University of London - Report and Support Privacy Notice 

1. Introduction 

The University of London (“the University”, “we”, “us”, or “our”) is committed to protecting your personal data and ensuring transparency in how it is used. 

This privacy notice explains how we collect, use, and protect personal data when you use the University’s Report and Support service, an online platform provided by Culture Shift, which enables individuals to report incidents and access support. 

2. Who We Are 

The University of London is the data controller for personal data processed through the Report and Support service. 

Contact details: 

University of London 

Senate House 

Malet Street 

London WC1E 7HU 

Email:  

Data Protection Officer (DPO): 

Email: data.protection@london.ac.uk  

3. What Is Report and Support? 

Report and Support is an online system available to students, staff, and visitors to: 

  • Report incidents such as harassment, bullying, discrimination, sexual misconduct, or hate incidents 
  • Access information about support services 
  • Understand University policies and procedures 
  • Choose to report anonymously or with contact details 

4. What Personal Data We Collect 

a. Anonymous reports 

You may submit a report without identifying yourself. If an anonymous report is made, the Report and Support tool is set up so that we do not know who has made the report. The University of London discourages the provision in anonymous reports of names or other information that could be used to identify a third party. However, if any such information is shared, University of London will use that information in order to review and process the report.  

Anonymous data is used primarily for monitoring the rates of these incidents in order to support our prevention work. 

b. Named reports 

If you choose to provide your identity, we may collect: 

  • Name and contact details 
  • University status (student, staff, visitor) 
  • Department (where relevant) 
  • Details of the incident 
  • Information about others involved (for example, names, department, job title, if you are a staff, student or visitor) 
  • Any supporting evidence 

c. Special category (sensitive) data 

Due to the nature of reports, we may collect special category information such as: 

  • Health or wellbeing information 
  • Sexual orientation 
  • Race or ethnicity 
  • Religion or beliefs 

This data is only collected where necessary to provide support and respond appropriately. 

5. How We Use Your Information 

We use your personal data to: 

  • Provide advice, support, and guidance 
  • Assess whether action or intervention is required 
  • Investigate issues in line with University policies (for named reports) 
  • Identify and monitor incidences and risks using anonymised, aggregated data 
  • Develop policies, training, and preventative strategies 
  • Meet our legal and regulatory obligations 

Important 

Anonymous reports are used to take action against identifiable individuals in exceptional circumstances. This is where it is required by our Legal and Regulatory obligations and will always be carried out in conjunction with our institutional and safeguarding requirements.  

6. Lawful Basis for Processing 

We process personal data under: 

  • Legal obligation – to comply with duties under legislation such as the Equality Act 2010, Worker Protection Act 2023, and regulatory requirements (e.g. OfS Condition E6) 
  • Legitimate Interest – we have a Legitimate Interest in protecting and supporting our community  
  • Employment and social protection law (where applicable) 

7. Special category data 

We process special category data (under Article 9 of the UK GDPR) under: 

  • Substantial public interest (for special category data), including safeguarding and equality monitoring under Schedule 1 of the Data Protection Act 2018, paragraph 18, paragraph 8  
  • Employment and social protection law (where applicable) 
  • Legal claims and judicial acts 

8. Sharing Your Information 

Your data will be handled confidentially. It will be shared only where necessary: 

Internal sharing 

  • Trained case managers 
  • Relevant University services (e.g. HR, student services, safeguarding) 
  • Senior governance groups (in anonymised form only) 

External sharing 

We do not routinely share identifiable data externally. However, we may share information: 

  • With external support services (with your consent where appropriate) 
  • With law enforcement or regulators where required 
  • To prevent serious harm or risk 

Platform provider 

The system is provided by Culture Shift, which acts as a data processor on behalf of the University. 

9. Data Storage and Security 

  • The platform is hosted on Amazon Web Services (AWS) in the London region 
  • Data is encrypted in transit (TLS/SSL) and at rest 
  • Backups are encrypted and stored in a separate secure region 
  • Access is restricted to authorised staff using secure login and two-factor authentication 
  • No personal data is stored on local devices 

10. Data Retention 

We retain data only as long as necessary: 

  • Case data: typically, up to 6 years after case closure (aligned with legal limitation periods) 
  • Anonymous reports: retained in anonymised form for statistical analysis 

Data is automatically deleted in line with defined retention schedules. 

11. Confidentiality and Safeguarding 

We aim to respect your confidentiality at all times. However, we may need to share information without your consent if: 

  • There is a risk of serious harm to you or others 
  • There are safeguarding concerns 
  • We are legally required to do so 

12. Your Rights 

Under UK data protection law, you have the right to: 

  • Access your personal data 
  • Correct inaccurate data 
  • Request deletion in certain circumstances 
  • Restrict or object to processing 
  • Request portability where applicable 

To exercise your rights, contact: [data.protection@london.ac.uk] 

You can also complain to the Information Commissioner’s Office (ICO): 

https://www.ico.org.uk 

13. Use of Anonymised Data 

We use anonymised and aggregated data to: 

  • Identify and monitor the rates of these incidents in order to support our prevention work. 
  • Inform prevention strategies 
  • Improve services 
  • Support institutional reporting 

This data does not identify individuals. 

14. International Data Use 

The Report and Support service is available globally, including to students studying outside the UK. 

All personal data is processed and stored in accordance with UK data protection law. 

15. Changes to This Notice 

We may update this notice periodically. The latest version will always be available on the University website. 

16. Contact 

For questions about this notice or your data: 

Data Protection Officer 

Email: data.protection@london.ac.uk  

 

There are two ways you can tell us what happened

Share anonymously or Share with contact details