The University of East Anglia has implemented Report+Support as a way for students, staff and others to report unacceptable behaviours and seek support. You can use Report+Support anonymously, or choose to disclose your name and other identifying information. 
 
This privacy notice explains how the University will use your personal data if you, or someone acting on your behalf, share identifying information with us through Report+Support. The University is a registered data controller and will use any personal data submitted through Report+Support in accordance with current UK data protection legislation. 
 
If you are a UEA student or employee, please also see our general privacy notice for students and staff.

 
Where does our information come from?
We collect personal data about you through Report+Support. We will respond to any reported incident using only the information you, or those acting on your behalf, have chosen to provide. 
 
What information do we use, and why?
Anonymous reports 
Report+Support is designed so you can report an incident without sharing any identifying information about yourself or others. Anonymous reports should therefore contain no personal data, and we will take no action to identify individuals from anonymous reports. We will use the information gathered through anonymous reports only to establish trends to better inform our decision-making. 
 
Named reports 
If you choose to identify yourself or others, the University will then process a range of information about you, as described in the following table. 
 
1. Information
 Your name, email address, connection to UEA, and school or department

Purpose
To contact you to offer support. These types of data are mandatory for named reports.

2. Information
Demographic data, including the following ‘special category’ data: 
  • Sexual orientation 
  • Whether you have a disability 
  • Ethnicity 
  • Religion 
Purpose
To collect data to establish trends to better inform our decision-making. Also to help advisers better prepare for your meeting. These are optional, and you can also ‘prefer not to say’

3. Information
Information about the incident(s) reported on. Note that this may also include other ‘special category’ data, such as information about your health, Trade Union membership, or political beliefs.

Purpose
To help advisers prepare for your meeting. Also to help collect data to establish trends to better inform our decision making. You can provide as much, or as little, information as you want about the incident(s).

4. Information
 The name(s) and information identifying others involved in the incident

Purpose
This information can be used to pursue action on the individual(s) if you choose to do so, or in case of issues with safeguarding, for the University to take action. You are not obliged to share information that will identify others involved in the incident. 

Who will have access to your data
Within UEA, access to personal information submitted through Report+Support will be strictly limited to a small number of University staff in Student Services (for reports affecting UEA students) or Human Resources (for reports relating to UEA employees). 
 
Where the University carries out an investigation following a report, if required for safeguarding or professionalism concerns we may share limited data about the report with certain University employees, for example the Head of the School or the Head or Assistant Head of Accommodation. The responder will be notified in advance before sharing of data to these University employees. 
 
Unless you ask us to do so, we do not intend to share your personal data with any third party. Any specific requests from a third party for us to share your personal data with them will be dealt with in accordance with the provisions of the data protection laws. There are certain circumstances in which UEA may provide information about the matters raised in a report, including personal data, to third parties such as the police, the safeguarding board and social care services. This may include providing personal data about you without your consent. 
 
These circumstances include: 
  • An allegation about behaviour by a staff member or student towards a student who is under the age of 18; 
  • An allegation about behaviour by a staff member or student towards an adult at risk; or 
  • A request by the police regarding a criminal investigation. 
Legal basis for using your data
In relation to our review and handling of the personal data submitted in a report, we have identified the following lawful bases: 
  • For all information: Article 6(1)(f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’ 
  • For information relating to UEA employees: Article 6(1)(b) ‘processing is necessary for the performance of a contract to which the data subject is party’ 
  • Where this activity involves ‘special category’ data, one or more of the following conditions may apply: 
  • For all information: GDPR Article 9(2)(g) ‘Substantial public interest’, with reference to the following sections of the DPA 2018: 
    • Sch. 1(2) para. 8(1)-(5)(c) ‘Equality of opportunity or treatment’ 
    • Sch. 1(2) para. 17(1)-(2)(c) ‘Counselling etc.’ 
    • Sch. 1(2) para. 18(1)-(4) ‘Safeguarding of children and of individuals at risk’ 
  • For information relating to UEA employees: GDPR Article 9(2)(b) ‘Employment and social security and social protection’, with reference to DPA 2018 Sch. 1(1) para. 1(1)-(3)
In some limited circumstances, we may share information contained in an incident report with a third party, and the following lawful bases will apply: 
  • For all information: Article 6(1)(a), ‘the data subject has given consent to the processing of his or her personal data for one or more specific purposes’ 
Where this activity involves ‘special category’ data the following condition will apply: 
  • GDPR Article 9(2)(a) ‘explicit consent’. 
For both of these processing activities the following may apply, in exceptional circumstances only: 
  • Article 6(1)(d) - processing is necessary in order to protect the vital interests of the data subject or of another natural person, and for ‘special category’ data, 
  • Article 9(2)(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent. 
Data processors
We are using the company Culture Shift to host and provide the Report+Support tool. They are acting as blind data processors on behalf of the University. You can read Culture Shift privacy notice here. 
 
How long we keep your information
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. 
 
All personal data will be kept according to the records retention schedules. 
 
We may retain some anonymised information in order to monitor our work in this area but you will not be identifiable from this information. 
 
Contact
If you have any questions about Report and Support online support and reporting tool, contact reportandsupport@uea.ac.uk
 
For any queries about our use of your personal data, contact dataprotection@uea.ac.uk. Further details are in the link below. 
 
Your rights, concerns & complaints, and other information 
We have published further data protection information here. 
 
Changes to this privacy note
This privacy notice was published in December 2019. We keep this privacy notice under regular review. We may withdraw or modify this notice at any time and we may supplement or amend this notice by additional policies and guidelines from time to time. Any changes we make to this privacy notice in the future will be posted in the UEA student and staff bulletins. 
Back

There are two ways you can report something