THE SCHOOLS HR CO-OPERATIVE LTD – DATA PROTECTION COMPLAINTS POLICY


Effective Date: 01 June 2026


PRIVACY POLICY


Definitions

“Data Protection Legislation” refers to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, and any subsequent amendments to this legislation. 
“Personal Data” has the same meaning as the definition in Article 4(1) of the UK General Data Protection Regulation and includes ‘special categories of personal data’ as defined in Article 9(1) of the UK General Data Protection Regulation.  For the purposes of this definition “personal information” has the same meaning as “personal data”.
“We”, “Us”, and “Our” means The Schools HR Co-operative Limited (“The SHRC” or “SHRC”) and should be construed accordingly. 
“You” and “Your” refers to any individual whose personal data we collect and/or process. 

1. Introduction 
The Data Protection Act 2018 is the main law governing data protection.  You have the right to complain directly to us if you consider that we have breached data protection laws because of the way we have handled your personal data (or the personal data of someone you are acting on behalf of).  This policy explains your right to complain and how we will handle your complaint, and may be subject to changes from time to time.

2. Roles and Responsibilities
Our Data Protection Officer (DPO) is responsible for handling data protection complaints within our organisation.  They will work with relevant employees of our organisation, as appropriate, to support the investigation of each complaint.

All employees are responsible for recognising data protection complaints.

Employees who receive or identify a data protection complaint, whether in person, through our email mailboxes or website “Contact Us” form, via social media, or through any other channels, must inform our DPO as soon as possible.

We are committed to handling data protection complaints in line with our legal obligations and in an accessible, fair, transparent, and timely manner.  We will handle complaints confidentially and only share information where appropriate to investigate and resolve the complaint, as required or authorised by law or otherwise in accordance with our privacy notices.

3. Types of Complaint
Examples of a data protection complaint include (but are not limited to) the following:

  • The way we have responded to a subject access request (SAR), or other data rights request (for more information on individual data rights, see our Privacy Policy)
  • The security measures we have used to store your information (e.g. where you have been impacted by a data breach)
  • How we have collected or used your personal information (e.g. where we have stored it, how long we have kept it for, or its accuracy).

This list is not exhaustive.  You have the right to complain to us at any time if you consider that there has been a breach of any of your rights in relation to your personal data.  Information on how we handle your personal data is set out in our separate Privacy Policy.  Please note: Where we are a Data Processor for your employer, you should refer to your employer’s Privacy Notice for details regarding the personal information your employer shares with us and for what purpose this information is shared with us. 

Complaints about other matters that do not relate to data protection, such as customer service issues, will not be treated as a data protection complaint.  If you have a complaint that is not about data protection, please refer to our “How To Give Us Feedback” section of the prevailing “Your Guide to Our Services” that can be accessed from the Service Level Agreement (SLA) Portal on our secure website.

If we are not sure whether you are making a data protection complaint, we will contact you to clarify the nature of your complaint.

4. How to Make a Data Protection Complaint to Us
You can submit a complaint directly to us using any of the following methods:

  • Website: “Contact Us” form
  • Email: dataprotection@schoolshr.net 
  • Telephone: 01895 717499
  • Mail: The Schools HR Co-operative Limited, Unit 1 Britannia Court, The Green, West Drayton, UB7 7PN (due to office operating hours it is recommended that complaints are submitted via one of the other above methods to avoid any delay with us acknowledging, investigating, and responding to your complaint).

This is not an exhaustive list.  We will take appropriate steps to respond to data protection complaints that we receive from any other channels, including via social media.

We will comply with our duty to make reasonable adjustments to our data protection complaints process for people with a disability as defined under the Equality Act 2010.  If you feel that you would benefit from any adjustments to our data protection complaints process, you should raise this with us when making your complaint.

5. Complaints Made on Social Media
Although data protection complaints may be made on social media, we would advise that a complaint may be dealt with more efficiently and effectively if it is made using one of the methods set out above.   Our social media channels are not routinely monitored, and there may be a delay if you make your complaint via this method.

Where we identify a data protection complaint about our organisation on social media, we will take appropriate steps to respond to the complaint in line with this policy.  However, as responding on social media is not usually a secure way of providing information, we will ask the individual making the complaint for an alternative contact method that we can use to respond to their complaint.

6. Complaints from Children
We will respond to any data protection complaints from children in plain, clear language they can understand at all stages of the complaints process.  We will comply with our obligations to assess the competence of the child to understand and exercise their rights. 

7. Responding to Your Complaint
When we receive a data protection complaint, we will acknowledge receipt no later than 30 calendar days from receiving it.

If we have any doubts about your identity, we may need to ask you for proof of identification before we respond to your complaint.

Complaints made on your behalf by a third party must be accompanied by evidence that the third party is authorised to act on your behalf.  If this is not provided, we will contact the third party to ask that such evidence is provided before we respond to your complaint.  If we are unsure whether a letter of authority is valid, we will contact you about this before we respond to your complaint (where we have valid contact details for you).

We will take appropriate steps to respond to your complaint without undue delay, including making enquiries into the complaint and keeping you informed about the progress of our investigation and timescales for the next update or outcome.

We may need to contact you to request further information to assist with our investigation.  It may take us longer to investigate and resolve complaints which are complex, serious, or which relate to multiple data protection issues.

Following our investigation, we will inform you of the outcome of your complaint without undue delay, explaining our findings, whether the complaint is upheld (in whole or in part), any action taken or proposed, and, where no action is taken, the reasons for that decision.

8. Complaints About Third-Party Data Processors
Where we receive a complaint that relates to the processing of personal information by our external third-party service providers, we will ask them to provide us with information relevant to the complaint without undue delay and in line with our contractual terms and/or Information Processing Agreement we have with the external third-party service provider.

9. Recognising a Data Protection Complaint
We will provide appropriate internal communications and support to our employees on recognising a data protection complaint and what to do if they receive one, including where to direct a data protection complaint within our organisation.

10. Record Keeping
We will keep a record of:

  • The date we received the data protection complaint
  • Your name
  • The date we sent our acknowledgement
  • A summary of relevant conversations and documents
  • The outcome of the complaint
  • Any actions we take because of our investigation.

We will use these records to demonstrate compliance, for audit and monitoring purposes, training, to support consistent handling and to identify recurring issues, trends or areas for organisational improvements or remediation.
We will not retain personal data relating to complaints for longer than is necessary.

11. Complaints to the Information Commissioner’s Office (ICO)
You have the right to make a data protection complaint at any time to the Information Commissioner's Office (ICO).

The ICO's contact details are as:

Information Access Team
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Live chat: https://ico.org.uk/global/contact-us/contact-us-public/public-advice/ 
ICO website: https://ico.org.uk/make-a-complaint/data-protection-complaints/

Ends.