About this notice
This privacy notice explains how Regent College London (RCL), as a data controller under Article 4 of the UK General Data Protection Regulation (UK GDPR), collects and uses personal data of individuals who use the Report and Support tool. It is in addition to RCL’s main Privacy Policy and Data Protection Policy. This notice will be reviewed annually and updated where necessary.
Contact details
Regent College London is the data controller. If you have any questions about this privacy notice or how your data is handled, please contact:
Data Protection Officer (DPO):
Email: dpo@rcl.ac.uk
Address: Regent College London, Carmine Court, 202 Imperial Drive, Harrow, HA2 7HG
Phone: +44 (0) 203 870 6666
How we collect your personal data
This tool allows RCL community members to report incidents such as bullying, harassment, sexual misconduct, gender-based violence, and hate crime. In doing so, you may provide personal data including:
- Contact details
- Demographic data (e.g. status, gender, ethnicity)
- Special category data (e.g. health, sex life, racial or ethnic origin)
- Allegations about criminal behaviour
You may also submit data about other individuals (e.g. witnesses or alleged perpetrators).
Purpose and lawful basis for processing
We use your personal data for the following purposes:
Purpose | Legal Basis (UK GDPR) | Special Category Basis (UK GDPR / DPA 2018) |
Identify appropriate support/contact for you | Consent (Art. 6(1)(a)) | Explicit consent (Art. 9(2)(a)) |
Review and take forward complaints or investigations (e.g. HR, Quality & Governance) | Legal obligation (Art. 6(1)(c)); Legitimate interest (Art. 6(1)(f)) | Substantial public interest – safeguarding/disciplinary (Art. 9(2)(g); DPA 2018 Sch. 1, Para 10, 18) |
Protect your or another’s vital interests | Vital interests (Art. 6(1)(d)) | Vital interests (Art. 9(2)(c)) |
Anonymised monitoring to identify trends | Legitimate interest (Art. 6(1)(f)) | Not applicable if data is anonymised |
Third-party data (witnesses and alleged perpetrators)
Where information about third parties is provided, we process this data under our legitimate interest (Article 6(1)(f)) and/or for substantial public interest (safeguarding, prevention of harm). We may not inform these individuals directly if doing so would seriously impair the purpose of the processing or pose a risk to you or others, in line with Article 14(5)(b).
Who we share your data with
We will only share your data with relevant RCL staff on a need-to-know basis. This may include:
- Safeguarding Officers
- Human Resources or Quality & Governance (depending on whether you are staff or student)
- Police or external authorities, where required by law or to protect vital interests
The platform is provided by a contracted third-party service provider (insert provider name), who hosts the system securely on RCL’s behalf. The provider cannot access or view your data.
International data transfers
All personal data is stored in the UK. If data is ever processed or stored outside the UK, appropriate safeguards (such as Standard Contractual Clauses) will be implemented to ensure compliance with Chapter V of the UK GDPR.
How long we keep your data
Personal data submitted through Report and Support will be retained for six years from the date of the report. This period is based on RCL’s legal obligations and risk management needs (e.g. safeguarding, potential investigations or legal claims).
Your rights
Under the UK GDPR, you have the following rights:
- Access – Request a copy of your personal data
- Rectification – Correct inaccurate or incomplete data
- Erasure – Request deletion of your data in certain circumstances
- Restriction – Ask us to limit processing
- Objection – Object to processing based on legitimate interest
- Portability – Receive your data in a structured, commonly used format (where applicable)
- Withdraw consent – Where processing is based on consent, you can withdraw at any time
You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.
To exercise any of your rights, please contact the DPO at the details provided above.
Cookies
Cookies are small text files stored on your device. This site uses:
- Essential cookies – Required for site functionality
- Analytics cookies – From Google Analytics, used to understand how users interact with the tool
- Analytics cookies (e.g. _ga, _ga_LZGM7YV9XM) are only set if you provide consent via our cookie banner. You may manage cookie settings at any time in your browser.
For more information: www.allaboutcookies.org
To opt out of Google Analytics tracking across websites: tools.google.com/dlpage/gaoptout
Security
All data submitted through this tool is encrypted in transit and at rest. Access is strictly limited to authorised personnel. The system is penetration-tested annually by a CREST-approved independent assessor.
External links
This platform may include links to third-party websites. Please be aware that these sites have their own privacy policies, and RCL is not responsible for their content or data handling.