Notice on the processing of data relating to the management of whistleblowing alerts and internal reports

In the context of the legislation on the protection of persons who report breaches of Union law, UNamur has put in place a whistleblowing policy. This policy includes the possibility of submitting internal reports via a platform, either anonymously or not. The technical management and operational follow-up of internal and external reports involve the processing of personal data.

For the purposes of this activity, UNamur processes data falling into the following categories:

• General identification data [category grouping the following type of data: surname, first name, postal address, email addresses, copy of identity card, identity photograph, telephone number …]
• Professional data [category grouping the following type of data: data relating to profession or professional activities, position in an entity outside the University, professional affiliations, paid educational leave…]
• Any information provided in the report or obtained in the course of handling the report and of the investigation carried out to follow up on a report. 

More specifically in connection with the use of the reporting platform: 

• Connection and logging data [category grouping the following type of data: connection dates and times, type of operation performed, user ID, IP addresses, type of data accessed …]
• The language used by the reporting person is stored in a cookie on the Platform.

These data are used to:

• Manage the collection, recording and storage of reports
• Validate the admissibility of the report 
• Manage the follow-up of the report, including with the reporting person. 

This management is to be understood broadly as regards the nature of the operations that may be undertaken to investigate the report. Depending on its subject matter, the investigation may take various forms in order to carry out the necessary checks and adopt measures. Furthermore, the investigation of the report may lead to other processing operations, such as complaints, proceedings or sanctions.

The activity is necessary for compliance with a legal obligation (Article 6, 1, c) of the GDPR).

The processing operations relating to the receipt, validation and investigation of reports are based on the Act of 28 November 2022 on the protection of persons who report breaches of Union or national law identified within a legal entity in the private sector, and on its implementing decrees.

In pursuit of the aforementioned purposes, UNamur is also required to process data falling into the following special categories:

• Data relating to health 
• Data relating to trade union membership
• Data relating to political opinions
• Data relating to religious or philosophical beliefs
• Data relating to sex life or sexual orientation
• Data relating to criminal convictions or offences

The processing of data falling into these special categories is justified on the grounds that it is necessary for reasons of substantial public interest (Article 9, 2, g) of the GDPR).

The categories of persons whose data are processed for the purposes of the activity are as follows:

• Users: persons who have access to the whistleblowing software platform, who receive the whistleblowing reports submitted, or who assign roles and responsibilities within the platform;
• Reporting persons: persons who submit a report;
• Reported persons: persons who are the subject of a report;
• Report handlers: users or other persons designated by UNamur who are responsible for receiving and investigating reports submitted via the platform or through another channel. 
• Third parties: persons who are not the subject of the report but who are mentioned in it or subsequently involved in the context of, and for the purposes of, following up reports (for example, subject-matter experts, facilitators, line managers, witnesses...).

The data included in the processing activity come from the following source(s):

• The data subject provided the data themselves
• The data are generated by an activity of the data subject
• The reporting person may provide personal data relating to third parties

Data are processed solely by University individuals and departments for the purposes of carrying out the activity. Internal data recipients mainly belong to the following categories:

• The person responsible for receiving reports 
• Report handlers 
• Members of the University’s bodies who receive the data pursuant to the internal whistleblowing policy
• With regard to checks and investigative measures, any person whom the report handlers consider it necessary to contact in order to obtain information or take action internally or externally (for example, a law firm)

External data recipients belong to the following categories:

• With regard to data stored or processed via the Platform, the service provider acting on behalf of and on the instructions of the University
• With regard to checks and investigative measures, any person whom the report handlers consider it necessary to contact in order to obtain information or take action (for example, a law firm)
• Public authorities responsible for following up offences, pursuant to the internal whistleblowing policy

The retention period is determined according to the following criterion or criteria:

• The need to retain data for operational purposes depending on the purpose for which they are used. Data are retained for as long as necessary to investigate the reports. Relevant information may also be retained and processed separately if the report leads to a complaint, proceedings or sanctions. 
• Compliance with one or more mandatory statutory retention periods imposed by law. The report, the acknowledgement of receipt, the investigation report and the feedback are recorded in a register in compliance with confidentiality requirements and the requirements of the Act of 28 November 2022.

Data subjects have rights, which are described on the www.unamur.be/en/privacy-policy page. To exercise these rights, data subjects may contact the Data Protection Officer (dpo@unamur.be).