Data Protection Complaints Policy
Scope of This Policy
This policy applies to complaints from data subjects about:
- How Kin&Co Enterprises Ltd processes your personal data (e.g., collection, use, storage, or sharing).
- Our handling of your data protection rights, such as DSARs, requests for erasure, or objections to processing.
- Any alleged breach of the UK GDPR or DPA 2018 (e.g., data inaccuracies, unlawful processing, or security incidents).
This policy does not cover general complaints unrelated to data protection (e.g., service quality), which are addressed via our Consulting team – please reach out to info@kinandco.com.
1. How to Submit a Complaint
We aim to make it easy for you to raise concerns about your personal data. You can lodge a complaint directly with our data protection lead using any of the following methods:
Email: info@kinandco.com
Phone:+44 (0)20 3745 1529 (Contact Hours Monday–Friday, 9am – 6pm)
Post: Kin&Co, Sustainable Workspaces, 5th Floor, County Hall, Belvedere road, SE1 7PB
When submitting a complaint, please provide:
- Your name and contact details.
- A clear description of your concern (e.g., specific data processing issue or request).
- Any relevant details (e.g., dates, correspondence, or reference numbers).
- If someone is acting on your behalf (e.g., a solicitor), evidence of your authorisation.
If you need assistance (e.g., due to accessibility requirements), please contact us, and we will provide alternative submission methods.
2. Our Complaints Process
We are committed to handling your complaint promptly, fairly, and transparently, in line with the UK GDPR and DUAA 2025. Our process is as follows:
2.1 Acknowledgment
We will acknowledge receipt of your complaint within 30 calendar days of submission, confirming we have received it and outlining the next steps.
If your complaint is unclear or lacks necessary details, we will contact you to clarify, ensuring we can proceed efficiently.
2.2 Investigation
Our data protection lead will investigate your complaint thoroughly, reviewing relevant records, policies, and processes.
We may contact you for additional information or to verify your identity (if needed to protect your data).
We aim to resolve most complaints within three months, though complex cases may take longer. We will keep you informed of progress, particularly if delays occur.
2.3 Response
Once our investigation is complete, we will provide a written response explaining:
- The outcome of your complaint (e.g., whether we found a breach and actions taken).
- Any remedies offered (e.g., correcting data, fulfilling a DSAR, or apologising for errors).
- Your right to appeal internally or escalate to the ICO (see sections 4 and 5).
If we cannot resolve your complaint (e.g., because we believe our processing complies with UK GDPR), we will explain our reasoning clearly.
2.4 Record-Keeping
We maintain secure records of all complaints, including details, outcomes, and lessons learned, as required by the DUAA 2025.
We periodically review complaints to improve our data protection practices.
3. Appealing Our Handling or Decision
If you are dissatisfied with how we handled your complaint or the decision reached, you may submit a further complaint to our data protection lead using the contact methods in section 2.
Please specify:
- Why you are unhappy (e.g., procedural issues or disagreement with the outcome).
- Any additional information to support your appeal.
We will:
- Acknowledge your appeal within 30 calendar days.
- Review the original complaint’s handling or decision, involving a senior staff member not previously involved, where possible.
- Respond within one month, detailing the outcome and your right to escalate to the ICO.
4. Escalating to the Information Commissioner’s Office (ICO)
You have the right to lodge a complaint directly with the ICO if you are unhappy with our response or appeal outcome. The ICO is the UK’s supervisory authority for data protection. You can contact the ICO by any of the following methods:
Online:
Helpline:
0303 123 1113 (Monday–Friday, 9am – 5pm)
Post:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
We are committed to addressing your data protection concerns. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you should raise your complaint directly with us first. If you are not satisfied with our final outcome, or if we fail to respond, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO). We will provide the ICO’s contact details in our final response to your complaint.
5. Our Commitment to Fairness
Proportionality: Our process is designed to be accessible and efficient, tailored to the size and complexity of our operations, as permitted by ICO guidance.
Transparency: This policy is publicly available on our website.
Continuous Improvement: We analyse complaints to enhance our data protection practices and ensure compliance with UK GDPR and the DUAA 2025.
Training: Our staff are trained to recognise and escalate data protection complaints to the data protection lead promptly.
6. Contact Us
For questions about this policy or our data protection practices, please contact our data protection lead: Zöe Kretzschmar
Email: info@kinandco.com
Phone:+44 (0)20 3745 1529 (Contact Hours Monday–Friday, 9am – 6pm)
Post: Kin&Co, Sustainable Workspaces, 5th Floor, County Hall, Belvedere road, SE1 7PB
7. Document Review and Revision
This policy will be reviewed as it is deemed appropriate, but no less frequently than every 12 months.
The data protection lead is the owner of this document and is responsible for ensuring that this procedure is reviewed in line with the review requirements of the UK GDPR & DUAA 2025.
This policy was approved by the Director of Operations and is issued on a version controlled basis.
Issued on: 15th April
Version: 1.0