Privacy Notice
University of Oxford Report + Support Platform
Version 1: January 2024
Please read this privacy notice carefully – it describes why and how the University collects and uses personal data in the context of the Report + Support tool and provides information about your rights. This privacy notice applies to the University’s handling of any personal data collected through the Report + Support tool and as such may be referred to by the reporting person, the reported person and any other individuals whose data is collected as part of this process.
It is important that a reporting person reads this policy when submitting their report and we are collecting or processing information about them, so that they are aware of how and why we are using the information. A reported person will not be made aware that a report has been made in the initial stages,
The Report + Support tool is part of the University Harassment Advisory Service and reports made through the tool are managed as part of this service and in accordance with the University Harassment policy.
Reporting persons don’t need to use the Report + Support platform to access support. They can speak to a Harassment Advisor by emailing the Harassment Line (email harassment.line@admin.ox.ac.uk) or speaking directly to a Harassment Advisor based in their department or faculty.
A reporting person is also able to formally report an incident of bullying and harassment at any point as outlined in the Harassment Policy.
A. What is the purpose of this document?
The University of Oxford is committed to protecting the privacy and security of your personal information (‘personal data’).
One of our responsibilities is to tell you about the different ways in which we collect and use your personal data – how we collect and use your data, what information we collect (and our legal basis for doing so), why we collect it, where we collect it from and whether (and with whom) we will share it (and in which circumstances). We also need to tell you about your rights in relation to the information. This notice ensures we are working in accordance with the UK General Data Protection Regulation (UK GDPR) and related UK data protection legislation.
This notice provides further details about all of these issues in respect of the Report and Support tool. We keep this privacy notice under regular review.
B. Glossary
'Personal data' means any information which identifies you as an individual. It may include your name but it may also be other information such as your gender, department and role which when combined may identify you.
It does not include data which does not relate to an identified or identifiable individual, or to personal data rendered anonymous in such a manner that the individual is not or no longer identifiable.
Where we refer to the ‘processing’ of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure, deletion or retention.
‘Sensitive personal data’ or 'special categories of personal data' such as information about racial or ethnic origin, religious beliefs or other similar beliefs, physical or mental health and sexual orientation, are given a high level of protection under data protection law.
Personal data relating to criminal convictions and offences are also treated as requiring additional protections.
C. Who is using your personal data
The University of Oxford[1] is the "data controller" as we determine the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. This means that we are legally responsible for the personal data we collect and hold about you.
[1] The University’s legal title is the Chancellor, Masters and Scholars of the University of Oxford.
D. About the Report + Support tool at University of Oxford
The Report + Support tool at the University of Oxford provides staff employed by the University with an online platform that enables staff to tell the university about an incident/concern of bullying and harassment, either on behalf of themselves or as a witness and also seek support in respect of issues of bullying and harassment.
Reports may be made by University-employed staff and may be either:
(a) anonymous, where no name or contact email address that could be used to identify either the individual making the report or the reported person is provided.
(b) named, where the names and contact email address of the individual making the report are included. The named report contains an optional free text box for individuals to provide further information about what happened, which may include names or other information which could be used to identify the reported person and other third parties. The University encourages individuals making a named report not to include names of third parties.
The data provided in each of the reports will be used as follows:
(a) anonymous reports: where no name or contact email address is provided this means the university will not be able to contact the reporting person to provide direct advice or support. The university will not investigate the reported behaviour and therefore no disciplinary action will be taken in relation to the reported person. The report data will help the University to provide better support to others and inform prevention work across the university.
(b) named reports: where the names and contact email address of the individual making the report are provided these will be allocated to a Harassment Advisor so that they can contact the reporting individual to discuss the situation and provide impartial guidance on how the resolve the situation informally or make a formal complaint to help the reporting individual decide what to do.
Please note: When a report is made through the Report and Support tool, the information contained in the report will be passed onto relevant staff members on a strictly need to know basis. For named reports, data may need to be shared for the purpose of any related investigation or follow up action. As set out in the University Harassment Policy and Procedures, there may be circumstances in which the University considers the report issues or implications for the reporting person or others actually, or potentially, affected are of such a serious nature that it, judges that action is required even in the absence of a formal complaint.
In particular, the Report and Support tool is not designed to be used when reporting potential safeguarding issues to the University of Oxford which should be reported in accordance with the Safeguarding Policy. Where a reporting person is making a report about behaviour which might also amount to a criminal offence they should consider reporting the matter to the police and the University may also make a direct referral to the police if they consider that there is a serious risk of harm which requires such a referral to be made
E. The Types of Data we collect
We collect, use, store and transfer different kinds of personal data, including special category data and criminal offence data supplied by the reporting person through our online form.
This may include:
Please read this privacy notice carefully – it describes why and how the University collects and uses personal data in the context of the Report + Support tool and provides information about your rights. This privacy notice applies to the University’s handling of any personal data collected through the Report + Support tool and as such may be referred to by the reporting person, the reported person and any other individuals whose data is collected as part of this process.
It is important that a reporting person reads this policy when submitting their report and we are collecting or processing information about them, so that they are aware of how and why we are using the information. A reported person will not be made aware that a report has been made in the initial stages,
The Report + Support tool is part of the University Harassment Advisory Service and reports made through the tool are managed as part of this service and in accordance with the University Harassment policy.
Reporting persons don’t need to use the Report + Support platform to access support. They can speak to a Harassment Advisor by emailing the Harassment Line (email harassment.line@admin.ox.ac.uk) or speaking directly to a Harassment Advisor based in their department or faculty.
A reporting person is also able to formally report an incident of bullying and harassment at any point as outlined in the Harassment Policy.
A. What is the purpose of this document?
The University of Oxford is committed to protecting the privacy and security of your personal information (‘personal data’).
One of our responsibilities is to tell you about the different ways in which we collect and use your personal data – how we collect and use your data, what information we collect (and our legal basis for doing so), why we collect it, where we collect it from and whether (and with whom) we will share it (and in which circumstances). We also need to tell you about your rights in relation to the information. This notice ensures we are working in accordance with the UK General Data Protection Regulation (UK GDPR) and related UK data protection legislation.
This notice provides further details about all of these issues in respect of the Report and Support tool. We keep this privacy notice under regular review.
B. Glossary
'Personal data' means any information which identifies you as an individual. It may include your name but it may also be other information such as your gender, department and role which when combined may identify you.
It does not include data which does not relate to an identified or identifiable individual, or to personal data rendered anonymous in such a manner that the individual is not or no longer identifiable.
Where we refer to the ‘processing’ of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure, deletion or retention.
‘Sensitive personal data’ or 'special categories of personal data' such as information about racial or ethnic origin, religious beliefs or other similar beliefs, physical or mental health and sexual orientation, are given a high level of protection under data protection law.
Personal data relating to criminal convictions and offences are also treated as requiring additional protections.
C. Who is using your personal data
The University of Oxford[1] is the "data controller" as we determine the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. This means that we are legally responsible for the personal data we collect and hold about you.
[1] The University’s legal title is the Chancellor, Masters and Scholars of the University of Oxford.
D. About the Report + Support tool at University of Oxford
The Report + Support tool at the University of Oxford provides staff employed by the University with an online platform that enables staff to tell the university about an incident/concern of bullying and harassment, either on behalf of themselves or as a witness and also seek support in respect of issues of bullying and harassment.
Reports may be made by University-employed staff and may be either:
(a) anonymous, where no name or contact email address that could be used to identify either the individual making the report or the reported person is provided.
(b) named, where the names and contact email address of the individual making the report are included. The named report contains an optional free text box for individuals to provide further information about what happened, which may include names or other information which could be used to identify the reported person and other third parties. The University encourages individuals making a named report not to include names of third parties.
The data provided in each of the reports will be used as follows:
(a) anonymous reports: where no name or contact email address is provided this means the university will not be able to contact the reporting person to provide direct advice or support. The university will not investigate the reported behaviour and therefore no disciplinary action will be taken in relation to the reported person. The report data will help the University to provide better support to others and inform prevention work across the university.
(b) named reports: where the names and contact email address of the individual making the report are provided these will be allocated to a Harassment Advisor so that they can contact the reporting individual to discuss the situation and provide impartial guidance on how the resolve the situation informally or make a formal complaint to help the reporting individual decide what to do.
Please note: When a report is made through the Report and Support tool, the information contained in the report will be passed onto relevant staff members on a strictly need to know basis. For named reports, data may need to be shared for the purpose of any related investigation or follow up action. As set out in the University Harassment Policy and Procedures, there may be circumstances in which the University considers the report issues or implications for the reporting person or others actually, or potentially, affected are of such a serious nature that it, judges that action is required even in the absence of a formal complaint.
In particular, the Report and Support tool is not designed to be used when reporting potential safeguarding issues to the University of Oxford which should be reported in accordance with the Safeguarding Policy. Where a reporting person is making a report about behaviour which might also amount to a criminal offence they should consider reporting the matter to the police and the University may also make a direct referral to the police if they consider that there is a serious risk of harm which requires such a referral to be made
E. The Types of Data we collect
We collect, use, store and transfer different kinds of personal data, including special category data and criminal offence data supplied by the reporting person through our online form.
This may include:
- The reporting person’s name, email address and other information such as their department (where applicable) and their age range;
- The name of the reported person if the reporting person provides it and other information about them such as their department;
- Special category personal data about the reporting person and, where provided, of the reported person (this may include details about race or ethnicity, religion or belief, sexual orientation, political opinions, trade union membership, information about health and any disability etc.);
- Criminal offence data where provided, which would usually be about the reported person (where the report involves allegations of behaviour which might also amount to a criminal offence);
- Personal data about third parties, including witnesses, if provided by the reporting person. This could include special category and/or criminal offence data; and
- Detail regarding the allegations of bullying and harassment.
(a) Anonymous reports
When users report anonymously, the university will not collect the name or email address of the person submitting the report.
(b) Named reports
If a named report is made, we collect, use and store the reporting person’s name and contact email address.
The named report contains a free text box for individuals to provide further information about what happened, this is entirely optional. The University encourages individuals not to include names of a third party or any personal data about the reported person within the information provided.
Under UK GDPR and for the purposes of Report + Support, the University treats named reports as personal data and anonymous reports as pseudonymous personal data.
F. How the university obtained your data
We obtain the information directly from the reporting person based on the information they provide through the completion of the Report + Support tool form.
G. How the university uses your data
We process your data for a number of purposes through the Report + Support tool and set out below the lawful bases for process the data.
The University processes data to ensure that it is complying with our legal obligations. We may also use your personal information where we need to protect your (or someone else’s) interests or where it is in the public interest as outlined in section D. When we process your personal information, we will do so provided your fundamental rights do not override those interests.
Lawful basis for processing information to speak to a Harassment Advisor and report an incident of bullying and harassment:
- Article 6 (1) (b) to meet the University’s obligations under its employment contract with the individual.
- Article 6 (1) (c) so we can comply with our legal obligations as your employer.
For staff, we will process your data under the basis of an employment contract with you which includes compliance with the University Harassment Policy and procedures.
(a) Anonymous reports: The report information provided through anonymous reports will help the University to provide better support to others and inform prevention work across the university.
Further information about the purpose of collecting anonymous data is provided below under the Data Insights section.
(b) Named reports: where a person chooses to provide their name and email address to speak to a Harassment Advisor in accordance with the University Harassment Policy. The report will be assigned to a Harassment Advisor who will have access to the case details (not the demographic data) and will contact the reporting individual to discuss their situation.
Lawful basis for processing information for the purposes of safeguarding an individual at risk:
(a) Anonymous reports: The report information provided through anonymous reports will help the University to provide better support to others and inform prevention work across the university.
Further information about the purpose of collecting anonymous data is provided below under the Data Insights section.
(b) Named reports: where a person chooses to provide their name and email address to speak to a Harassment Advisor in accordance with the University Harassment Policy. The report will be assigned to a Harassment Advisor who will have access to the case details (not the demographic data) and will contact the reporting individual to discuss their situation.
Lawful basis for processing information for the purposes of safeguarding an individual at risk:
- Article 6 (1) (d) in order to protect your vital interests or those of another person.
- Article 9 (2) (g) – substantial public task – safeguarding of children and individuals at risk, under para.18, Part 2, Schedule 1 of the Data Protection Act 2018 as amended, is adopted.
Lawful basis for processing demographic information (special category data) for equality monitoring purposes:
- Article 6(1)(c) so we can comply with our legal obligations as your employer.
- Article 9(2)(g) – Substantial public task (Equality of Opportunity of Treatment, under para. 8, Part 2, Schedule 1 of the Data Protection Act 2018 as amended)
Within the tool, we request and process the data outlined in section E including certain types of special category data (racial and ethnic origin, sexual orientation or religious belief) to meet our legitimate interests relating to the governance, management and operation of the University by enabling the university to better understand equality of treatment and experiences of marginalised groups in relation to bullying and harassment and inform the university’s equality objectives around Harassment Prevention and therefore meet our statutory obligations under equalities and other legislation.
This data will only be processed where it has been volunteered. These questions are optional and not necessary for seeking support from a Harassment Advisor.
All data will be anonymised and aggregated at an appropriate level to ensure there is no residual risk of re-identification when producing monitoring reports.
H. Change of Purpose
We will only process your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose.
I. Data sharing with Third Parties
In the context of the Report and Support tool, we will share your data in line with this data privacy notice and the University Harassment Policy and procedures.
For named reports, this involves sharing the reporting person’s name, email address and other personal data listed in Section E about the Reported person, as well as data pertaining to the Reported Person (as listed in Section E), with a Harassment Advisor so that within the bounds of their role they are able to discuss your situation and provide support and guidance to help you decide what to do.
We don’t share data with Culture Shift, the third-party service provider that help us provide the tool. They act as a blind processor. Please see Culture Shift’s Knowledge Base for further information on the measures adopted by Culture Shift, which are designed to help keep personal data secure.
In certain circumstances we may need to share your personal data with third parties to perform our legal and other responsibilities. This could include disclosures to the police, social care services, external lawyers, relevant professional statutory regulatory bodies, such as the General Medical Council, external funders (to the extent that sharing is required by the funding terms) or disclosures required to be made in the course of legal proceedings, or in response to an individual exercising their legal right to access their personal data.
Personal data may be shared with relevant staff members and third parties, as outlined in section D, including in circumstances in which the University considers the implications for the reporting party or others actually, or potentially, affected are serious and, based on the information provided in the report, judges that action is required even if the reporting person is not requesting any action, or willing or able to make a formal complaint. Sharing in these circumstances may include providing personal data about you without your consent.
J. Transfers of your data overseas
We do not transfer your personal data outside the UK in relation to the Report and Support tool.
K. Data security
We have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Details of these measures are available from the University’s Information Security website.
Third parties that process data on our behalf will do so only on our instructions and where they have agreed to keep it secure.
L. Retention period
We will only retain your personal data for as long as we need it to fulfil our purposes, including data insight requirements.
We will keep records of the name, email address and other personal data of the reporting person and any personal data of anyone else contained in the case details, for a period of 6 months contained from the date of case closure on the ‘Report + Support’ system to allow us to fulfil the purposes of the Harassment Advisory Service and track case management. At this point, it is deemed there is no legitimate reason for retaining the personal data (name or email address) or free text answers from named reports and therefore we will redact this information that is no longer needed for the provision of support to any individual (subject to any other legal or regulatory requirements).
We will retain anonymised information for data insight purposes for a 3-year period to help the university better understand equality of treatment and experiences of marginalised groups in relation to bullying and harassment and inform the university’s equality objectives around Harassment Prevention, but you will not be identifiable from this information.
Data retention processes will be managed by administrative users in Equality and Diversity Unit who have authorization to access this data.
M. Your rights in relation to your personal data
Under certain circumstances, by law you have the right to:
This data will only be processed where it has been volunteered. These questions are optional and not necessary for seeking support from a Harassment Advisor.
All data will be anonymised and aggregated at an appropriate level to ensure there is no residual risk of re-identification when producing monitoring reports.
H. Change of Purpose
We will only process your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose.
I. Data sharing with Third Parties
In the context of the Report and Support tool, we will share your data in line with this data privacy notice and the University Harassment Policy and procedures.
For named reports, this involves sharing the reporting person’s name, email address and other personal data listed in Section E about the Reported person, as well as data pertaining to the Reported Person (as listed in Section E), with a Harassment Advisor so that within the bounds of their role they are able to discuss your situation and provide support and guidance to help you decide what to do.
We don’t share data with Culture Shift, the third-party service provider that help us provide the tool. They act as a blind processor. Please see Culture Shift’s Knowledge Base for further information on the measures adopted by Culture Shift, which are designed to help keep personal data secure.
In certain circumstances we may need to share your personal data with third parties to perform our legal and other responsibilities. This could include disclosures to the police, social care services, external lawyers, relevant professional statutory regulatory bodies, such as the General Medical Council, external funders (to the extent that sharing is required by the funding terms) or disclosures required to be made in the course of legal proceedings, or in response to an individual exercising their legal right to access their personal data.
Personal data may be shared with relevant staff members and third parties, as outlined in section D, including in circumstances in which the University considers the implications for the reporting party or others actually, or potentially, affected are serious and, based on the information provided in the report, judges that action is required even if the reporting person is not requesting any action, or willing or able to make a formal complaint. Sharing in these circumstances may include providing personal data about you without your consent.
J. Transfers of your data overseas
We do not transfer your personal data outside the UK in relation to the Report and Support tool.
K. Data security
We have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Details of these measures are available from the University’s Information Security website.
Third parties that process data on our behalf will do so only on our instructions and where they have agreed to keep it secure.
L. Retention period
We will only retain your personal data for as long as we need it to fulfil our purposes, including data insight requirements.
We will keep records of the name, email address and other personal data of the reporting person and any personal data of anyone else contained in the case details, for a period of 6 months contained from the date of case closure on the ‘Report + Support’ system to allow us to fulfil the purposes of the Harassment Advisory Service and track case management. At this point, it is deemed there is no legitimate reason for retaining the personal data (name or email address) or free text answers from named reports and therefore we will redact this information that is no longer needed for the provision of support to any individual (subject to any other legal or regulatory requirements).
We will retain anonymised information for data insight purposes for a 3-year period to help the university better understand equality of treatment and experiences of marginalised groups in relation to bullying and harassment and inform the university’s equality objectives around Harassment Prevention, but you will not be identifiable from this information.
Data retention processes will be managed by administrative users in Equality and Diversity Unit who have authorization to access this data.
M. Your rights in relation to your personal data
Under certain circumstances, by law you have the right to:
- Request access to your data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.
- Request correction of your data. This enables you to ask us to correct any incomplete or inaccurate data we hold about you.
- Request erasure of your data. This enables you to ask us to delete or remove your data under certain circumstances, for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
- Object to processing of your data where we are processing it to meet our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your data for direct marketing purposes.
- Request the restriction of processing of your data. This enables you to ask us to suspend the processing of your data, for example, if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your data to another party.
Further information on your rights is available from the Information Commissioner’s Office (ICO).
If you want to exercise any of the rights described above or are dissatisfied with the way we have used your information, you should contact the University’s Information Compliance Team (ICT) at data.protection@admin.ox.ac.uk. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of the GDPR. Please note the ICT may keep a record of your communications to help us resolve any issues which you raise.
If you remain dissatisfied, you have the right to lodge a complaint with the ICO at https://ico.org.uk/concerns/.
N. Keeping your data up-to-date
It is important that the data we hold about you is accurate and current.
For individuals submitting a named report, you can email harassment.line@admin.ox.ac.uk if you would like to update your contact name or email address.
For other requests related to your right of access including erasing a report, please contact the University’s Information Compliance Team at data.protection@admin.ox.ac.uk. The team will seek to deal with your request without undue delay, and in any event in accordance with the requirements of the GDPR. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
O. Changes to this privacy policy
We regularly review this privacy notice to ensure that it remains accurate and all changes are published here.
If you want to exercise any of the rights described above or are dissatisfied with the way we have used your information, you should contact the University’s Information Compliance Team (ICT) at data.protection@admin.ox.ac.uk. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of the GDPR. Please note the ICT may keep a record of your communications to help us resolve any issues which you raise.
If you remain dissatisfied, you have the right to lodge a complaint with the ICO at https://ico.org.uk/concerns/.
N. Keeping your data up-to-date
It is important that the data we hold about you is accurate and current.
For individuals submitting a named report, you can email harassment.line@admin.ox.ac.uk if you would like to update your contact name or email address.
For other requests related to your right of access including erasing a report, please contact the University’s Information Compliance Team at data.protection@admin.ox.ac.uk. The team will seek to deal with your request without undue delay, and in any event in accordance with the requirements of the GDPR. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
O. Changes to this privacy policy
We regularly review this privacy notice to ensure that it remains accurate and all changes are published here.