Privacy Notice – Sexual Harassment Support Service
The support service will provide members with the ability to report incidents of sexual harassment in the workplace and to seek the support and advice they need. Individuals will also be able to get support for personal cases when required. The support service will also enable the union to collate data to identify trends or patterns of behaviour in workplaces or employer so they can be addressed on a collective basis.
Data Controllers
The data controller is Prospect, and the Data Protection Compliance Officer can be contacted as follows:
Prospect, 100 Rochester Row, London, SW1P 1JP
Tel: 0207 346 0911
Email: [email protected]
How do we collect your personal data?
We will collect the personal data directly from you when you complete the web form or when you ring the support service number.
We may also collect data on third parties who are identified in information provided to us. This information will only be retained if necessary.
What Information we collect about you and why.
The personal data we collect is used to administer the scheme. We will use your telephone number and/or email address to contact you to provide you with the advice/support needed.
We will ask you for the details of an incident including your employer/workplace. This information will be used to allocate it to the appropriate staff member.
If a personal case is opened, then the information will be used to allocate to the appropriate team for support.
All Information supplied by members, non-members or anonymously will be logged into a database. This will be used to identify trends in workplaces and used by teams to take collective action as necessary.
Special Category Data
We will need your trade union membership number to confirm you are a member.
When reporting an incident the information may include racial or ethnic origin, sex life or sexual orientation.
Criminal Data
When an incident is reported this may also contain information about a third-party individual either the harasser or as a witness. Depending on the seriousness of the incident this may contain allegations of a criminal nature.
What is our Purpose and Lawful Basis for Processing Your Personal Data.
The lawful basis we rely on to process your personal data is Legitimate Interest, Article 6(1)(f) of UK GDPR
- To administer the support service scheme.
- To follow up on submissions and to provide general advice and support as the individual requires.
- To record information in a database to identify trends in employment/workplaces.
- To record information from non-members and anonymous callers in the database of incidents.
- To share information on trends with relevant teams/officers for collective action.
The lawful basis we reply on to process your personal data when a personal case is opened is Article 6(1)(b) contract, as this is a service we offer as part of membership of the union.
Special Category Data
The lawful basis we rely on to process special category data is the processing is carried out in the course of our legitimate trade union activities, Article 9 (2)(d) of UK GDPR, which is to maintain and improve the conditions of employment of members and the relationship between them and their employer.
The lawful basis we rely on to process personal data provided to us by individuals which may include allegations about a third party which are of a criminal nature is that we have a substantial public interest to prevent or detect unlawful acts (Schedule 1, Part 1&2, 10).
The processing is also necessary for the provision of a confidential counselling, advice or support service (Schedule 1, Part 1&2, 17). Data will be provided without the consent of the third party.
The conditions for this are set out in our appropriate policy document.
Who do we hold personal data about?
We hold personal data about members who contact the support service for advice and assistance. We will also hold personal data of non-members.
We may also hold data about other individuals who have been identified in incidents.
Who will process your personal data?
We will not share your personal data with anyone outside the union.
Do we transfer data outside the UK?
The personal data we collect will not be transferred outside the UK.
How long will we retain personal data?
Your data will be retained for the following periods.
Case files will be retained for 7 years from the date the file is closed.
Personal case file will be retained for 7 years from the date the file is closed.
Information on the database will be retained for 7 years.
Your rights in relation to your data
You have the right to request a copy of the personal information that we hold about you. This right always applies to all the personal data we process. There are some exemptions which means you may not always receive all the information we process.
Your right to rectification (Article 16)
You have the right to ask us to rectify information you think is inaccurate, and to complete information you think is incomplete. This right always applies to all the personal data we process.
Your right to erasure (Article 17)
In certain circumstances you can ask for the data we hold about you to be erased from our records. There are also exemptions to this right which means we may not always be able to comply with your request.
Your right to restriction of processing (Article 18)
You have the right to ask us to restrict the processing of your personal data in certain circumstances.
Your right to object to processing (Article 21)
You have the right to object to processing of your personal data if it is processed on the grounds of legitimate interest.
Further details about UK GDPR and your rights under UK GDPR can be found on the ICO’s website at https://ico.org.uk/.
Complaints
If you wish to make a complaint about the way your data has been used or to assert your rights, please contact the Data Protection Compliance Officer on [email protected]
You can also make a complaint to the Information Commissioner’s Office; the contact details are:
ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113
This notice maybe updated periodically. We will inform members of the changes and the date on which they take effect.