Last updated: 20/05/26

Our commitment

We take our responsibilities around personal data seriously. This policy sets out the process for raising a concern about how we have handled your personal data, and what you can expect from us in response.

This policy covers complaints made under UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What is a data protection complaint?

A data protection complaint arises when someone is dissatisfied with the way we have collected, used, shared, stored, or safeguarded their personal data.

There is no need to use formal or legal language — if something does not feel right, simply tell us what has concerned you.

How to raise a concern

Complaints can be submitted by email, phone, post, or in person — whichever is most convenient for you.

To get in touch, please contact: Beth Amos - beth@wildflowerneuro.org.uk

A brief explanation of your concern is all we need to get started. You do not need to quote legislation or submit supporting evidence at this point.

Our complaints process

Acknowledgement

We will confirm receipt of your complaint within 30 days, in line with the requirements of the Data (Use and Access) Act 2025. Our acknowledgement will outline the next steps.

Investigation

We will look into your complaint promptly. Depending on the nature of your concern, this may involve reviewing what you have told us, examining our records and systems, consulting relevant members of staff, and considering whether our data handling met the required legal standard.

Keeping you updated

If the investigation requires more time, we will keep you informed of progress so you are never left wondering where things stand.

Our response

Once the investigation is complete, we will set out our findings without undue delay. Our response will cover what we found, what action we have taken or intend to take, and any improvements we plan to make to our practices. Where it is appropriate to do so, this may include correcting or erasing data, revising our procedures, or acknowledging where things went wrong.

Escalating your complaint

If you are dissatisfied with our response, or with the way your complaint has been handled, you have the right to refer the matter to the Information Commissioner's Office (ICO) at www.ico.org.uk

You are not required to contact us again before doing so, though we would welcome the chance to address your concerns directly if you are willing.

Learning from complaints

We maintain records of all data protection complaints, including the steps taken and the outcomes reached. We use this information to identify patterns, address weaknesses, and continually improve how we manage personal data.

Policy review

This policy is reviewed on a regular basis to ensure it stays up to date with current legislation, ICO guidance, and best practice.