GDPR Complaints Procedure

GDPR Complaints Procedure

Sue Haynes

How I handle your data protection concerns

1. About This Document

This document sets out the complaints procedure for Sue Haynes (referred to as “I”, “me” and “my” throughout this document). It explains how I will handle any complaint you make about the way I collect, use, store, share or otherwise process your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. My Contact Details

All GDPR-related complaints should be directed to me using the contact details below:

3. Your Rights Under UK GDPR

You have the following rights in relation to the personal data I hold about you:

The right to access the personal data I hold about you (a Subject Access Request)

The right to rectification — to have inaccurate or incomplete data corrected

The right to erasure (‘the right to be forgotten’) in certain circumstances

The right to restrict processing of your personal data

The right to data portability — to receive your data in a structured, machine-readable format

The right to object to processing, including for direct marketing purposes

The right to withdraw consent at any time where processing is based on your consent

If you believe I have not respected one or more of these rights, you are entitled to raise a formal complaint using the procedure set out in this document.

4. How to Make a Complaint

Please submit your complaint in writing — by email — using the contact details in Section 2. To help me investigate your concern as efficiently as possible, please include:

Your full name and preferred contact details

A clear description of your concern and which data protection right(s) you believe have been affected

The approximate date(s) when the issue occurred

Any relevant reference numbers, correspondence or documents

5. My Complaints Process

Once I receive your complaint, I will follow the five steps below. I am committed to handling all complaints promptly, fairly and confidentially.

Acknowledgement — within 30 days

I will acknowledge your complaint in writing within 30 days of receiving it, confirming that I have recorded it and will be investigating.

Requesting Further Information

If I need any additional details to fully investigate your complaint, I will contact you as soon as possible and explain what I need and why.

Investigation & Review

I will carry out a thorough and impartial review of your complaint. I will agree a realistic timescale with you once I have all necessary information, and I will keep you updated if there are any delays.

Decision & Outcome

I will communicate the outcome of my investigation to you clearly and in writing within one calendar month of receiving all the information needed (this may be extended by up to two further months for complex complaints — I will notify you if this is the case).

Closure or Escalation

If you are satisfied with the outcome, I will close your complaint. If you remain dissatisfied, you have the right to refer your complaint to the ICO free of charge (see Section 6 below).

6. Escalating Your Complaint to the ICO

If you remain dissatisfied with my response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) — the UK’s independent supervisory authority for data protection. This service is free of charge.

ICO website: https://ico.org.uk/make-a-complaint/

ICO helpline: 0303 123 1113 (Monday–Friday, 9am–5pm)

ICO postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF