Get us involved in your plans

Data Protection Complaints Policy

Version: 1.0
Effective Date: July 2026
Policy Owner: Richard Causon – Director
Review Frequency: At least annually
Next Review Date: July 2027

1. Purpose

This Data Protection Complaints Policy sets out the procedures that Causon Business Finance Ltd (“the Firm”) follows when handling complaints relating to the processing of personal data.

The policy is designed to ensure compliance with:

  • UK GDPR;
  • Data Protection Act 2018;
  • Data (Use and Access) Act 2025;
  • Information Commissioner’s Office (ICO) guidance on handling data protection complaints.

The Firm is committed to handling all data protection complaints fairly, transparently, promptly and consistently.

This policy applies to all directors, employees, contractors and any third parties acting on behalf of the Firm.

2. Policy Statement

Causon Business Finance Ltd recognises individuals’ rights regarding their personal data and is committed to:

  • Providing an accessible process for raising data protection complaints.
  • Investigating complaints fairly and impartially.
  • Acknowledging complaints within the required timescales.
  • Keeping complainants informed throughout the investigation.
  • Taking corrective action where appropriate.
  • Learning from complaints to improve policies, procedures and customer outcomes.
  • Cooperating fully with the Information Commissioner’s Office where required.

There is no charge for making a complaint.

3. Scope

This policy applies to complaints concerning:

  • Collection of personal data.
  • Use of personal data.
  • Storage of personal data.
  • Sharing of personal data.
  • Accuracy of personal data.
  • Retention of personal data.
  • Subject Access Requests.
  • Data erasure requests.
  • Data portability requests.
  • Direct marketing activities.
  • Data breaches.
  • Any alleged infringement of UK data protection legislation.

4. Complaints Manager

The Firm has appointed:

Richard Causon
Director, Compliance Officer and Data Protection Lead

Address:
Suite 3, Catherine House
Coventry Road
Hinckley
Leicestershire
LE10 0JT

Email:
sales_support@causonbf.co.uk

Telephone:
01455 250690

The Complaints Manager is responsible for:

  • Receiving complaints.
  • Investigating complaints.
  • Communicating with complainants.
  • Maintaining complaint records.
  • Implementing remedial actions.
  • Reporting complaint trends to senior management.

5. What Is a Data Protection Complaint?

A data protection complaint is any expression of dissatisfaction relating to how the Firm has handled personal data or complied with data protection legislation.

Examples include:

  • Personal information being inaccurate.
  • Concerns regarding consent.
  • Delays in responding to a Subject Access Request.
  • Personal data being shared incorrectly.
  • Concerns following a personal data breach.
  • Data being retained longer than necessary.
  • Objections to direct marketing communications.

A complaint may be received verbally or in writing.

6. How Complaints Can Be Made

Individuals may submit complaints through any of the following channels:

Email
sales_support@causonbf.co.uk

Telephone
01455 250690

Post
Richard Causon
Causon Business Finance Ltd
Suite 3, Catherine House
Coventry Road
Hinckley
Leicestershire
LE10 0JT

The Firm will not require individuals to use a specific form before a complaint can be accepted.

7. Complaint Handling Process

7.1 Receipt of Complaint

All complaints received will be recorded in the Data Protection Complaints Register.

The record will contain:

  • Date received.
  • Complainant details.
  • Nature of complaint.
  • Relevant business area.
  • Investigation actions.
  • Outcome.
  • Any corrective actions taken.

7.2 Acknowledgement

The Firm will acknowledge receipt of a data protection complaint within 30 calendar days of receipt.

The acknowledgement will:

  • Confirm receipt.
  • Provide a reference number where appropriate.
  • Explain the next steps.
  • Identify the individual handling the complaint.
  • Provide expected timescales.

7.3 Investigation

The Firm will investigate complaints fairly, independently and without undue delay.

The investigation may include:

  • Reviewing correspondence.
  • Reviewing customer records.
  • Reviewing processing activities.
  • Interviewing employees.
  • Reviewing systems and controls.
  • Seeking additional information from the complainant.

The Firm will keep complainants informed regarding progress where investigations are expected to take longer than anticipated.

7.4 Complaint Outcome

Following investigation, the Firm will provide the complainant with a written outcome without undue delay.

The response will normally include:

  • A summary of the complaint.
  • The findings of the investigation.
  • Whether the complaint is upheld, partially upheld or rejected.
  • Any corrective actions taken.
  • Any remedial measures being implemented.
  • Information regarding escalation rights.

8. Escalation to the Information Commissioner’s Office

If the complainant remains dissatisfied after receiving the Firm’s final response, they may contact the Information Commissioner’s Office.

Information Commissioner’s Office

Website: https://ico.org.uk

Telephone: 0303 123 1113

Address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

The Firm encourages individuals to raise concerns directly with the Firm first so that issues can be resolved quickly and effectively.

9. Data Breach Complaints

Where a complaint relates to an actual or suspected personal data breach, the Firm will:

  • Investigate immediately.
  • Consider whether the incident constitutes a personal data breach.
  • Assess risks to affected individuals.
  • Determine whether notification to the ICO is required.
  • Notify affected individuals where legally required.

Personal data breaches are also managed in accordance with the Firm’s Data Protection and Data Security Policy.

10. Vulnerable Individuals

Where a complainant is identified as vulnerable, the Firm will take appropriate steps to ensure the complaints process remains fair and accessible.

Such measures may include:

  • Alternative communication methods.
  • Additional time where appropriate.
  • Clear and simple explanations.
  • Allowing authorised representatives to assist.

11. Root Cause Analysis

The Firm will undertake root cause analysis where appropriate to identify:

  • Systemic issues.
  • Process failures.
  • Training deficiencies.
  • Technology weaknesses.
  • Compliance risks.

Lessons learned will be reported to senior management and incorporated into process improvements where necessary.

12. Record Keeping

The Firm will maintain records of:

  • Complaints received.
  • Investigations conducted.
  • Correspondence.
  • Outcomes.
  • Corrective actions.
  • Root cause analysis.

Records will be retained for a minimum period of six years.

13. Responsibilities

Director

Richard Causon is responsible for:

  • Oversight of this policy.
  • Approval of complaint outcomes.
  • Monitoring trends.
  • Ensuring corrective actions are implemented.

Employees

All employees must:

  • Recognise potential data protection complaints.
  • Report complaints immediately.
  • Cooperate with investigations.
  • Complete any required remedial actions.

14. Monitoring and Review

The Director will review:

  • Complaint volumes.
  • Complaint themes.
  • Root causes.
  • Control weaknesses.
  • Regulatory developments.

This policy shall be reviewed at least annually and sooner where legal or regulatory changes require amendment.