Privacy Policy
Data Protection Complaint Handling Policy
1. Purpose and scope
1.1 Wynyard Hall Limited (hereon in referred to as “Wynyard Hall”, “we”, “us” or “our”) has legal complaint handling obligations under the UK GDPR, Part 3 of the Data Protection Act 2018 and section 103 of the Data (Use and Access) Act 2025 (hereon in collectively referred to as the “UK data protection legislation”). If an individual considers that we have breached the UK data protection legislation, they have the right to make a complaint directly to us, to the Information Commissioner’s Office (ICO) (or the Information Commission as it will be known following Part 6 of the Data (Use and Access) Act 2025) or to pursue legal action.
1.2 These complaints must relate to data protection but the UK data protection legislation does not specifically define a data protection complaint. The scope of complaints is therefore wide and may include, but is not limited to, complaints relating to the way we collect or use someone’s personal data, their data protection rights (such as the right of access, correction or erasure), our privacy notices and policies, how long we keep their personal data and security.
1.3 This Data Protection Complaint Handling Policy (“Policy”) outlines our approach to handling data protection complaints. It covers complaints from any data subject or their authorised representative.
1.4 This Policy applies to the handling of data protection complaints only. Any complaints which fall outside the scope of this Policy will be dealt with in accordance with our general complaints procedure. To submit a complaint that falls outside the scope of this Policy, please contact us using our contact form which can be found on our website here, by calling 01740 644 811 or by emailing reception@wynyardhall.co.uk. Where a complaint relates to this Policy and our general complaints procedure, then each element shall be dealt with in accordance with the relevant complaints process.
2. Guiding principles
We are committed to handling data protection complaints in line with our legal obligations and in an accessible, fair, transparent and timely manner. We will handle complaints confidentially and only share information where appropriate to investigate and resolve the complaint, as required or authorised by law or otherwise in accordance with our privacy policies. We will aim to avoid conflicts of interest.
3. Roles and responsibilities
3.1 Our data protection team is responsible for co-ordinating how we handle data protection complaints. They will involve relevant business, HR, IT, security, risk or compliance teams as needed.
3.2 All staff are responsible for recognising complaints and referring them to the data protection team without undue delay, and no later than 1 working day, as well as for providing supporting information and responding to requests from the data protection team when asked.
3.3 Our data protection team is responsible for ensuring staff are aware of and trained sufficiently to deal with data protection complaints.
4. How to recognise a data protection complaint
In order to submit a complaint under the UK data protection legislation, complainants do not have to use legal terms or quote sections of the UK data protection legislation. So long as the complainant has submitted a complaint alleging that we have infringed or breached the UK data protection legislation, it will be considered a data protection complaint.
5. Transparency
5.1 To ensure complainants understand what to expect from our data protection complaints process, this Policy covers the following information:
5.1.1 how to make a data protection complaint (please refer to clause 8 below);
5.1.2 if necessary, the information we require to investigate a complaint such as any supporting documentation including, contact details, unique reference numbers, account numbers (please refer to clause 9 below);
5.1.3 what we do with that information and why (for example, investigations, establishing the facts, complaint resolution) (please refer to clause 9 below);
5.1.4 how we handle complaints which might be sensitive in nature (please refer to clause 7 below);
5.1.5 what individuals can expect from the process (please refer to clause 14 below);
5.1.6 when individuals can expect to hear from us, including status update communications such as acknowledgements, progress updates and outcomes (please refer to clause 12 below); and
5.1.7 any reasonable support we provide to help individuals make complaints such as alternative formats or language options (please refer to clause 8 below).
6. Non-data protection complaints
Some complaints will include both data protection and non-data protection issues; we will handle the data protection aspects under this Policy. Non-data protection issues will be addressed under our general complaints procedure.
7. Complaints involving children or vulnerable individuals
Where we receive a complaint from, or on behalf of, a child or other vulnerable individual, we must consider additional safeguards and requirements to ensure our process is fair, transparent and accessible to the individuals concerned, having regard to age, understanding and any other relevant circumstances.
8. Complaint channels
8.1 Individuals may submit a data protection complaint to us using any of the following options:
8.1.1 by using our online contact form (please refer to clause 1.4 above);
8.1.2 by email to DataProtectionOfficer@wynyardhall.co.uk;
8.1.3 by post to Wynyard Hall, Wynyard, Stockton-on-Tees, Billingham, TS22 5NF; or
8.1.4 by telephone at 01740 644 811.
8.2 Where a complaint is made through social media or another insecure public channel, we will ask the complainant to continue the complaint through a more secure method to protect their personal data.
9. Requesting additional information
9.1 Some complaints may be easy to resolve; others may require further investigation. Where reasonably necessary to investigate a complaint, we may ask the complainant for additional information, including information to verify their identity or to clarify the scope of the complaint. We will only request information that is reasonable and proportionate in the circumstances and will not request more information than we require to identify the complainant or their representative.
9.2 Where a complaint is made on behalf of another individual, we may require evidence such as a power of attorney or signed letter of authority indicating that their representative is authorised to act on their behalf. We cannot progress complaints unless adequate proof of authority is provided. Where this is the case, we will explain it to the person who submitted the complaint.
10. Complaint to or about processors or partners
10.1 Where a complaint received by us relates to the processing of personal data by our service providers, we will ask these providers to provide us with details and information relevant to the complaint without undue delay and in accordance with any agreed and specified terms within our contract with the service provider.
10.2 Where a service provider receives a complaint about the processing of our personal data whether by them or us, they should forward this to us without undue delay. Service providers are under no obligation to handle complaints on our behalf unless this has been agreed between us and the relevant service provider(s) under a binding contract. Where applicable, we will ask service providers to handle such complaints in line with our policies and procedures.
11. Record keeping
11.1 We will keep appropriate records about each complaint in our complaints register which includes the following information:
11.1.1 the date of receipt;
11.1.2 the acknowledgement;
11.1.3 any relevant correspondence, conversations and documents; and
11.1.4 the outcome of the complaint, including escalation, and any actions taken in response.
11.2 These records will be used to demonstrate compliance, for audit and monitoring purposes, training, to support consistent handling and to identify recurring issues, trends or areas for organisational improvements or remediation.
11.3 We will not retain personal data relating to complaints for longer than is necessary and will handle such records in accordance with our privacy policies and procedures.
12. Acknowledgement and timeframes
12.1 For data protection complaints received on or after 19 June 2026, we must acknowledge receipt of a complaint within 30 days of receipt. However, we will aim to acknowledge receipt without undue delay.
12.2 We will aim to:
12.2.1 request any further information including for clarification or identification purposes as soon as practicable; and
12.2.2 where necessary, provide updates at regular intervals.
12.3 For ongoing investigations, we will communicate this to complainants with an indication of our initial, anticipated timescales for resolving the complaint. We will continue to keep the complainant informed of our progress, including, where appropriate, the next steps, any further information required, and any expected timeframe for the next update, or outcome.
13. Investigations
13.1 We will take reasonable and proportionate steps necessary to investigate complaints fairly and in a timely manner.
13.2 It may take us longer to investigate and resolve complaints which are complex, serious or which relate to multiple data protection issues. In the event it takes longer than 30 days following receipt of the complaint for us to fully respond, we will provide