Purpose of this policy

We are committed to treating personal data with respect, transparency, and care. This policy explains how you can raise a concern about the way your personal data has been handled, and how we will respond.

​It applies to all data protection complaints made under UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What counts as a data protection complaint?

A data protection complaint is any expression of dissatisfaction about how we have collected, used, shared, stored, or protected your personal data.

​You do not need to use legal language. If something worries you, you can tell us in your own words.

How can you make a complaint?

You can make a complaint in any format - email, phone, letter, or in person.

Please contact: Sarah Wallace - hello@sarahwallaceva.co.uk

​Include a brief description of what has happened and why you are concerned. You do not need to cite legislation or provide evidence at this stage.

What happens next

Step 1 - Acknowledgement

We will acknowledge your complaint within 30 days, as required by the Data (Use and Access) Act 2025.  Our acknowledgement will confirm that we have received your complaint and explain what will happen next.

Step 2 - Investigation

We will investigate your complaint without undue delay. This may include:

• reviewing the information you have provided

• checking our records and systems

• speaking to relevant staff

• assessing whether our data handling complied with the law

Step 3 - Keeping You Informed

If the investigation takes time, we will keep you updated so you know what is happening and when you can expect a full response.

Step 4 - Outcome

We will communicate the outcome without undue delay.

Our response will explain:

• what we found

• any steps we have taken or will take

• any changes we will make to improve our practices

Where appropriate, this may include correcting or deleting data, updating our processes, or offering an apology.

If you're not happy with our response

If you feel we haven't resolved your complaint to your satisfaction, you have the right to take it to the UK's independent data protection regulator, the Information Commissioner's Office (ICO).

Under the Data (Use and Access) Act 2025, we ask that you give us the opportunity to respond before contacting the ICO. The ICO will typically expect to see that you raised your complaint with the organisation first.

You can contact the ICO in the following ways:

• Website: ico.org.uk/make-a-complaint

• Helpline: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Record-keeping and learning

We keep a log of all data protection complaints, including the actions taken and outcomes reached.  We use this information to improve our processes and strengthen our data protection practices.

Review of this policy

We review this policy regularly to ensure it remains accurate, accessible, and compliant with current legislation and ICO guidance.

Find our Privacy Policy here.