Complaints Handling Privacy Notice

B: The type of personal information we collect

C: How we get your personal information and why we collect it

D: How we store your personal information

A: Introduction

This privacy notice describes how Abertay University processes personal data for the purpose of administering the Complaints Handling Procedure.

The notice also explains how we use your personal data in accordance with your rights under the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

B: The type of personal information we collect

We currently collect and process the following information:

Information such as your name, status (i.e. student, staff or member of public), student ID (if applicable), email address and telephone number.
Information relating to your academic school, programme of study and year of study (if applicable).
Details of anyone you have chosen to represent you.
Information relating to the nature of the complaint such as the relevant staff/students name, the location and the University School, Service or Department involved.
We may also collect information including ethnic/racial origin, disability, religious belief, gender, age, sexual orientation, and national (UK/EU/international) status.

C: How we get your personal information and why we collect it

Most of the personal information we process is provided to us directly by you for the following reason(s):

To respond to complaints.
To enable members of staff in the relevant University departments to investigate and make decisions on complaints.
To refer to previous decisions if you contact Complaints Handling again.
To monitor and evaluate complaints for quality assurance as required under the Quality Assurance Agency for Higher Education (QAA) Code on Appeals and Complaints; and as required by the Scottish Public Services Ombudsman (SPSO).
The provision of quarterly and annual reports on complaints handling provided to the University’s management and committees. All reports are comprised of anonymous statistical information, so your privacy is not affected.
The University has a legal requirement to monitor student information including ethnic/racial origin, disability, religious belief, gender, age, sexual orientation, and national (UK/EU/international) status, and similar, in relation to student complaints, to ensure that no particular group is discriminated against, and to comply with equality and diversity legislation. This information is used securely and confidentially by a small number of administrative staff, for statistical monitoring and anonymised reporting only, to ensure non-discrimination.

We also receive personal information indirectly, from the following sources in the following scenarios:

Information including ethnic/racial origin, disability, religious belief, gender, age, sexual orientation, national (UK/EU/international) status, course and student status may be collected from University systems (if applicable).
Partner institutions.
Other relevant parties.

We may share this information with the following internal and/or external parties:

Members of staff to investigate and respond to complaints.
Personal data may be disclosed to the SPSO in connection with any complaint which you may ask the SPSO to investigate.

Some statistical and/or anonymised reporting information will be published and disclosed to relevant external regulatory bodies, as required by the Equality and Human Rights Commission and the SPSO.

Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:

We need it to perform a public task. We process your personal data to carry out our public task to provide education under the Further and Higher Education Act 1992, part of which involves us operating a suitable complaints process.

Under Article 9 of the UK GDPR, the lawful bases we rely on for processing your special category information are (e.g. health, ethnic/racial origin, disability, religious belief, sexual orientation, or information about your sex life):

Reasons of substantial public interest (with a basis in law). Your personal data is processed for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enabling such equality to be promoted or maintained. This is enabled by the Data Protection Act 2018, Schedule 1, Part 2 – s8 – equality of opportunity or treatment and the Equality Act 2010.

We may also be required to process your special category information where this is necessary in order to properly conduct the complaints process. This is also on the basis of substantial public interest (with a basis in law) enabled by the Data Protection Act 2018, Schedule 1, Part 2, - s6 – Statutory purpose (i.e. to deliver and manage education under the Further and Higher Education Act 1992).

D: How we store your personal information

Your information is securely stored using the University’s business systems. The University is obliged to protect personal data under the UK GDPR and Data Protection Act 2018 and has established protocols for the safeguarding of data.

The University will retain your personal data only as long as is necessary in accordance with the JISC record retention guidance (last action on case + 6 years).

E: Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you or in certain circumstances we may extend our time to respond by a further two months, considering the complexity and number of requests.

Please contact us at complaints@abertay.ac.uk if you wish to make a request.

F: How to contact us

If you have any concerns about our use of your personal information, you can contact the University’s Data Protection Officer (DPO):

Data Protection Officer
Abertay University
Kydd Building
Bell Street
Dundee DD1 1HG
Tel: 01382 308000 Email: dataprotectionofficer@abertay.ac.uk

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

G: Changes to this Notice

We may update this notice at any time. Please check this notice regularly to be aware of any changes and should any change affect your rights and interests, we will bring this to your attention and explain any impact to you.