Privacy Complaints Procedure

Timetable for handling privacy complaints

‍ 1/ Complaint Received

‍ When we receive a privacy or data protection complaint, we will first review the information provided to:

• ‍ confirm that the complaint relates to The Matthew;

• identify the nature of the privacy concern being raised;

• determine whether the complaint also includes a formal data protection rights request, such as a Subject Access Request (SAR), request for rectification, request for erasure, or another individual rights request.

If necessary, we may contact the complainant for clarification before proceeding further.

2/ Verifying the complainant’s identity

‍If we have reasonable doubts regarding the identity of the individual making the complaint, we may request information necessary to verify identity before responding.

• Verification will be requested at the earliest opportunity where required.

• We will only request information that is necessary and proportionate for identity verification purposes.

• If sufficient information is already available to verify identity, we will not request additional documentation.

3/ Acknowledgement of the complaint

‍In accordance with applicable data protection requirements, we will acknowledge receipt of privacy complaints within 30 days of receiving them. The 30-day period begins on the day after the complaint is received and includes weekends and public holidays. If the final day of the acknowledgement period falls on a weekend or public holiday, or any other day that our office is normally closed, acknowledgement will be issued by the end of the next working day.

The acknowledgement may include:

• confirmation that the complaint has been received;

• information about the next steps in the process;

• requests for additional information if required; and

• indicative timescales where available.

4/ Updates during the investigation

‍We will, without undue delay, take appropriate steps to investigate privacy complaints and keep complainants informed during the process. Updates may include:

• confirmation that the investigation remains ongoing;

• requests for further information;

• progress updates where available; and

• expected timescales for the next communication.

Where limited progress can be reported, we will still seek to keep the complainant appropriately informed.

5/ Information gathering and acknowledgement review

‍Before conducting a full investigation, we will ensure that we have enough information to properly understand and assess the complaint. We will not make assumptions regarding the issues raised and may contact the complainant if additional information is required.

6/ Investigation process

As part of the investigation process we will:

• identify and preserve relevant information where appropriate;

• gather and review relevant records and evidence;

• assess all relevant facts thoroughly, fairly and accurately;

• compare information held by The Matthew with information provided within the complaint;

• review our internal policies, procedures and data handling practices where relevant; and

• determine whether any corrective action or process improvements are necessary.

Investigations will be conducted fairly and with appropriate consideration of applicable data protection obligations.

7/ Outcome of the complaint

Once the investigation has been completed, we will inform the complainant of the outcome without undue delay. Our response will normally be sent by email unless another communication method has been requested.

The response may include:

• the findings of the investigation;

• actions taken, where applicable;

• any corrective measures implemented; and

• information regarding further options available to the complainant.

‍If a complainant remains dissatisfied with the way in which their personal information has been handled or with the outcome of their complaint, they may contact the Information Commissioner’s Office (ICO): ico.org.uk/global/contact-us

The ICO is the UK's independent authority responsible for upholding information rights and data protection law.‍