Complaints Policy

1. Context

Data Protection is an important legal compliance issue for Park Planner. During the course of activities it collects, stores and processes personal data (sometimes of a sensitive nature) about individuals, other third parties and other individuals who come into contact with the organisation. Park Planner as a data controller is liable for the actions of its staff regarding how they handle data.

When we refer to Personal Data we mean information that relates to you (or the person you are representing).

Data Protection law has, in recent years, strengthened the rights of individuals, and places tougher compliance obligations on organisations that handle personal data. The Information Commissioner’s Office (ICO) is responsible for enforcing data protection law including handling complaints about data protection.

UK data protection law consists primarily of:

• The General Data Protection Regulations (UK GDPR);
• The Data Protection Act 2018 (DP Act 2018);
• The Data (Use and Access) Act 2025 (DUA Act 2025); and
• The Privacy and Electronic Communications (EC Directive) Regulations (PECR) 2003

The enactment of the DUA Act 2025 introduced a new right to individuals relating to Data Protection Complaints. From 19 June 2026 organisations must have a process to handle and respond to complaints if someone considers that they have infringed data protection legislation.

Park Planner will be mindful of its obligations under other legal frameworks when handling complaints, such as equality and discrimination legislation, in the application of this policy.

2. Policy statement

Previously, individuals who believed their data protection rights had been breached could complain to the ICO. Under the DUA Act, complainants must now first raise their issue directly with the data controller before approaching the ICO.

This policy sets out how Park Planner will handle complaints relating to personal data in line with the relevant Data Protection Law. It gives details of our Complaints process as a Data Controller, to enable an earlier resolution of issues and provide a proactive solution to the complainant whilst promoting transparency at all stages.

3. Scope

This policy applies to all individuals whose personal data is processed by Park Planner.

3.1 Complaints from individuals

This policy applies to all individuals who wish to complain about the way in which the organisation processes their personal data.

3.1.1 Competence

We must and therefore will assess the competence of the individual to understand and exercise their rights and will respond in plain clear language that they can understand. An individual’s competence is assessed depending on their level of understanding. We take the general view that any person aged 13 or over is of a sufficient age and maturity to be able to exercise their data protection rights but will assess every situation individually on a case-by-case basis.

3.1.2 Verification of the authority of people making complaints on behalf of others

Someone may make a data protection complaint on behalf of another person (e.g. a family member, solicitor, advocacy service). If so, we must check they are authorised to act on the other person’s behalf. The form of evidence we may need depends on the circumstances, but examples include:

• An appropriate power of attorney; or
• A signed letter of authority from the person they are acting on behalf of.

3.2 Right to complain

Park Planner will ensure that data subjects are aware of their right to complain, which will include outlining details in our Data Privacy Notice and informing data subjects as part of responses to data subject access requests.

4. Your right to complain to the ICO at any time

You can complain to the ICO at any point. You do not need to wait for Park Planner to review its decision at any stage before complaining to the ICO. The ICO contact details are:

Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
https://ico.org.uk
Tel: 0303 123 1113
https://ico.org.uk/make-a-complaint/

The ICO can only deal with complaints on Data Protection issues. They cannot advise on aspects that relate to other legislative or regulatory frameworks.

5. Policy

As a data controller, from 19 June 2026 Park Planner is required to:

1. Establish a formal Data Protection Complaints Process;
2. Acknowledge complaints within 30 days (regardless of times when there may be closures or staff absences, or at certain periods of the year such as organisation holidays);
3. Without undue delay, take appropriate steps to respond;
4. Make appropriate enquiries;
5. Keep complainants informed of the steps taken / provide progress updates; and
6. Inform individuals of the complaint outcome without any unjustifiable or excessive delay.

We are not required to provide an outcome in any set timeframe but are required to do so without undue delay. This policy shows how we are compliant with these requirements.

6. What constitutes a complaint?

If you consider that Park Planner has infringed data protection legislation because of the way we have handled your personal information (or the personal information of someone you are acting on behalf of), you can complain to the organisation.

We will treat all complaints seriously and a resolution will be sought at the earliest possible time. It is desirable that complaints are resolved through the informal process as outlined below but if this does not resolve the situation, further stages of escalation through a formal route have been detailed.

6.1 Obligations as joint controllers and processors

Where we are a joint controller of data, we will have an appropriate arrangement in place with other joint controllers for the handling of complaints. Timescales covered in this policy commence as soon as a complaint is received by any of the controllers. We will also have agreements in place on how to handle complaints with any processors we use.

6.2 Where Data Protection issues form part of a wider complaint

Where data protection issues form part of a wider complaint, the complaint will be dealt with as part of the organisation’s complaints procedures. However, the Data Protection element will be dealt with in accordance with this policy and, if a response to the Data Protection complaint can be provided sooner than that for the other issues (and there is no justification for waiting to supply the replies together), then it will be.

7. How to make a complaint

A complaint form is provided at the end of this policy as Annex A and we encourage complainants to complete and return this to us. Please submit this to the Park Planner Data Protection Officer (DPO):

Park Planner, Viscount House, River Lane, Chester CH4 8RH
customerservices@parkplanner.co.uk

This can be completed and submitted either electronically or in writing. Although our preferred method of receiving your complaint is by using the form we have supplied, there is no obligation for you to make a complaint in that way. You can complain in any way you choose, including through other channels. You do not have to use legal terms or quote sections of the legislation in your complaint.

7.1 Confirmation of identity

Where appropriate, we may first seek to verify the data subject’s identity or any third party’s entitlement to the relevant information.

8. Roles and responsibilities

Park Planner has an appointed Data Protection Officer (DPO) who will endeavour to ensure that all personal data is processed in compliance with Data Protection legislation. Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the DPO.

9. What we do when we receive a complaint and complaint stages

9.1 Stage One — Informal resolution

• We will acknowledge receipt of a Data Protection complaint within 30 days. The 30 days start the day after we receive your complaint. If the last date to acknowledge falls on a weekend or public holiday, we have until the next working day to provide an acknowledgement.
• In instances where we are able to investigate the complaint and provide an outcome within 30 days, we are not required to provide an acknowledgement and outcome separately.
• If we are not clear what the complaint is about, we will ask the complainant for more information to identify what enquiries we need to make. We will do this as quickly as possible.
• If not already given, we may also ask what outcome the complainant is looking for as this could help us narrow down the scope of our investigation and resolve the matter sooner.
• We will investigate the complaint without any undue delay.
• We will make appropriate levels of enquiries based on the circumstances of the complaint. We are not required to take steps that are unreasonable or disproportionate.
• We will keep the complainant updated on the progress of the investigation.
• We will provide an outcome to the complainant including any corrective action taken and your right to escalate the matter. At the informal stage, complaints may be resolved over the phone rather than in writing.

9.1.1 Undue delay

What is unjustifiable or excessive always depends on the circumstances and may vary from one complaint to another. The time taken to investigate is likely to depend on a wide range of factors including the scale and complexity of the issue.

9.2 Stage Two — Formal resolution

• It is hoped that most data protection complaints will be resolved informally. However, if the complainant is not happy with the outcome of Stage One, they should notify the organisation using the contact details in Section 7 that they wish to proceed to Stage Two.
• Stage Two complaints will be handled by someone different to the person who conducted the original investigation. This may be someone external to the organisation. Once completed, the complainant will be notified of the outcome, any corrective action taken and their right to escalate the matter in writing.
• If the complainant is still not satisfied with the outcome, they should notify the organisation that they wish to progress to Stage Three of the Data Protection Complaints Procedure.

9.3 Stage Three — Independent review

• Stage Three complaints will be reviewed by a senior member of the organisation or an external expert. The complainant should set out their grounds for escalation to this stage and provide any supporting evidence.
• If possible, the reviewer will resolve the complaint without the need for further investigation. Where further investigation is required, they will decide how this is carried out.
• After due consideration of the complaint and all the facts considered, the nominated reviewer will decide whether or not the Stage Two decision was a reasonable one and decide whether to: (1) dismiss the complaint in whole or in part; (2) uphold the complaint(s) in whole or in part; and (3) make recommendations.

The complainant will receive the decision in writing without undue delay.

10. Recording complaints and use of personal data

Data Protection Complaints are recorded on a centralised database and monitored. Information relating to Data Protection Complaints may be used to provide reports and updates within the organisation.

11. Annex A — Data Protection Complaints Form

Please read Park Planner’s Data Protection Complaints Policy before completing this form as it provides information on how and when this form should be completed.

Please return completed forms to Park Planner’s Data Protection Officer (DPO):

Park Planner, Viscount House, River Lane, Chester CH4 8RH
customerservices@parkplanner.co.uk

You can use this form to submit a complaint to us about how we have handled your personal data or responded to a request where you have exercised your data subject rights. Although our preferred method of receiving your complaint is by using this form, there is no obligation for you to make a complaint in this way. You can complain in any way you choose, including through other channels. You do not have to use legal terms or quote sections of the legislation in your complaint.

At Park Planner we take our obligations under the UK GDPR and Data Protection Act 2018 seriously and welcome the opportunity to review concerns and, where appropriate, make things right. When we refer to ‘personal data’ we mean information that relates to you.

This form should not be used for a complaint that is not related directly to data protection matters.

Collection of personal data

This form will collect your personal data, such as your name and contact details as well as the detail of your complaint. This will be used to process your complaint and respond to you.

Park Planner Data Protection Complaints Form

Please use block capitals.

1. Your full name
2. Name of organisation, and your relationship to them (if relevant)
3. Contact address
4. Contact telephone
5. Contact email address
6. Are you making this complaint on behalf of another individual?
7. Please provide the name of the individual on whose behalf you are complaining & accompany this form with either: a signed letter of authority from the person you are acting on behalf of; an appropriate power of attorney; details of an authority the organisation has previously accepted and verified; or details of your status with the complainant
8. Details of the complaint. Please provide a summary of your concern(s), including dates and any information that will enable us to review and address your concern(s). Max 500 words.
9. Have you previously contacted us in relation to this matter? Yes/No. If yes, please provide details and what actions have been undertaken to date (including staff member(s) who have dealt with it so far) and solutions offered. Max 500 words.
10. The reason(s) that this was not a satisfactory resolution for you. Max 500 words.
11. What action(s) would you like to be taken to resolve your complaint? Max 500 words.
Signature(s):
Date:

If you have more than one ground of complaint we suggest numbering them so that each is considered in turn. If you require more space you may wish to attach an additional page setting out your complaint.