Data Protection Complaints Policy

---

1. Introduction and Purpose

At Nicky’s Atelier we are committed to protecting the privacy and security of personal

data. We recognise that individuals have a right to understand how their data is handled

and to raise concerns if they believe their data protection rights have been infringed.

This policy outlines how we receive, investigate, and resolve complaints regarding our

handling of personal information. Our goal is to resolve data protection concerns

effectively, transparently, and without undue delay.

2. Relevant Legislation

This policy is designed to comply with the UK's data protection framework, which includes:

The UK General Data Protection Regulation (UK GDPR)

The Data Protection Act 2018 (DPA 2018)

The Data (Use and Access) Act 2025

3. What Counts as a Data Protection Complaint?

A data protection complaint is any expression of dissatisfaction from an individual (or

someone acting legally on their behalf) regarding how we process personal data.

individuals do not need to use legal terminology or quote specific legislation for a query to

be treated as a formal data protection complaint.

4. How to Submit a Complaint

We accept complaints through multiple channels to ensure accessibility. You can submit

your data protection complaint to our designated lead via:

Email: nicky@nickys-atelier.com

Post: 1-3 Old Church Road, Clevedon BS21 6LZ

Phone: 07974 493985

5. Our Complaint Handling Process

We follow a strict statutory framework to ensure all complaints are handled fairly and

efficiently:

Stage 1: Acknowledgement

We will acknowledge receipt of your complaint in writing (via email or post) within 30 days

of receipt. If a third party is complaining on your behalf, we will request proof of

authorisation.

Stage 2: Investigation

Our Data Protection lead will conduct an internal review of the circumstances without

undue delay, making all necessary enquiries to establish what occurred.

Stage 3: Communication

We will keep you updated on the progress of our investigation, particularly if the case is

complex.

Stage 4: Outcome

We will write to you without undue delay to explain the outcome of our investigation and

detail any remedial actions we have taken.

6. Escalation to the Information Commissioner’s Office (ICO)

If you are not satisfied with the outcome of our internal investigation or how your

complaint was handled, you have the right to escalate your complaint directly with the

Information Commissioner's Office (ICO) www.ico.org.uk

7. Record Keeping and Retention

We maintain a log of all data protection complaints received. This record includes:

 The date the complaint was received and acknowledged.

 Details of the investigation undertaken and evidence considered.

 The final outcome, the rationale for our decision, and any remedial actions taken.

8. Policy Review and Accountability

This policy is reviewed annually to ensure ongoing compliance with UK statutory

requirements and Information Commissioner's Office (ICO) guidance.