Who is covered by this policy
This policy applies to all individuals who process personal data on behalf of UrbanChain, including employees, contractors, temporary staff, partner organisations and third parties with access to UrbanChain systems or data.
Why do we need this policy
This policy ensures that UrbanChain can:
- demonstrate accountability to regulators;
- handle complaints consistently and fairly; and
- reduce regulatory risk by resolving issues before escalation to a regulator.
Failing to maintain a robust complaints process can increase the risk of unresolved data protection concerns, regulatory scrutiny and damage to our organisation's reputation. Without a formal mechanism for handling complaints, individuals may feel their concerns are not taken seriously, which could lead to the issue being escalated to a regulator. In addition, the absence of a complaints process may make it difficult for an organisation to identify systemic issues and evidence compliance with its obligations, more generally.
Policy principles
UrbanChain adopts the following principles when handling data protection complaints:
- Accessibility: Individuals must be able to complain using any reasonable channel.
- Fairness: Complaints must be assessed objectively and without bias.
- Timeliness: Action must be taken without undue delay.
- Transparency: Individuals must be informed about progress and outcomes.
- Accountability: Decisions and actions must be recorded and justifiable.
- Proportionality: Investigations must be appropriate to the risk and impact.
How we handle complaints
Receiving complaints
UrbanChain accepts data protection complaints through multiple channels, including email, online forms, telephone, post, in person, and social media (with redirection to secure channels). Complaints do not need to reference legislation or use formal language. Any expression of dissatisfaction about personal data handling may qualify.
To submit a data protection complaint, please contact our Data Protection Officer at DPO@urbanchain.co.uk.
Acknowledging complaints
Complaints must be acknowledged as soon as possible and within 30 calendar days. The timeframe begins the day after receipt. If the deadline falls on a non-working day, the next working day applies.
Acknowledgement will confirm receipt, outline next steps, and provide a point of contact. Where identity verification or clarification is requested early, a separate acknowledgement is not required.
Identifying and clarifying complaints
Where ambiguity exists, UrbanChain will seek clarification promptly, confirm whether the matter relates to data protection, and identify the desired outcome. Not all complaints that include data rights are data protection complaints — for example, a service complaint bundled with a deletion request remains primarily a service issue.
Investigation process
All data protection complaints must be investigated in a structured, fair and proportionate manner. Investigations will:
- assess all relevant facts thoroughly, objectively and without bias;
- involve appropriate staff, including subject matter experts where necessary (e.g. IT, HR, or legal);
- compare the details of the complaint with internal records, systems and correspondence; and
- consider applicable internal policies, contractual obligations and legal requirements.
Each complaint will have a nominated investigation lead responsible for coordinating and overseeing the process, from receipt to outcome. A clear audit trail will be maintained throughout, including key decisions and rationale, evidence reviewed, and communications with staff and the complainant.
Timeframes
UrbanChain aims to investigate complaints without undue delay. Internal target timelines are:
- Logging and triage: within 1–2 working days of receipt
- Acknowledgement: within 3–5 working days (always within the 30-day legal maximum)
- Initial assessment and scoping: within 5 working days
- Progress update to complainant: within 10–15 working days where the matter remains open
- Outcome: within 20–30 calendar days for standard complaints
For complex or high-risk complaints, timelines may extend where justified. In such cases, UrbanChain will document reasons for any delay and provide clear, revised timeframes to the complainant. These timelines are not default waiting periods — where a complaint can be resolved more quickly, it will be.
Communication and updates
UrbanChain will keep complainants informed of progress, explain delays where they arise, and provide expected completion timeframes. Communication will prioritise clarity over volume.
Outcome and resolution
Upon completion, UrbanChain will provide a clear outcome, explain findings and reasoning, describe any remedial actions taken, and address each complaint point where relevant. Even where UrbanChain concludes that it has complied with data protection law, the response will include a clear and reasoned explanation. Complainants will also be informed of their right to escalate to a regulator.
Escalation to a regulator
If you remain dissatisfied with the outcome, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
0303 123 1113 | www.ico.org.uk
Responsibilities
- Senior Managers: overall accountability and oversight.
- Primary Security Contact (DPO): advice, monitoring, and escalation.
- Line Managers: ensuring staff awareness and appropriate handling.
- All Staff: recognising and escalating complaints appropriately.