Privacy notice

The University has a legal obligation to consider complaints made to the University.  In the course of exercising this legal duty, information about complainants (whether students, staff members, applicants for admission or members of the public) can be considered by the Investigations Manager, Complaint Investigators, and other staff directly involved in the process of handling complaints.  

All information processed in relation to investigations under the Complaint Handling Procedure will be treated confidentially, in line with the University of Edinburgh’s Data Protection Policy.

This information will be stored securely, and will be shared with members of University staff involved in the resolution of your complaint. All staff involved in the handling and processing of sensitive personal data or Special Category data have a duty of confidentiality in relation to the content and processing of this data.

The University does not use automated decision making or profiling in relation to complaint investigations. A human decision maker will always be involved before any decision is reached in relation to you.

The University of Edinburgh will not share your information with any third parties, unless required to do so by law.

How long the University will hold this information

Information about complainants will normally be retained for 5 years after the complaint has been closed, and subsequently destroyed. In some circumstances, the University may retain information longer where a case might be relevant to an ongoing relationship between the individual and the University.

Data Controller and Contact Details

For data collected under this privacy notice, the University of Edinburgh (the “University”) is the Data Controller (as that term is defined in the EU General Data Protection Regulation (Regulation (EU) 2016/679), registered with the Information Commissioner’s Office, Registration Number Z6426984.

The University's data protection policy, along with contact details for our Data Protection Officer, are available below.

Data Protection Policy 

Data Protection Officer

Legal Basis for Processing

The University’s legal basis for processing personal data for this purpose is a task in the public interest, exercising official authority laid down by law under section 7(1) of the Universities (Scotland) Act 1889 as amended by the Universities (Scotland) Act 1966.  

Secondary Legal Basis (Special Category Data)

The University of Edinburgh recognises that you may be adversely affected in ways which mean that we have to processes ‘Special Category’ data about you, as defined by the General Data Protection Regulation. When processing Special Category Data that you have supplied to us as part of an application or submission, the University must have a legal basis for processing this data. The legal bases under which the University processes Special Category data in relation to these mechanisms are available below.

The remainder of University of Edinburgh’s Privacy Notice is available below.

University of Edinburgh Privacy Notice