Whistleblowers

This privacy notice relates to the processing of personal data in response to a report in the context of the whistleblower scheme within Ghent University.

Why does Ghent University process data relating to whistleblowers?

The personal data are processed by Ghent University in a careful manner and exclusively for the following purposes:

  • To comply with the legal obligations regarding the reporting of breaches under the whistleblowing system (EU Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law).
  • To transfer personal data as evidence to judicial authorities if there are justified suspicions of unlawful acts (legal obligation)
  • To defend ourselves in the event of legal proceedings (legitimate interest)

What data is processed?

The personal data may relate to

  • the whistleblower
  • the reported persons involved in the report or complaint
  • third parties named or contacted during the whistleblowing procedure

Ghent University processes the following personal data of the whistleblower:

  • Personal identification data: surname, first name, position, relationship with Ghent University.

Regarding the report and the investigation:

  • All types of personal data that are communicated to us by the reporter or that are reported or described during the investigation. Special personal data may also be communicated in this process.

With whom is the personnel data shared?

The following recipients may receive personal data from you:

  • Yourself
  • The persons authorized to receive and investigate your report. If necessary for conducting a thorough and confidential investigation, other (external) parties may be involved in the investigation and have access to certain personal data.
  • Government or judicial authorities, insofar as UGent is obliged to send them your personal data (e.g. tax authority, police or law enforcement).

How long will your data be kept?

Ghent University does not store your personal data longer than is strictly necessary for the purposes for which your personal data are provided.

  • Reports that have been closed as unfounded will be deleted after one year;
  • Reports that have been considered well-founded are kept for ten years;

If a new report is made about an infringement that was previously mentioned in the register, the retention period of the original report will be brought into line with the new retention period. If disciplinary or judicial proceedings are initiated, the report will be kept until the end of any appeal proceedings.

If there is a legal obligation, the above periods can reasonably be extended.

Contact

If you have any questions, comments or suggestions about the processing of your personal data, please contact the integrity advisor by e-mail via integriteit@ugent.be or the Data Protection Officer via privacy@ugent.be.

If you wish to submit a complaint about the processing of personal data, you can also contact the Data Protection Authority.