/other similar bodies 
 
There are certain circumstances in which UoN may provide information about the matters raised in a report, including personal data, to third parties such as the police and social care services. This may include providing personal data about you without your consent. This is mostly to happen in circumstances where there is a safeguarding concern and/or where providing information to third parties is required under or consistent with our duty of care. 
 
UON's consultants and professional advisors 
 
Depending on the circumstances, UoN may need to share details of reports made with its consultants and other professional advisors, such as solicitors. 
 
Courts and tribunals 
 
In the event that a report results in legal proceedings being issued, UoN may share personal data with the relevant courts and tribunals. 
 
External Funding Bodies 
 
It may be necessary, in certain circumstances, for UoN to share information about the matters raised in a report, including personal data, with our external funding bodies – for example, where required to do under the terms and conditions of a research grant award or during a funder audit of a specific grant. 
 
Further information 
 
Please note, the list of third parties in this section is not exhaustive – data may also be shared in accordance with the privacy policies listed at section 1 above, as applicable. 
 
8.     Transfers outside the UK/European Economic Area 
 
We do not transfer your personal data outside the UK/European Economic Area (EEA) in relation to the Report and Support tool. 
 
9.     Information security 
 
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 
 
10.  Retention periods 
 
We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. 
 
All personal data processed in the context of Report and Support will be kept according to the UoN Records Retention Schedule
 
Within a reasonable time after we no longer need to retain your personal data, we will take reasonable steps to remove it securely from our systems. 
 
Please note that we may retain some anonymised information in order to monitor our work in this area, but you will not be identifiable from this information. 
 
11.  Your rights 
 
Your rights as a data subject are set out in the University’s main Privacy Notice, which can be located here: https://www.nottingham.ac.uk/utilities/privacy/privacy.aspx 
 
In certain circumstances, we may need to restrict your rights in order to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege), or otherwise as permitted by law. 
 
12.  Automated processing 
 
UON does not use automated processing and decision making without manual intervention. This includes in relation to data received in the context of the Report and Support tool. 
 
13.  Who regulates the use of my personal information? 
 
UON maintains a data protection registration with the Information Commissioner's Office, the independent authority which oversees compliance with the data protection laws. Our registration number is Z5654762. 
 
Please see the Information Commissioner's Office website (www.ico.org.uk) for further information. 
 
14.  Who do I contact with questions? 
 
If you have any questions about UoN’s use of your personal data that are not answered by this privacy notice, please contact UoN's Data Protection Officer: dpo@nottingham.ac.uk 
 
If we are unable to adequately address any concerns you may have about the way in which we use your personal data, you have the right to lodge a formal complaint with the Information Commissioner's Office. Details are available on our main Privacy Notices here: https://www.nottingham.ac.uk/utilities/privacy/privacy.aspx 
 
For any other questions regarding Report and Support, please contact: 
 
Annie Jennings
Director of Student and Campus Life
Trent Building 
University of Nottingham
University Park
Nottingham
NG7 2RD 
Back

There are two ways you can tell us what happened