Privacy notice

Who decides

Bamenda Polytechnic decides what your information is used for: it is the controller. Virtual Minds Hub runs VemTrace for it as a processor.

[To be confirmed: the legal entity and address of Virtual Minds Hub.]

[To be confirmed: what Virtual Minds Hub may do with your information under its contract with the institution.]

Privacy contact: Bamenda Polytechnic

What is collected

• Your name, ID number and contact details, from the institution’s records or from what you type.
• What you write in a request or report, the files you add, and what staff reply and decide.
• Sign-in codes and sessions, and a log of who did what, for security and audit.
• Your internet address, to limit abuse. On the anonymous report page it is not kept.

Why

To receive, route and answer requests, to keep the institution’s records, to keep the service secure, and to tell you what happened to your request.

[To be confirmed: the legal basis for each of these purposes.]

Cookies

There are no advertising or tracking cookies. These keep the site working:

• vt_member: keeps a student signed in
• vt_session: keeps staff signed in
• vt_apex: keeps you signed in on the main VemTrace address
• vt_state: protects the sign-in round trip
• vt_flow: protects the sign-in round trip
• vt_who: remembers that this browser last signed in as staff
• vt_lang: remembers your language
• vt_pending: holds your ID number between the two sign-in steps
• vt_pending_via: remembers how your sign-in code was sent
• vt_theme_preview: lets an administrator preview a draft look
• vt_back: brings you back to your institution after signing out
• vt_invite: holds a staff invitation during sign-in

[To be confirmed: whether Cloudflare’s robot check sets a cookie of its own.]

Who else sees it

Cloudflare runs the robot check on the sign-in, request, report, incident, verification and widget forms, so it sees your connection, not what you write.

When something breaks, an error report goes to our error tracking with personal details removed. Your browser sends none from the anonymous report page. If the server fails there, its report has no browser details and its time is rounded to the hour.

[To be confirmed: where the error tracking service is hosted.]

Mail goes through the institution’s or our mail service. Queued mail is removed 30 days after it is delivered.

AI help runs only where the institution has switched it on. The triage helper and the student assistant are not given confidential requests. One exception: when a case officer asks for help redacting a case file, that file’s text goes to the AI, and it can come from a confidential request.

[To be confirmed: the AI provider, where AI help is on.]

Where it is kept

[To be confirmed: where the servers and backups are hosted, and any transfer abroad.]

How long

As this institution has set it:

• Files of requests never sent: 7 days
• Files of decided requests: 730 days
• Ended sessions and sign-in codes: 30 days
• Audit log: 2555 days
• Data exports: 7 days

Your rights

You can ask to see your information, to correct it, or to have it erased where the law allows. Ask the institution.

[To be confirmed: which rights apply under the law, and who to complain to.]