Privacy Notice

The College is committed to looking after any information that you make available to us.  We aim to be clear about what we will do with your data.  This privacy notice explains when and why we collect personal information about you and how we will use this information including the ways we might share this with others.  It also explains how we keep your information secure as well as the rights you have in relation to the information we hold about you.

The headings below set out the main information we need to give to you.  

The privacy notice will be regularly reviewed to make sure it contains the most up-to-date information.  We will let you know if we make significant changes to this privacy notice.

If you have any questions about any of the information contained in this privacy notice then you can contact us on gdpr@glasgowclyde.ac.uk 

Glasgow Clyde College (referred to in this Privacy Notice as the “College”, “we”, “our” or “us”) is the Data Controller under the data protection legislation.  This privacy Notice sets out how we process the personal data we collect about you (referred to in this Privacy Notice as “you” or “your”).

You can make a report using Report + Support either anonymously or by providing your name.

If you choose to submit an anonymous report without sharing any identifying information about yourself then no direct action can be taken.  We will use the information gathered only to establish and monitor trends to better inform our decision making and to help us identify whether there are patterns of behaviour that we should address.  We will not take any action to identify individuals from anonymous reports but in order for us to be able to help you fully we encourage you to report with your personal details.  If you choose to make an anonymous report then we would ask that you do not include the names or other information that could be used to identify a third party (such as the alleged perpetrator or witnesses).

If you choose to submit a named rather than an anonymous report then we will process the following personal data about you:-

We will also process the names and other details of any third parties who are involved in the issues reported.  Information relating to an individual’s criminal convictions or past offences (including alleged offences) must not be included in any report.  If it is included then we will delete this before the report is progressed.   

Where you name a member of staff, student or third party within the report then this information may be used to start one of our formal processes if you choose to do so, or for the College to take action if we have safeguarding concerns. You do not have to provide information that will identify others involved in the incident if you do not want to.

The only information we collect will be the information you have chosen to provide to us when you submit your report via the reporting tool.

The main purposes for which we will process the information you have provided are:

When you submit information using the Report + Support tool, you consent to us using this for the purposes set out in this notice. At any time you may withdraw this consent and we will safely and securely delete the information that you have provided to us.

It may also be necessary because the College has a legitimate interest in ensuring staff and students at the College are safe and receiving support for incidents and/or concerns affecting them and to allow us to create a safe and supportive working and study environment.

We will not generally take steps such as investigating the report, initiating disciplinary proceedings or passing information to third parties in order to take the report further unless: (a) you have made a named report and (b) you agree to this action.  On rare occasions the processing may be necessary to you protect your vital interests or the vital interests of another individual, for example because a report reveals a situation that needs the involvement of the emergency services or another external agency.  

Our Privacy Notices provide further information on this.

Where no action is taken the information you provide will be retained in Report + Support for a period of four months, following the date the report is made and will then be destroyed.   Where action is taken we will retain the information provide will be retained in Report + Support for a period of twelve months, following the date the report is made and will then be destroyed.   Where personal data initially collected via the Report + Support tool is then used in connection with a formal process, then the data will be retained in line with the standard retention period for that process.

We may retain some anonymised information in order to monitor our work in this area but you will not be identifiable through this information.

We will always make sure that when we share information about you that we do this in line with the legislation and that we only share the minimum amount of information that is needed.  

Access to personal information submitted through Report + Support will be strictly limited to a small number of College staff in Student Support (for reports affecting College students) or Human Resources (for reports relating to College employees). Where the College carries out a formal investigation following a report we may share limited data about the report with certain College employees, for example an appropriate Assistant Principal. We will aim to notify you in advance of sharing data with these College employees. 

Report + Support is a third-party platform that has been developed by Culture Shift and they host the reporting tool for us.  The College will act as the Data Controller for the information you provide.  We have an agreement in place with Culture Shift to make sure that they handle your data in line with our instructions and the data protection legislation. Culture Shift do not routinely have access to personal data contained in reports made using the Report + Support tool. However, there are times when it may be necessary for Glasgow Clyde College to grant access to Culture Shift, for example, to investigate and remedy security incidents or to provide technical support to us. Such access will be coordinated on a case by case basis, and subject to strict controls.

There are certain circumstances where we may provide information about the matters raised in a report, including personal data, to third parties.  This may include providing personal data about you without your consent. For example where there is a legal obligation to provide information in respect of a court case. There may also be times where we share information provided to us with the police or other social care services.

Personal data included in a report may have to be disclosed by us in response to a subject access request.  This is where the individual who the data is about exercises their right under the law to request a copy of their personal data from us.  A request may be made by the person submitted the report, the person to whom the complaint relates or by a third party referred to in a report.  The College has policies and procedures in place to deal with these requests and will uphold its confidentiality obligations in respect of the report.

We are not obliged to comply with a request if this would mean disclosing information about another individual who can be identified from that information unless (1) the other individual has consented to that disclosure, or (ii) it is reasonable to comply with the request without the other individual’s consent.

Where possible, given the nature of the information in the reports, we will try to avoid disclosing personal information other than that of the individual who has submitted the request, unless explicit consent to the disclosure is given by the other relevant individuals.  However, there may be circumstances in which disclosure may enable to requestor to determine the identity of the person who has made the report, e.g. if a specific event is referred to.  In these cases, we will consider our response carefully and will endeavour to balance the requestors right under data protection law to receive their information against the confidentiality obligations we have towards the person making the report to us.

Under the legislation you have certain rights in relation to the information we hold about you:

Many of the rights above are not absolute so there may be times when you make a request to us and we are unable to meet it in full but if this is the case we will explain to you fully why we have not been able to do what you have asked.  

As mentioned above Report + Support is a third party platform developed by Culture Shift.  You can find out more about how your information is kept safe by them in here - Security - Report + Support by Culture Shift (reportandsupport.co.uk)

In addition, the College will make sure that any staff who are accessing the information you have provided have received appropriate training about their data protection obligations and their duty to keep the information about you safe.

The information you provide will not be transferred out of the EEA.

The Data Protection Officer.  If you have any concerns about how we handle your personal data then you can contact the Data Protection Officer directly by e-mail gdpr@glasgowclyde.ac.uk or by post to Data Protection Officer, Glasgow Clyde College, Cardonald Campus, 690 Mosspark Drive, Cardonald, G52 3AY

If you remain unhappy then you have a right to complain to the Information Commissioners Office:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

e-mail:casework@ico.org.uk and telephone 0303 123 1113