Complaints Policy

We are committed to protecting personal data and respecting the privacy rights of individuals.

This Policy explains how we handle complaints relating to the collection, use, storage, disclosure, security, retention or other processing of personal data, and how individuals can raise concerns about our handling of their information.

We aim to investigate and resolve complaints fairly, transparently and within a reasonable timeframe, in accordance with UK data protection legislation.

If you have a concern about how we process your personal data, you may contact us using any of the communication methods provided on our website or in our privacy notice. You may be asked to complete a form with details of your complaint.

To help us investigate your complaint, please provide:

• Your name and contact details; 
• Details of your concern; 
• Any relevant dates or correspondence; and 
• Any supporting information you believe may assist our investigation. 

Where necessary, we may ask for additional information to verify your identity before responding to your complaint.

When we receive a data protection complaint, we will carry out an investigation in accordance with this section. 

4.2 Acknowledgement

We will acknowledge receipt of your complaint within 30 days and provide:

• Confirmation that your complaint has been received; 
• A reference number (where applicable); and 
• Information about the next steps in the process. 

4.3 Investigation

We will investigate the matters raised and take reasonable and proportionate steps to:

• Establish the relevant facts; 
• Review the processing activities concerned; 
• Assess compliance with applicable legal obligations; and 
• Determine whether corrective action is required. 

During the investigation, we may consult relevant departments or specialist advisers where necessary.

If your complaint relates to a personal data breach, we will investigate the matter in accordance with our internal incident management procedures and any applicable legal reporting obligations.

4.4 Outcome

Following completion of our investigation, we will provide a response setting out:

• Our findings; 
• Any action taken or proposed; 
• The reasons for our decision; and 
• Information about further escalation options where appropriate. 

If you are dissatisfied with our response, you have the right to raise your concerns with the UK Information Commissioner's Office (ICO).

You can reach them at www.ico.org.uk

Nothing in this Policy affects your right to contact the ICO at any stage.

We will handle complaints confidentially and will only share information where necessary to:

• Investigate and resolve the complaint; 
• Comply with legal or regulatory obligations; or 

• Protect our legitimate business interests. 

   

We maintain records of data protection complaints and their outcomes to help us:

• Demonstrate compliance with legal obligations; 
• Monitor service quality; 
• Identify trends and recurring issues; and 
• Improve our data protection practices. 

Complaint records are retained in accordance with our records retention requirements and applicable legal obligations.

We periodically review complaints received under this Policy to identify opportunities for improvement and to ensure continued compliance with applicable data protection legislation.

This Policy may be updated from time to time to reflect changes in legal, regulatory or business requirements.