Data Protection Complaint Procedure

1. INTRODUCTION

1.1. This procedure documents the process for making and handling complaints involving personal data controlled and/or processed by Owl Barn Limited. It sets out how Owl Barn Limited ensures data subjects have a fair and transparent mechanism to raise data protection concerns, and how Owl Barn Limited (The Company) investigates and resolves such complaints in line with its obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

2. PURPOSE & SCOPE

2.1. This procedure provides details of:

(a) the mechanism for data subjects to raise data protection concerns directly with Owl Barn Limited;
(b) the process for investigating and resolving data protection complaints promptly and effectively;
(c) how Owl Barn Limited identifies and addresses potential data protection compliance issues at an early stage;
(d) the means by which Owl Barn Limited maintains trust and confidence with customers, employees, website users and other individuals whose personal data may be processed by Owl Barn Limited;
(e) how Owl Barn Limited demonstrates accountability and commitment to data protection compliance.

2.2. This procedure applies to all complaints relating to the processing of personal data by Owl Barn Limited.

3. DEFINITIONS

3.1. Data Protection Complaint: Any complaint regarding Owl Barn Limited’s processing of personal data will be handled in line with this procedure. Data protection complaints may relate to:

(a) how Owl Barn Limited collects, uses, shares, stores or deletes personal data;
(b) the lawful basis relied on for processing personal data;
(c) the accuracy or completeness of personal data held;
(d) matters relating to subject access requests or other data subject rights requests;
(e) security measures relating to the protection of personal data;
(f) automated decision-making;
(g) retention of personal data; and/or
(h) international transfers of personal data.

3.2. This procedure applies to complaints about data protection matters only. It does not apply to:

(a) general complaints about Owl Barn’s services, products or customer service which should be directed to Owl Barn Limited’s general customer service complaints process at info@owlbarn.com;
(b) employment-related grievances or disputes (which should be directed to Owl Barn Limited’s HR Grievance Procedure).

4. RESPONSIBILITIES

4.1. Owl Barn Limited has overall responsibility for personal data processing. Day-to-day responsibility for coordinating data protection complaints rests with the Data Protection Lead. In relation to this procedure, it is the responsibility of the Company to:

(a) Acknowledge receipt of every data protection complaint in writing within 7 business days;
(b) Request verification of identity, clarification or further information from the complainant promptly and within the initial acknowledgement period, where strictly necessary and proportionate to enable the Company to investigate the complaint;
(c) Investigate complaints thoroughly and without undue delay;
(d) Provide a substantive response and confirmation of the outcome to the complainant without undue delay. The Company aims to resolve complaints within one calendar month of receipt. Where the complaint includes or constitutes a formal data subject rights request (such as a Subject Access Request), Owl Barn Limited will respond to that specific element in accordance with statutory UK GDPR timescales, which is within one calendar month of receipt;
(e) Provide regular and timely updates to the complainant regarding the progress of the investigation, particularly where complex matters extend the expected resolution timeframe;
(f) Confirm the final outcome of the complaint in writing, including any actions taken to resolve the matter if upheld, alongside clear information about the individual’s right to escalate the matter to the Information Commissioner’s Office (ICO) if they remain dissatisfied with Owl Barn Limited’s response.

4.2. It is the responsibility of all Company staff to cooperate fully in the timely investigation and resolution of data protection complaints.

5. HOW TO MAKE A DATA PROTECTION COMPLAINT

5.1. If you wish to raise any concerns or to complain about the way in which Owl Barn Limited has processed your personal data, please write to the Data Protection Team by email at privacy@owlbarn.co.uk or by post to: Owl Barn Limited, Unit 2, The Stable Yard, Middlewood Green, Stowmarket, Suffolk, IP14 5HG.

5.2. To help the Company deal with your complaint as promptly and efficiently as possible, please provide a full written explanation of your concerns which includes:

(a) Your full name or, if you are complaining on behalf of someone else, their full name together with written authority to act on their behalf;
(b) Your contact details, including email address or, if preferred, postal address;
(c) Your relationship to Owl Barn Limited (for example, customer, employee, contractor, supplier, website visitor or other), and any reference number you hold (such as a customer number, employee number or other relevant reference number) to help us locate your records;
(d) A clear description of your complaint setting out what has happened and any concerns;
(e) The date(s) or time period when the issue occurred or was discovered, and whether it is ongoing;
(f) The individuals, departments, or systems involved, so far as known to you;
(g) Copies of any supporting documents or evidence you wish to rely on; and
(h) Confirmation of whether you have already raised the matter with Owl Barn Limited and, if so, with whom and when.

5.3. A complaint form, which sets out the minimum information required above is available on request. Use of the form is encouraged to help Owl Barn Limited investigate and respond promptly, but a complaint will not be rejected solely because the form has not been used.

5.4. A member of the Company will acknowledge your complaint within seven (7) business days and may ask you to clarify any matters which are not clear in your complaint. If Owl Barn Limited needs to verify your identity before investigating your complaint, this request will be made within the acknowledgement period.

Where a complaint involves a formal exercise of data subject rights (such as a Subject Access Request), the statutory response timeline will pause from the date identity proof is requested and resume immediately upon receipt of appropriate proof of identification.

6. RESPONSES TO A DATA PROTECTION COMPLAINT

6.1. The Company will investigate your complaint and will communicate a substantive outcome to you without undue delay. We aim to provide this response within one calendar month of receipt of your complaint.

6.2. If your complaint raises complex questions, requires additional information, or involves a third party, the investigation may require additional time. In such circumstances, Owl Barn Limited will inform you within the initial one-calendar-month period, provide a clear rationale for the extension, and supply you with regular updates on the progress of the investigation.

Where the complaint includes an exercise of data subject rights under the UK GDPR, any such extension will not exceed a maximum of two additional calendar months, ensuring a final statutory response is provided within three calendar months of the initial receipt.

6.3. Upon completing the investigation, the Company will confirm the outcome to you in writing. The response will:

(a) if your complaint is upheld, set out the specific actions taken by Owl Barn Limited to address your concerns and, where appropriate, mitigate any identified privacy risks or harm; or
(b) if your complaint is not upheld, clearly explain the reasons for this decision and remind you of your statutory right to escalate the matter to the regulator.

7. RIGHT TO ESCALATE TO THE REGULATOR

7.1. You have the statutory right to refer data protection concerns directly to the UK supervisory authority, the Information Commissioner's Office (“ICO”) (transitioning to the Information Commission). However, we strongly encourage you to raise your concerns with Owl Barn Limited first. This gives us the opportunity to investigate the issue and put things right promptly, which the regulator generally expects you to have attempted before they step in.

7.2. If you remain dissatisfied with Owl Barn Limited’s final response, handling, or progress updates regarding your complaint, you have the right to escalate the matter to the ICO / Information Commission.

7.3. Please refer to the guidance on the regulator’s official website for details on how to lodge a formal complaint: ico.org.uk.

8. CONTACT INFORMATION

8.1. For the attention of the Data Protection Lead:

Owl Barn Limited, Unit 2, The Stable Yard, Middlewood Green, Stowmarket, Suffolk, IP14 5HG
Email: privacy@owlbarn.co.uk

9. PRIVACY POLICY

9.1. By submitting a data protection complaint, you acknowledge that Owl Barn Limited will process your personal data for the purpose of investigating and responding to your complaint, in accordance with Owl Barn Limited’s privacy policy (owlbarn.co.uk). Owl Barn Limited may need to share your data internally and, where necessary, with relevant advisers, service providers or regulators for the purpose of investigating and responding to your complaint.

10. RETENTION OF COMPLAINT RECORDS

10.1. Owl Barn Limited maintains a secure log of all data protection complaints. Records of complaints, including investigation notes, identity verification checks, and final outcome responses, will be retained securely for a period of six (6) years from the date of resolution. This retention period is necessary to demonstrate compliance with our statutory duties and to defend against any potential legal claims or regulatory enquiries. Following this period, the records will be securely destroyed or permanently anonymised