Data Protection Complaints Procedure
Organisation: TOVO Data Ltd
Website: tovodata.co.uk
Version: 1.0
Effective Date: 19 June 2026
Review Date: Annually
Owner: Data Protection Lead / Director of Operations
1. Purpose
TOVO Data Ltd ("TOVO", "we", "us" or "our") is committed to protecting personal data and respecting the rights of individuals under UK data protection legislation.
This procedure explains how individuals may raise concerns or complaints about how we collect, use, store, share or otherwise process personal data and how TOVO will investigate and respond.
This procedure has been implemented to comply with:
UK General Data Protection Regulation (UK GDPR)
Data Protection Act 2018
Data (Use and Access) Act 2025; and
Guidance issued by the Information Commissioner's Office (ICO)
2. Scope
This procedure applies to:
Customers
Prospective customers
Suppliers
Business contacts
Employees
Contractors
Website users; and
Any individual whose personal data is processed by TOVO
It covers complaints relating to:
Accuracy of personal data
Direct marketing communications
Lawful basis for processing
Data retention practices
Subject Access Requests
Data security and confidentiality
Data sharing activities
Automated decision-making
Privacy information and transparency
Individual rights under UK GDPR; and
Any other alleged breach of applicable data protection legislation
3. How to Make a Complaint
Individuals may submit a data protection complaint free of charge using any of the following methods:
Post
Data Protection Lead
TOVO Data Ltd
[Registered Office Address]
Website
Through the contact form available at:
Telephone
Using any published TOVO contact number.
A complaint does not need to use legal terminology or specifically mention "UK GDPR" or "data protection" to be treated as a data protection complaint.
Any expression of concern regarding the handling of personal information may be treated as a data protection complaint.
4. Information We May Request
To enable us to investigate, we may request:
Name and contact details
Details of the concern
Relevant dates;
Supporting evidence or correspondence;
Proof of identity where appropriate.
Where a complaint is made on behalf of another individual, we may require evidence of authority to act.
5. Acknowledgement of Complaints
Upon receipt of a data protection complaint, TOVO will:
Record the complaint in our Complaints Register;
Review whether it falls within the scope of data protection legislation; and
Acknowledge receipt within 30 calendar days.
The acknowledgement will:
Confirm receipt;
Provide a reference number where applicable;
Explain the next steps; and
Provide contact details for the investigator.
6. Investigation Process
TOVO will investigate complaints fairly, objectively and without undue delay.
The investigation may include:
Reviewing relevant records and systems
Interviewing staff members
Examining correspondence or communications
Assessing compliance with policies and legislation
Seeking clarification from the complainant where necessary
During the investigation we may provide progress updates where appropriate
7. Complaint Outcomes
Following investigation, TOVO will provide a written outcome explaining:
Our findings
Whether the complaint is upheld, partially upheld or not upheld
Any corrective actions taken
Steps we will implement to prevent recurrence; and
Further escalation options available to the complainant
Examples of corrective action may include:
Rectification of inaccurate data
Deletion of data where appropriate
Restriction of processing
Amendments to procedures
Staff training
Technical or organisational security improvements
8. Timescales
TOVO will:
Action
Timescale
Acknowledge complaint
Within 30 calendar days
Commence investigation
Without undue delay
Provide updates where necessary
As investigation progresses
Notify outcome
Without undue delay following conclusion
Complex complaints may require additional time. Where this occurs, the complainant will be informed of the reasons for the delay and the expected timescale.
9. Escalation to the Information Commissioner's Office (ICO)
If an individual remains dissatisfied after receiving TOVO's response, they may contact the Information Commissioner's Office.
Information Commissioner's Office
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
Address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
TOVO encourages individuals to contact us first so that we can attempt to resolve concerns promptly and effectively.
10. Record Keeping
TOVO maintains records of data protection complaints, including:
Complaint details
Dates received and acknowledged
Investigation actions taken
Correspondence
Findings and outcomes
Remedial actions implemented
Records will be retained in accordance with TOVO's Record Retention Policy.
11. Confidentiality
All complaints will be handled confidentially and shared only with individuals who need access to investigate and resolve the matter.
Processing of complaint information will be undertaken in accordance with applicable data protection legislation.
12. Responsibility
The Data Protection Lead is responsible for:
Maintaining this procedure
Monitoring compliance
Ensuring complaints are investigated appropriately
Maintaining complaint records; and
Reporting significant data protection issues to management
All employees and contractors must cooperate fully with any complaint investigation.
13. Review
This procedure will be reviewed:
Annually
Following significant legislative change
Following ICO guidance updates; or
Following any significant data protection incident or complaint trend