Privacy notice for Manchester Metropolitan University Report and Support System
This Privacy Notice explains who we are, how and why we collect and use personal information about you, our lawful basis, relevant retention periods and how you can exercise your privacy rights. Please do read this notice to understand our practices and if you have any questions please contact us using the contact details provided.
Who we are
The Manchester Metropolitan University (‘the University’) is the Data Controller in respect of the personal data you provide via the Report and Support System. We manage personal data in accordance with the General Data Protection Regulation (GDPR) and the University’s Data Protection Policy.
How we use the personal data you submit?
We use the information we collect from you, including personal data, about incidents and/or concerns in order to:
- Provide you with appropriate support, from a suitable advisor, following the incident and/or concern you have submitted.
- Investigate reported incidents and take appropriate action in accordance with your wishes.
- Better understand the type and nature of incidents at the University with a view to preventing instances of hate crime, sexual assault and sexual harassment incidents that occur.
Recipients - Do we share the data with third parties?
- If you report a named individual, we may be required to share details of your complaint with them for us to fully investigate and consider an appropriate outcome. Details of your complaint will also be shared with relevant witnesses and staff members (including panel members who are asked to consider the case).
- If you also report the incident and/or concern to the police and they approach us for the information submitted, we may disclose this in order to support the police investigation.
- If your reported incident and/or concern is relevant to on-going safeguarding matters and there is a pressing need, which cannot reasonably be ignored, we may report the incident to the police.
We also utilise the services of Culture Shift in order to host and support our instance of the Report and Support System. This is under the terms of an agreed data processing contract that restricts use, and sets out confidentiality and information security requirements.
We use Google Analytics cookies to track your usage of our Report and Support website. This tracking information enables us to enhance the usability and performance of our website and Report and Support services. No personally-identifiable information is recorded. Please read our Report and Support Cookie Policy for more information, including how to opt out.
We use Google Analytics cookies to track your usage of our Report and Support website. This tracking information enables us to enhance the usability and performance of our website and Report and Support services. No personally-identifiable information is recorded. Please read our Report and Support Cookie Policy for more information, including how to opt out.
Our lawful basis for processing
As a public authority acting in the public interest we rely upon the ‘public task’ lawful basis in order to use your personal data as described above. The public interest is to support victims of hate crime, sexual assault and sexual harassment incidents; to safeguard and to prevent incidents occurring. Our clear basis in law is our general duty of care to our students and staff to act reasonably to protect health, safety and welfare.
If your submission includes personal data classified as ‘special category’ or ‘criminal offence data’ under the GDPR we will rely upon: Article 9 (2)(g) - The processing is necessary for reasons of substantial public interest in order to:
- Satisfy our duty of care to protect the health, safety and welfare of our students and staff.
- To prevent or detect unlawful acts.
- To safeguard individuals at risk from neglect, physical, mental or emotional harm .
- To protect our students and staff from dishonesty, malpractice, serious improper conduct and unfitness.
- To provide a confidential counselling service to our students and staff.
Your data subject rights
You have the following rights in respect of the personal data you submit:
- The right to erasure (right to be forgotten) – this means that you can request that we delete the information you submit within the system.
- The right to rectification – this means that you can request that we amend the personal data we hold about you if you believe that something has been incorrectly recorded.
- The right to restrict processing – this means you can ask us to hold and use your personal data in certain ways which restricts how we use your information.
- The right of access – this means that you can ask to see a copy of the information held about you in order to satisfy yourself that we are processing your personal data in accordance with our GDPR obligations.
Data retention
Unless you ask us to dispose of your personal data sooner as per your data subject rights, we will retain your submission in a manner which identifies you for 6 years from the date that we close your case.
Further information
For further information about data protection at the University, how we process your personal data as a student, contact details for the University’s Data Protection Officer, and your full data subject rights, including how to lodge a complaint with the ICO (supervisory authority for data protection), please refer to the Student Privacy Notice .
Contacting us
For questions or concerns about: this Privacy Notice, our use of your personal information in respect of the Report and Support System and / or exercising your data subject rights please contact Lyle Millard on L.Millard@mmu.ac.uk / 0161 247 3702 in the first instance.
Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.
Supervisory authority
Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.
Supervisory authority
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of our processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. See: https://ico.org.uk/global/contact-us/ for contact information.
Updates to this privacy notice
We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.