Report & Support Privacy Notice
Last updated: November 2021
Summary
This Privacy Notice informs you how we, the Royal College of Art (RCA/the College) as a data controller uses the personal data that you and/or a third party provide to us when using “Report & Support” at the College. Personal data can be anything that relates to you (e.g. your name, email address, health information). Your personal data will be processed by RCA in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act, 2018.
The law surrounding Data Protection is complex and we are committed to helping you understand how it relates to you and your relationship with RCA. If you have any questions or concerns about this, please contact our Data Protection Officer (DPO) at dpo@rca.co.uk
We sometimes provide you with supplementary privacy notices to cover specific circumstances applicable to you. Please see link below for these:
https://www.rca.ac.uk/data-protection-privacy-cookies/
Our purpose(s) for processing your personal data
The principle purpose for processing your personal data is for us to supply you with confidential help and practical support. You are not required to give us your personal data, but if you limit the data you give us it will limit the service we can provide you with.
In addition, the College may process your personal data for other purposes such as:
- To offer additional support in your studies
- In the fulfilment of our public tasks
- To meet our statutory or legal obligations
Lawful Bases
When processing your personal data, UK Data Protection law(s) requires RCA to have a lawful bases for doing so. RCA rely on the following lawful bases for processing your personal data:
In most cases, the College relies upon the Public Interest task lawful basis. This enables us to process your personal data in order to perform a task which is in the public interest. Typically, RCA rely on this lawful basis when processing your personal data for purposes such as providing various student welfare services (e.g. Report & Support), teaching & research.
In other cases, RCA may rely upon (in addition or instead of Public Interest Task) other lawful bases as follows:
- Legal obligation: The College rely upon this lawful basis when needing to comply with our statutory or legal obligations
- Vital interests: On occasion, this lawful basis is relied upon when RCA need to process your personal data in order to protect your (or someone else’s) vital interests. For example, in a life or death situation.
- In certain circumstances, RCA may rely on your consent. Typically, this is in circumstances where any of the above lawful bases do not apply. If so, we will seek your consent or explicit consent to process your personal data. Where RCA do rely upon your Consent, you have the right to withdraw that consent at any time with no detriment to you.
Where RCA process special category data, in addition to the above Legal bases, the College are also required to rely on a separate lawful basis specifically for that special category personal data. The lawful basis the College choose will be dependent on the circumstances associated with that processing but in many cases the processing will take place on one of more of these bases:
- With your explicit consent
- As part of our legal obligations under employment, social protection or social security law
- Reasons of substantial public interest
- In the establishment, exercise or defence of legal claims
- In the interests of public or occupational health
- For scientific, historical research or archiving purposes
Using the above lawful bases, we set out below further detail of why we use your personal data (this is not an exhaustive list, but is intended to communicate more information regarding our purposes for processing your personal data):
- mental health support
- reporting an incident on or off campus during the course of your study
Types of Personal Data we hold and process about you
When you use “Report & Support”, the personal data that the College will depend on the personal data that you choose to give us. As a result, RCA will process a variety of types of personal data. Examples include:
- Your contact details
- Details related to your study
Special Category Data & Criminal Conviction Data
We also obtain, hold and process, special category personal data (the term used by the UK GDPR) or other sensitive data of students. Special category data includes information about someone’s:
- Race
- Ethnic origin
- Politics
- Religion
- Trade union membership
- Genetics
- Health
- Sex life
- Sexual orientation
- Criminal Conviction data
Any emergency contact details provided by you will be used to protect your vital interests and wellbeing and will only be used for this purpose. You should notify the relevant person that you are providing their contact details to the College as your listed emergency contact.
Sharing your personal data with third parties
Sharing of your personal data only takes place if the College has a lawful basis for doing so. This activity is subject to appropriate safeguards including contractual agreements and appropriate technical measures. An example of third parties which RCA would share your “Report & Support” personal data with is the Police if it forms part of a formal criminal investigation.
The College also use third party companies as data processors to carry out certain administrative functions on our behalf. For example, when you use “Report & Support”, you use a platform supplied to RCA by a third-party company. This platform enables us to provide the College’s “Report & Support” services to you. Your personal data will not be used by the third-party company.
If RCA share your personal data outside of the UK, this sharing activity will be proportionate, have a lawful basis and be subject to the appropriate safeguards.
Submission of your Information to HESA
It is a statutory requirement for RCA to send some of the information we hold about you to HESA every year (“Your HESA Information”). HESA is the official source of data about UK universities and higher education colleges.
HESA collects, and is responsible for the database in which your HESA Information is stored. They use this information for their own purposes and share your HESA Information with third parties for specified and lawful purposes.
If you choose to provide information about your disability status, ethnicity, sexual orientation, gender reassignment or religion these may at our discretion be included in your HESA information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010.
To read the full HESA Fair Processing Notice, please visit: www.hesa.ac.uk/about/regulation/data-protection/notices
Keeping your personal data secure
RCA operate secure electronic and physical storage with controlled access for personal data. Such access is controlled on a need to know basis. The College employ robust technical measures such as encryption when storing and transmitting your personal data. Access to physical records is strictly controlled. RCA staff are subject to mandatory data protection and information security training. All staff and any third parties who process your personal data are aware of our comprehensive policies and processes and their obligations in handling your personal data.
How long we keep your personal data for
RCA will only keep your personal data for the amount of time it is needed in order to fulfil the relevant processing activity/purpose. Please contact dpo@rca.ac.uk for further information on the policy/schedules.
Your rights & how to contact us
When RCA process your personal data, the UK GDPR provides you with the following qualified rights:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
For any questions relating to the processing of your personal data or if you wish to exercise any of your qualified rights, please email dpo@rca.ac.uk. Alternatively, you can write to us at the following address:
FAO: The Data Protection Officer
Royal College of Art
Kensington Gore
London
SW7 2EU
You also have the right to make a complaint to a data protection supervisory authority (the Information Commissioner’s Office in the UK). However, if you have any concerns about how your personal data is processed by RCA, please contact us in the first instance using the contact information above.