Data Protection Complaints Procedure

Our approach

We are committed to processing personal data in line with our data protection obligations and based on the UK GDPR principles of processing personal data lawfully, fairly and in a transparent way; collecting personal data for specific and legitimate purposes and not processing personal data in a way that is incompatible with those purposes; collecting and using adequate, relevant and minimal personal data; taking reasonable steps to make sure personal data is accurate and kept up to date; not keeping personal data longer than necessary; and implementing appropriate security measures to protect personal data.

There may be times when we don’t get it right, and, if so, we want you to let us know. We take complaints very seriously and aim to learn from them to improve our standards of service and data protection controls.

How to make a data protection complaint

You can contact us using any of the following methods:

What happens next?

We will acknowledge your complaint within 30 days of receiving it. We may ask for information to check your identity and if someone is making a complaint on your behalf we will also need to check that the person making the complaint is allowed to do so. If we are unable to identify you / verify the authority of the person making the complaint, we may not be able deal with it.

Considering and investigating your complaint

We will consider your complaint without undue delay and keep you/your authorised representative updated at appropriate intervals on the progress of our investigation.

The usual steps in the process are: reviewing your complaint; locating and reviewing relevant information we hold relating to the complaint; establishing the relevant facts; consulting staff involved in handling your personal data; considering compliance with our policies and procedures; and taking steps to resolve the complaint and improve future compliance.

We may need to ask you for further information or documents. If so, we will ask you to provide the information within a specific period of time so that we can respond to your complaint within a reasonable time frame.

Notifying you of the outcome of our investigation

We will let you/your authorised representative know the outcome of the complaint without undue delay. We will explain clearly what we’ve done to deal with your complaint and, where appropriate, any action we have taken as a result.

If we can’t resolve your complaint

We hope that we will be able to resolve your complaint to your satisfaction, but, if you are unhappy with the outcome, you can complain to the Information Commissioner’s Office (ICO) or you can take action in the courts.

The ICO’s contact details are:

More details on how to complain to the ICO are available on the Complaints page of the ICO’s website. You should usually submit your complaint to the ICO within three months of your last contact with us.

Data protection rights and non-data protection related complaints

Please note that if you are looking to exercise one of your rights under UK GDPR (right to access, information, rectification, restriction, erasure, object, portability, rights in relation to automated decision making) we have a separate procedure for this and we will handle your request in accordance with this procedure.

You can find more information about your data protection rights and how to exercise them in our privacy notices which are available upon request from our legal department.  If you are a KAEFER employee, you can request a copy of our employee privacy notice at any time from your line manager, the people and development team or by contacting the legal team at legalUK@kaefer.com

Version control