Data Protection Complaints Procedure

Data protection complaints procedure 

How to complain about our use of your personal data 

  1. What this procedure is for

This procedure applies if you think we have got something wrong in the way we have collected, used, shared, stored or deleted your personal data or in the way we have handled a request to exercise your data protection rights. 

It sits alongside our general complaints process. If you are not sure which applies, send it to us anyway and we will make sure it reaches the right people. You will never be sent away because you used the wrong route. 

Examples of things this procedure covers: 

  • We have used your personal data in a way you did not expect or agree to. 
  • We are holding information about you that is wrong, out of date or excessive. 
  • We have kept sending you marketing after you unsubscribed. 
  • We have not responded properly, or at all, to a request to see, correct or delete your data. 
  • We have shared your personal data with someone we should not have. 
  • You think our website’s cookies or tracking are not behaving as our policy says. 
  • Your personal data has been lost, or exposed to someone who should not have seen it. 
  1. How to complain

Use whichever of these suits you. We accept complaints however they reach us including by phone, by email to a general inbox, or through a social media message. You do not have to use the form, and you do not have to use the word “complaint”. 

Route 

Details 

Email 

[email protected] 

Telephone 

+44 (0) 1743 636300 ask to speak to the person responsible for data protection, Simon Jeavons or Mike Davis. If they are not available we will take your details and call you back. 

Post 

Data Protection, Shoothill Ltd, Willow House East, Shrewsbury Business Park, Shrewsbury SY2 6LG, United Kingdom 

What to tell us 

You do not need to get this right for us to take your complaint seriously, but the more you can give us, the faster we can deal with it: 

  • Your name and how you would like us to reply to you. 
  • What has happened, and when. 
  • Which of your personal data is involved, as far as you know. 
  • Any reference numbers, correspondence or dates that would help us find the relevant records. 
  • What you would like us to do to put it right. 

If you need help, or are complaining for someone else 

  • If you need this procedure in another format, or would find it easier to complain in a different way, tell us and we will make reasonable adjustments. 
  • You can ask someone else, a relative, a friend, a solicitor or an advice service to complain on your behalf. We will need to be satisfied they are authorised, so we may ask you to confirm it in writing. This is to protect your personal data, not to slow things down. 
  • We accept complaints from children, and from adults on their behalf. We will consider whether a child understands what they are asking, and we will write to them in language appropriate to their age. 
  1. What we will do, and when

Stage 

Timescale 

What happens 

Acknowledgement 

Within 5 working days as our own target; within 30 days at the latest, as required by law 

We confirm we have received your complaint, tell you who is dealing with it and how to reach them, and set out what happens next. Where we can resolve the matter immediately, we will simply do so and tell you. 

Investigation 

Begins without undue delay 

A named member of staff looks into what happened. How far we go will be proportionate to how complex the issue is and how much it affects you, a straightforward marketing complaint takes far less work than a complaint about a data breach. We may come back to you for more information; if we do, please reply as soon as you can, as we cannot progress without it. 

Progress updates 

At least every 20 working days while the investigation is open 

If it is going to take longer than expected, we will tell you where things stand and why, rather than leaving you waiting. We will not hold back the outcome of your complaint because a wider or related issue is still unresolved. 

 

 

 

Outcome 

Within 30 calendar days wherever possible; longer only where the complaint is genuinely complex, and only having told you 

We write to you with: what we found; whether we agree something went wrong, and if we do not, our reasons; what we are doing to put it right and by when; what we are changing so it does not happen again; and how to ask for an internal review or take it to the ICO. 

  1. If you are not happy with our answer

Ask us to review it 

If you think we have missed the point, got the facts wrong, or not gone far enough, reply and ask for an internal review. Please tell us what specifically you disagree with. The review will be carried out by Simon Jeavons, Managing Director and we will write to you with the result within 20 working days. 

An internal review is optional. You can go to the ICO instead, or at the same time. 

Complain to the Information Commissioner’s Office 

The ICO is the UK’s independent regulator for data protection. You have a statutory right to complain to it about our handling of your personal data. You can do this at any time you do not need to have used our procedure first, and you do not need our agreement. In practice the ICO will usually ask whether you have raised the matter with us and given us a reasonable opportunity to respond, so it is generally worth trying us first. 

Information Commissioner’s Office 
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 
Helpline: 0303 123 1113 
Online: ico.org.uk/make-a-complaint 

The ICO does not charge for making a complaint. It offers a live chat service and can take complaints by phone as well as online. 

If you ask us for help contacting the ICO, or want a copy of our correspondence to send with your complaint, we will provide it. 

Going to court 

Nothing in this procedure limits your legal rights. Separately from complaining to us or to the ICO, you can apply to a court for an order requiring us to comply with data protection law, and you may be able to claim compensation for damage, including distress, caused by a breach of it. You may wish to take independent legal advice. 

  1. What we do with complaints internally

So that you know your complaint is not simply filed away: 

  • We keep a record of every data protection complaint: when it arrived and how, when we acknowledged it, what we did to investigate, the outcome, and any action taken. We keep these records for 6 years. 
  • We do not use these records for any purpose other than handling your complaint, learning from it and meeting our legal obligations. 
  • Complaints are reviewed by Senior Management Team at least quarterly to identify patterns and fix underlying causes. 
  • Our staff are trained to recognise a data protection complaint however it arrives, and to pass it to the right person promptly. 
  • Complaining will never affect the service you receive from us, or how we deal with you in future.