Data Protection Complaints Notice
About this notice
We take the privacy and security of your personal data seriously. If you have a concern about how we have collected, used, shared, stored or deleted your personal information - including how we have used any automated tools or AI in a way that affects your personal data - we want to hear from you. We will do our best to put things right.
This notice explains your rights, how to raise a concern with us, what to expect when you do, and what to do if you are not satisfied with our response.
Your right to complain directly to us is a statutory right under the Data (Use and Access) Act 2025. You do not need to go to the ICO first - we are your first point of contact, though you are always free to contact the ICO directly if you prefer.
Who we are and who to contact
Data protection at Steady Space is the responsibility of Eleanor Hynes, Principal.
Email: elle@steady-space.co.uk
Form Submission: Online form
We accept complaints however they reach us - by email, phone, post, social media, in person or through an online form. However your complaint arrives, we will log it and handle it in the same way. You do not need to use a particular form or format to make a complaint.
Our Process
What counts as a data protection complaint
A data protection complaint is any concern you raise about how we have collected, used, stored, shared or deleted your personal data. This is broad - it covers a wide range of situations, not just formal data breaches.
Examples of the types of concern we can investigate:
- We did not respond to a data subject access request (a request to see what information we hold about you) within the required time, or the response was incomplete.
- We collected or used your personal data without a valid lawful basis, or for a purpose you were not told about.
- We shared your personal data with someone we should not have, or without a lawful reason to do so.
- We did not action a request to delete, correct or restrict your personal data when we were required to.
- We kept your personal data for longer than necessary.
- A data breach or security incident affected your personal data and we did not handle it correctly.
- You continued to receive marketing from us after you had opted out.
- Our privacy notice was unclear, incomplete or did not accurately describe how we use your data.
- We used AI or an automated tool in a way that affected your personal data without proper safeguards, transparency or human oversight.
- You believe an automated or AI-assisted decision affected you unfairly and your request for a human review was not handled properly.
What this process does not cover
- General dissatisfaction with the quality of our service, where personal data is not the issue - please contact us, and we will do our best to help.
- Billing or payment queries - please contact us.
- Complaints about the outcome of a data subject access request that was handled correctly and on time.
- Complaints about a third party's conduct or professional practice - these should be directed to the relevant professional body or regulator.
- Employment or HR grievances - these follow a separate process, even where a data request forms part of the grievance.
If you are not sure whether your concern is a data protection matter, please contact us anyway and we will help you direct it to the right place.
There are no formal requirements for how you raise a complaint. You can contact us verbally, in writing, or through any of the channels listed above.
How to raise a complaint with us
To help us investigate your concern as quickly as possible, it helps if you can tell us:
- Your name and contact details.
- A clear description of your concern - what happened, when, and who was involved.
- Any relevant reference numbers, screenshots or correspondence.
- What outcome you would like.
You do not need to provide all of this to make a valid complaint. If you are not sure what to include, just get in touch and we will help you from there. Our online complaints form also has set questions that may be a helpful guide to support you.
What happens when we receive your complaint
Step 1 - Acknowledgement
Step 1 - Acknowledgement
Step 1 - Acknowledgement
We will send you a written acknowledgement within 30 calendar days of receiving your complaint, including weekends and bank holidays. Day one of that period is the day after we receive it.
Our acknowledgement will confirm:
- That we have received your complaint and the date we received it.
- The name of the person who will be handling it.
- What happens next and an expected timescale.
Step 2 - Investigation
Step 1 - Acknowledgement
Step 1 - Acknowledgement
We will investigate your complaint fairly and thoroughly, without undue delay. This may include reviewing records and system logs, and speaking to relevant team members or suppliers.
Step 3 - Keeping you informed
Step 3 - Keeping you informed
Step 3 - Keeping you informed
We will not go silent while we are investigating. If we need more information from you, or if anything changes, we will get in touch as soon as possible.
Step 4 - Our response
Step 3 - Keeping you informed
Step 3 - Keeping you informed
We aim to give you a full response within one calendar month of receiving your complaint. In complex cases, we may extend this by up to a further two months. If we need to do this, we will tell you within the first month and explain why.
Our response will explain:
- What we investigated and how.
- What we found, and the reasons for our decision.
- What action (if any) we have taken or will take as a result.
- Your right to take your complaint to the ICO if you are not satisfied.
We will not charge a fee for handling your complaint, unless it is clearly unfounded or excessive - in which case we will explain this to you before proceeding.
Complaints about AI or automated decisions
If your concern relates to how AI or an automated tool has been used in connection with your personal data, we will review:
• Whether AI or an automated tool was used, and at what stage of the process.
• Whether the use was lawful, fair and transparent.
• Whether appropriate human oversight was in place at the point any decision was made.
We will not use AI alone to decide the outcome of a data protection complaint - a named member of our team will handle the investigation and response personally.
Where your complaint relates to an automated or AI-assisted decision, you have additional rights under the Data (Use and Access) Act 2025, including the right to ask us to explain how the process worked in plain English, to request a human review, and to ask us to reconsider the outcome. The person carrying out that review has full authority to change the original decision, not simply confirm it.
Third-party tools and suppliers
Where our processes involve third-party tools, platforms or suppliers, we remain your single point of contact for any data protection complaint. You do not need to contact our suppliers directly - we will liaise with them on your behalf as part of our investigation and keep you informed of the outcome.
If you are not satisfied with our response
If you remain unhappy after we have responded - or at any point during our process - you have the right to refer the matter to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. You do not have to wait for us to finish before contacting the ICO, and you do not have to raise your concern with us first, though we would always appreciate the opportunity to put things right.
Contact the ICO
- ICO Website: ico.org.uk
- Helpline: 0303 123 1113 (Monday to Friday, 9am to 4:30pm)
- Live Chat: Available on their website
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Our ICO registration
Steady Space is registered with the Information Commissioner's Office under registration number ZC090638. You can verify this at this link.
Accessibility
We want this process to be accessible to everyone. If you need this notice in a different format - for example, in large print, or if you would like to speak to someone directly rather than communicate in writing - please let us know and we will do our best to help.
This notice was last reviewed in June 2026. We review it at least once a year and update it whenever our contact details or processes change. If you have questions about this notice, please contact us at elle@steady-space.co.uk.
This notice is subject to copyright. If you require a complaints process or similar policy, please contact Jo Brianti using the details below.
© Jo Brianti | jo@jobrianti.co.uk | www.jobrianti.co.uk
The Contents of our Privacy Policy and complaints form are also copyrighted by Koffee Klatch Limited. To obtain a further license to use this work, please visit the Koffee Klatch website.