Report & Support Privacy Notice 

 

1.       The University of Winchester treats very seriously the personal data and the sensitive personal data it processes on behalf of its staff, students and visitors. It continues to comply fully with the UK General Data Protection Regulation (UK GDPR) and any national implementing laws, regulations and secondary legislation (‘National Legislation’), as amended or updated from time to time, in the UK and then (ii) any successor legislation to the GDPR or the Data Protection Act 2018 or the National Legislation. 

2.       The University processes both personal data and special category data under a range of different ‘lawful bases’ depending on the nature of the respective ‘processing purposes’ (the ‘purposes of the processing’ as outlined below).

3.       For the personal data supplied within the Report and Support system, the University is processing this data under the lawful basis of ‘Public Task’, as set out under Article 6(1)(e) of the UK GDPR. Specifically, to meet the Office for Students statement of expectations with regards to Prevent, harassment and sexual misconduct effecting students in HE and the recommended standards within the Equality and Human Rights Commission report on race harassment.

4.       For any special category data supplied within the Report and Support system, the University is processing this data under Article 9(2)(g) of the UK GDPR. Specifically, that the processing is necessary for reasons of substantial public interest as laid down in the Data Protection Act 2018 Schedule 1, Part 2, Paragraph 8 – equality of opportunity or treatment.

5.       The ‘purposes of the processing’ for the personal data and special category data include:

a)                    Reporting issues such as harassment & misconduct, either anonymously or by named individuals.

b)                   Case management of reports, including the triage of information, and any additional information added to the system during the course of disciplinary investigations.  

c)                     Anonymized statistical data is produced for analysis.

6.                     The categories of personal data that may be processed are:

a)       Name and contact details of staff, students, witnesses

b)      Allegations of disciplinary offences reported

c)       CCTV or similar evidence

d)      Personal statements

7.                     Special category data may also be processed including race, ethnicity, politics, religion, union membership, genetics, biometrics, health, sex life or sexual orientation.

8.                     Once the information is reviewed, it will be shared with relevant University departments where necessary. Where appropriate it may also be shared with responsible staff following the ‘Disciplinary Procedures for Students’ or ‘Disciplinary Procedures’ for University staff. These policies are available on the University intranet. 

9.                     The information may also be shared with external parties such as the police or social services, when it is judged necessary.

10.               The personal data will usually be kept for three years after the last action for each case. Where allegations are particularly serious the data will be kept for a period of six years, in line with the statute of limitations. Personal data around accusations that are proven to be unfounded will be anonymized and statistical information only will be kept for reporting purposes. Personal data around accusations against staff that are neither proven nor disproven will be retained for the duration of their employment.

11.          As an individual you have a number of rights available to you in regard to your data. More information on these can be found here. To exercise any of your data right, please contact the Data Protection Officer whose details are listed below. 

12.          You have a right to contact the ICO if you have concerns about how your data is used. The ICO can be contacted in a variety of ways, and further details can be found here 

13.          The University will review and, where necessary, update this privacy notice in line with current guidance and developments

The data protection officer for the University is: 

 
The University of Winchester,

Sparkford Road,

Winchester,

Hampshire,
 
SO22 4NR,
 
United Kingdom.
 
Tel: +44 (0) 1962 841515, Ext. 7217
 
Email: stephen.dowell@winchester.ac.uk
 
 

The name and contact details of our organisation are:
 

 
SO22 4NR,
 
United Kingdom.
 
Tel: +44 (0) 1962 841515