top of page

Bookings Open Soon!

Data Protection Complaints Policy.

  1. Introduction

    1. A data subject, that is a natural living being, has rights under UK Data Protection Legislation which include; The General Data Protection Regulation [UK GDPR]; The Data Protection Act 2018 [DPA 2018]; The Privacy and Electronic Communications Regulations [PECR]; and The Data (Use and Access) Act [DUAA]. This policy outlines how complaints arising from the use of such personal data are dealt with.

  2. Data Subject Rights

    • Right to be informed; The right to be informed encompasses the obligation to provide “fair processing information”. It emphasises the need for transparency in the use of personal data.

    • Right of access; Data Subjects have the right to access their personal data and supplementary information. The right of access allows individuals to be aware of and verify the lawfulness of the processing. Such a Data Access Request will be provided free of charge within one month, with the following exceptions/provisos:

      • Such a request is manifestly unfounded or excessive;

      • Such a request is repetitive;

      • Such a request requires copies of previously provided information. In the event of charges being raised the firm will notify in advance such costs which in any event will be based on the administrative cost of providing the requested information. In the event of manifestly unfair or excessive requests we may refuse to respond to the request and any such refusal will be notified to the requester [data subject] with a reason for the refusal and, in addition,  information as to the data subject’s rights to complain to the supervisory body or judicial authority within one month of such a request being received.

      • Right to rectification; The GDPR gives Data Subjects the right to have personal data rectified. Personal data can be rectified if it is inaccurate or incomplete.

      • Right to erasure; This right is to enables a Data Subject to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

      • Right to restrict processing; Individuals have a right to ‘block’ or suppress processing of personal data. When processing is restricted, storage of the personal data is permitted, but not to further process it. Information can be retained just enough for the individual to ensure that the restriction is respected in future.

      • Right to data portability; The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.  It allows them to move copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.

      •  Right to object; The right to object to processing.

  3. Complaint

    1. Data subjects may complain about any aspect of the processing of personal data.

    2. Should the data subject appoint a representative to act on their behalf the data subject’s written consent authorising the representative to do so must be received before the procedure is commenced with.

  4. Complaint procedure

    1. A list explaining the five [5] stages is laid out below:

      • Stage 1 – Informal complaint

        Resolution by communication of concern with the Data Protection Officer (or equivalent) by telephone or online meeting. If the matter is resolved at this stage, no further action is required. If unresolved, the complaint will proceed to Stage 2.

      • Stage 2 – Formal complaint

        The complaint must be made in writing to the Data Protection Officer (or equivalent). Response times are as follows:

        Acknowledgement within 5 working days. Full response within 20 working days. If the matter is resolved at this stage, no further action is required. If unresolved, the complaint will proceed to Stage 3.

      • Stage 3 – Investigation

        An investigation will be carried out, if necessary. Further information may be requested from the complainant in order to ascertain the outcome being sought. If the matter is resolved at this stage, no further action is required. If unresolved, the complaint will proceed to Stage 4.

      • Stage 4 – Update

        The complainant will be informed of any updates or delays encountered, including any revision to the outcome delivery date. If the matter is resolved at this stage, no further action is required. If unresolved, the complaint will proceed to Stage 5.

      • Stage 5 – Outcome

        A final outcome will be provided within 20 working days unless updated. Details of any actions taken or to be taken will be included. If the complainant wishes to take matters further, details of the appeals procedure to the regulator (ICO) will be provided.

    2. If the complaint remains unresolved the complainant can escalate their complaint to the Information Commissioner’s Office [ICO] www.ico.org.uk/make-a-complaint

bottom of page