Data Protection Complaints Procedure

Introduction

We take complaints about our handling of personal data seriously. This procedure applies to anyone whose personal data we process.

1. First, exercise your rights:

To access, correct, erase, restrict, object to, or port your personal data, contact us. We respond within one month; if we need longer, we will explain why.

2. Making a complaint:

If you are unhappy with our response, or with any processing of your personal data, contact us with "Data protection complaint" in the subject, describing the issue and the outcome you seek. Complaints cannot be made anonymously; a third party may complain on your behalf with your written authority. Tell us if you need reasonable adjustments.

3. How we handle it:

We acknowledge within 5 working days, investigate impartially through a director not involved in the original matter, and give a written outcome within 30 days, including anything we will change.

4. Escalation:

If you remain dissatisfied, you may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, for EU residents, your local supervisory authority. You may also have judicial remedies. Complaints about damage or distress arising from a data breach are eligible under this procedure; breaches themselves are investigated under our incident response process.