Data Protection Complaints Policy

1. About this policy

At Quadrangle we take data privacy seriously. If you are unhappy with how we have handled your personal data, you have the right to raise a concern.

This policy explains:

• How you can make a complaint about how we use your personal data;
• What will happen when you raise a concern;
• What you can expect from us throughout the process.

We aim to handle all complaints quickly, fairly, and transparently. Our goal is not just to resolve issues, but to learn from them and continually improve how we protect your information.

Quadrangle's data protection complaints process ensures that all concerns about personal data are taken seriously, and handled consistently, fairly, and in line with data protection law.

2. Who this applies to

This process applies to anyone whose personal data we handle, including:

• Clients and service users;
• Employees and job applicants;
• Suppliers and partners;
• Research participants.

It also applies to all staff responsible for handling personal data and responding to concerns.

3. What is a data protection complaint?

A data protection complaint might include concerns about how we:

• Collect your data;
• Use or share your data;
• Keep your data secure;
• Respond to your requests (such as asking to see your data);
• Retain or delete your data.

You do not need to use legal terms or mention "GDPR" for us to treat your concern as a complaint.

4. How to make a complaint

To make a complaint, contact our Data Protection Officer:

5. What you can expect from us

When you raise a complaint, you can expect a clear, respectful, and transparent process. We will:

• Acknowledge your complaint promptly, usually within 5 working days;
• Explain what will happen next and who is handling your complaint;
• Investigate your concern fairly and without unnecessary delay;
• Keep you informed of progress throughout;
• Provide a clear and honest outcome.

If we need more information from you, we will inform you and explain why.

6. How we handle complaints

We follow a structured but flexible process.

Step 1: Record

We will securely record your complaint so it can be tracked and managed properly.

Step 2: Acknowledge

We will confirm that we have received your complaint and explain the next steps.

Step 3: Review

We will review the details of your complaint. If anything is unclear, we will contact you.

Step 4: Investigate

We will carefully investigate your concern. This may include:

• Reviewing our systems and records;
• Speaking to relevant staff;
• Checking our compliance with data protection law and our policies.

Step 5: Update

We will keep you informed throughout the process.

Step 6: Respond

Once we have completed our investigation, we will provide a clear response explaining what we found, whether anything went wrong, and what this means for you.

Step 7: Act

Where appropriate, we will take steps to address any issues. This may include correcting your data, improving our processes, or providing additional staff training.

Step 8: Close

We will confirm when your complaint has been closed and explain any further options available to you.

7. Timeframes

We aim to resolve complaints as quickly as possible.

• We will acknowledge your complaint promptly, usually within 5 working days;
• We aim to provide a full response within one calendar month, depending on the complexity of the issue.

If we need more time, we will explain why and keep you informed.

8. Escalation

If you are not satisfied with how we have handled your complaint, you have the right to raise your concern with the Information Commissioner's Office (ICO), the UK's independent authority for data protection.

We would always encourage you to contact us first so we can try to resolve your concern.

You can contact the ICO as follows:

Phone: 030 3123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Online: https://ico.org.uk/concerns

9. Your rights

Under data protection law, you have rights regarding your personal data. These include:

• The right to be informed;
• The right of access;
• The right to correct inaccurate data;
• The right to request deletion (in certain circumstances);
• The right to restrict or object to processing.

If your complaint relates to one of these rights, we will ensure it is handled appropriately.

10. Continuous improvement

We keep secure records of complaints, investigations, and outcomes. This helps us ensure consistency, demonstrate compliance with the law, and monitor trends and improve our services.

Our staff are trained to recognise and respond to data protection complaints appropriately. We regularly review and update our training to ensure it remains effective.

11. Accessibility

If you would like this policy in another format (for example: audio, large print, braille) please contact Quadrangle's Data Protection Officer using the contact details in Section 4.