Privacy Notice

Buckinghamshire New University (“BNU”, “the University”) is the registered data controller with regard to the information submitted via the Report and Support platform and is committed to protecting the rights of individuals in line with its statutory requirements.

This privacy notice explains when and why we collect personal information about you, in the context of the Report and Support tool, and how we will use this information including the ways we might share this with others.  It also explains how we keep your information secure and the rights you have in relation to the information we hold about you.

This privacy notice applies to personal data provided to us both by individuals themselves or by third parties and supplements the wider BNU privacy notices available to view on the university web site.

If you have any questions about this privacy notice or how the University processes your personal data, then you can contact us on dpofficer@bnu.ac.uk.  

The only information we collect about you, is the information you have chosen to share with us when you submit a report via Report + Support. You can make a report either anonymously or by providing your name. 

·         your name (first name and surname), 

·         contact details (this could be your telephone number for example) 

·         and student or staff number where relevant

·         Your status (student or member of staff)

·         If you experienced or witnessed the incident 

·         The University campus where you study or work 

·         Course or directorate 

·         The nature of the incident (e.g. hate crime) 

·         The option to provide further information about the nature of the incident (e.g., date and time and any other relevant information).

We will also process the names and other details of any third parties who are involved in the issues reported.  Where you name a member of staff, student or third party within the report then this information may be used to start one of our formal processes if you choose to do so, or for the University to take action if we have safeguarding concerns. You do not have to provide information that will identify others involved in the incident if you do not want to.

Protected characteristics information (e.g. Age, Disability, Gender reassignment, Marriage and civil partnership, Pregnancy and maternity, Race, Religion and belief, Sex, Sexual orientation)

It is your choice to provide this information to us. 

·         To help us identify the best person for you to speak to in relation to your report and to provide you with appropriate support in respect of the incident and/ or concern; 

·         To allow us to take further action under the relevant University procedure, such as our disciplinary procedure; 

·         Compiling statistics or analysing trends from arising reports to inform our proactive and preventative work; and 

·         Meeting our duty of care to provide a safe environment for our staff and students.

When you submit a report, the information you provide may enable us to better support you and others in the University as well as helping us prevent bullying, harassment, sexual misconduct or any other inappropriate and unwelcomed behaviour, making the University a safer place to study and work. 

The information that you provide, both in a named report and anonymous report, is therefore valuable to us in terms our future decision making. By providing us with your contact details you will enable us to provide support and request further information if necessary.

You do not have to provide protected characteristics information; this is entirely voluntary. By providing this information you will help us monitor the use of the platform across the various characteristics.

Use of Report and Support is entirely voluntary and you can provide as much or as little information as you choose. The only information we collect will be the information you have chosen to provide to us when you submit your report via the reporting tool.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for and to satisfy any legal, accounting, or reporting requirements, and in accordance with the University’s Retention Schedule.

We will keep full records of all reports, both anonymous and named, for 6 years from case closure on the ‘Report and Support’ system following which, all personal data will be deleted.

Data protection laws require us to meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "legal basis" for the processing. Where we process special category (sensitive) personal data, we are required to establish an additional legal basis for processing that data. The lawful bases that we use in order to legally process the information provided via this platform are:

·         Performance of a task in the public interest  The University will be processing personal data in its capacity as a public authority in connection with its core purposes of education and research, and its responsibility to its staff and students in relation to its core purposes.

·         Performance of a contract  Where a report is made by or about a BNU member of staff or student, the University may process personal data in order to fulfil its obligations under our contract with that staff member or student. 

·         Consent  Where you have made a report and we cannot rely upon any other appropriate legal basis, we will generally seek to obtain your consent to the processing of your personal data when reviewing and processing that report and sharing with any relevant party.

·         Equality of opportunity or treatment  We process certain types of special category data in order to monitor equality of opportunity/treatment. 

·         Employment law obligations  We may also process certain special category data where this is necessary so that we can meet our obligations in the field of employment law.  

·         Statutory and government purposes  We may process special category data in order to fulfil our duties under the Equality Act 2010.  

·         Safeguarding of children and of individuals at risk  We may process special category data in order to safeguard children or individuals at risk.  

·         Preventing or detecting unlawful acts  We may process special category data in order to prevent or detect an unlawful act.  

·         Establishment, exercise or defence of legal claims  It may be necessary to process your special category personal data in relation to establishing, exercising or defending legal claims.  

·         Legal obligation: processing is necessary for compliance with a legal obligation to which the University is subject.

Some of the above grounds for processing will overlap and there may be several grounds which justify the use of personal information.

Third parties with whom we may share your personal data.

·         Law enforcement or other government and regulatory agencies: The University may be required by law to disclose certain information to the police or another relevant authority in circumstances e.g. where it is considered that an individual is at serious risk of harm.

·         BNU consultants and professional advisors: Depending on the circumstances, BNU may need to share details of reports made with its consultants and other professional advisors, such as solicitors.

·         Courts and tribunals: In the event that a report results in legal proceedings being issued, BNU may share personal data with the relevant courts and tribunals.

·         Periodically requests are received from third parties with authority to obtain disclosure of personal data. Such requests will only be fulfilled where the University is permitted to do so in accordance with applicable law or regulation.

Note that the list of third parties in this section is not exhaustive – data may also be shared in accordance with the wider university privacy notices available to view on the university web site.

Culture Shift, the company who host the platform, are unable to view the reports submitted.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where it is appropriate.

Only members of staff who need access to information will be authorised to do so. Information held electronically will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access.

Some processing may be undertaken on the University’s behalf by an organisation contracted for that purpose. Organisations processing personal data on the University’s behalf will be bound by an obligation to process personal data in accordance with Data Protection legislation and under strict instruction from the University.

·         Withdraw consent where that is the legal basis of our processing; 

·         Access your personal data that we process; 

·         Rectify inaccuracies in personal data that we hold about you; 

·         Be forgotten so that your details are removed from systems that we use to process your personal data; 

·         Restrict the processing in certain ways; 

·         Obtain a copy of your data in a commonly used electronic form; and 

·         Object to our processing of your personal data. 

Many of the rights above are not absolute so there may be times when you make a request to us and we are unable to meet it in full but if this is the case we will explain to you fully why we have not been able to do what you have asked.

If you wish to exercise any of the above rights, please contact us using the details set out below.

If you have any concerns with regards to the way your personal data is being processed or have a query with regard to this then you can contact the Data Protection Officer directly by e-mail dpofficer@bnu.ac.uk or by post.

Buckinghamshire New University,

Queen Alexandra Road,

High Wycombe, Buckinghamshire HP11 2JZ

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

BNU is registered as a controller with the Information Commissioner’s Office. Our registration number is: Z772474X