GDPR Complaints Procedure for Hooked On Granite Ltd t/a Joe Browns and The Climbers Shop
The Data (use and access) Act 2025
This Data Protection Policy document sets out:-
- Introduction -The Law -Our Commitment to Compliance
- What constitutes a data protection complaint -definition
- What is not regarded as a data protection complaint
- How to make a complaint
- What you can expect from us
- Complaints made on behalf of others
- What to do if you are not happy with the way we handled your complaint-ICO signpost
- Checklist for your complaint-help us to help you
Introduction - The Law and Our Commitment to Compliance
Under UK data protection law, all organisations are legally required to have a process in place for handling data protection complaints by 19 June 2026. It’s one of the few new obligations brought in by the Data (Use and Access) Act. We are required to:-
- Give people a way of raising data protection complaints
- Acknowledge each complaint within 30 days of receipt
- Take appropriate steps to respond without undue delay, including making any relevant enquiries and keeping complainants up to date with progress
- Provide an outcome to complainants without undue delay
We are committed to handling your personal data in a way that is fair, transparent, and in accordance with the law.
If you are unhappy with how we have handled your data, this policy outlines how you can make a complaint.
What constitutes a complaint – how is it defined?
This new legal obligation aims to give anyone unhappy with the way we have handled their personal information a clear method for raising a complaint.
The Information Commissioner's Office (ICO) has provided an indicative listing of what a complaint could cover. This is not an exhaustive listing but represents typical cases they have encountered in the past.
These cases include making a complaint about:-
- A data breach which impacted them
- A response to a Data Subject Access Request or other privacy rights request
- How long personal information is kept
- The accuracy of information held
- Security measures in place to protect personal details
- How profiling of a person has been carried out
- Or any other data protection related matter
In most cases, if the ICO receives a complaint, it will first ask the person to raise the matter with the organisation. The ICO will expect to see a robust policy and procedure in place to facilitate this quickly.
Our policy reflects this expectation.
What is not regarded as a data protection complaint?
If someone is complaining about a service or other matters and is also exercising one of their privacy rights (such as access, erasure, or objection) this will not be treated as a data protection complaint.
The ICO has provided the following examples which they say would not be data protection complaints: –
- A person may acknowledge you responded to their subject access request on time but express dissatisfaction that you did not expedite it
- An employee may raise a grievance issue and also request copies of their personal information
- A person may complain about a customer service issue and also request that you delete their information
If you are not sure if your issue is a complaint, the ICO has said they will help provide clarification. A link to their official guidance and website can be found below.
How to Make a Complaint
If you have a complaint about how your data has been handled, please contact our Data Protection Officer (DPO). Our DPO is Paul Casey
Our process is designed to enable us to investigate and resolve the issue as quickly as possible. You can use any of the following channels for your complaint:-
- Email: [email protected]
- Post: Hooked On Granite Ltd. Menai Hall, Llanberis High Street, Caernarfon. LL55 4HA.
But you are not obliged to use our set process. We want to be completely user-friendly and flexible.
As with any Data Subject Access Requests, you can contact any appropriate employee, in any part of the organisation.
Whichever method you use, please provide as much detail as possible about your complaint.
Below is a checklist to help you throughout the process. This will help us to understand the issue and investigate it thoroughly.
What to Expect From Us
We will acknowledge receipt of your complaint within seven working days.
We will then investigate your complaint and provide you with a full response within 30 calendar days.
Throughout the process, we will:
- Keep you informed of our progress.
- Request any additional information we may need from you in a timely and proportionate manner.
- Provide you with a clear and comprehensive outcome of our investigation.
Complaints made on behalf of others
As with privacy rights, a family member, solicitor, or other relevant organisation can raise a complaint on behalf of another person. We will follow due process for checking they’re authorised to do this, such as an appropriate Legal Power of Attorney or signed Letter of Authority from the person they are acting on behalf of.
If You Remain Unhappy
If you are not satisfied with the outcome of your complaint, or if you feel we have not handled it appropriately, you have the right to complain to the Information Commissioner’s Office (ICO). The ICO is the UK’s independent regulator for data protection and information rights.
You can contact the ICO in the following ways:
For more information about the ICO and their complaints guidance, you can visit their website at www.ico.org.uk
https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/what-are-data-protection-complaints/#whatare
A Checklist for Making your Data Protection Complaint
Before you start your Data Protection complaint, collect:
- Copies of your original request or communication
- Proof of when you sent it (email timestamp, postal receipt)
- Any responses you received from us
- Your follow-up correspondence
- Notes of any phone calls (date, time, who you spoke to, what was said)
- Visit the ICO guidance page signposted above
Drill down into:
- What happened — a clear description of the issue
- When it happened — key dates
- What you want — what outcome you’re seeking
- What you’ve done so far — your attempts to resolve it
Six Top Tips- Help us to help you
1. Be specific – dates, names, and exactly what happened
2. Stay factual – avoid emotional language, stick to the facts
3. Show your efforts -demonstrate how you tried to resolve it first
4. Be clear about what you want -the outcome you are seeking
5. Include evidence -documents strengthen your complaint
6. Keep it focused – one clear complaint is better than multiple vague ones