UPZELO LIMITED (THE COMPANY) – UK GDPR COMPLAINTS POLICY.
A thorough and transparent complaints procedure is considered necessary to enable the Company to consider what happened and how to rectify errors in relation to breaches of UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. This Policy follows the Upzelo Data Protection Policy.
This Complaints Policy ensures that all complaints are treated with due consideration, fairness and equitability.
Complaints pursuant to retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (“UK GDPR”).
If anyone wishes to complain to Upzelo about how their personal information has been processed, their UK GDPR complaint has been handled, or appeal against any decision made following a complaint, they can submit their complaint in writing. This should be addressed directly to the Upzelo Data Privacy Manager (“DPM”) at support@upzelo.com.
Complaints regarding how personal data has been processed should be submitted to Upzelo’s DPM. Receipt will be acknowledged within 7 working days.
The DPM will review and respond in writing to a complaint within 14 working days of receipt of the complaint. If a longer time is required Upzelo Limited will notify the Complainant of the delay and will provide an estimate of when Upzelo Limited will provide a substantive response.
If a Complainant is dissatisfied with the way in which their complaint has been handled then they can forward their complaint to:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK.
Upzelo’s Complaints Procedure has three stages of handling and escalation:
Stage 1 – Informal Complaints – delegation by the DPM to a suitable person knowledgeable about the circumstances for their investigation, discussion and resolution with the Complainant.
Stage 2 – Formal Complaints – investigation, discussion and resolution with the Complainant by the DPM himself who is assigned to the role of dealing with Data Protection complaints.
Stage 3 – Final Escalation to the Directors – consideration of the complaint and the prior investigation and efforts to resolve by the directors of Upzelo Limited.
All complaints should go fully through Stages 1 or 2 before/if they proceed any further to Stage 3. The DPM can elect to decide, on behalf of Upzelo Limited, that a complaint is vexatious or of no merit to justify Stage 3 and can refuse any Complainant’s request for a Stage 3 review. Such a decision is to be undertaken in the knowledge that the Complainant’s next step would be to the ICO or legal action which are factors that shall be taken into account in such decision.
Any Stage 2 Formal Complaint that is reasonably established to have been a reportable breach of UK GDPR shall be reported to the ICO as soon as reasonably possible after it has been established, and within 72 hours.
The Complainant makes a verbal complaint to an Upzelo employee or representative who then logs and reports it immediately to the DPM who decides whether it is a Stage 1 or Stage 2 process that is best required in all the circumstances.
The appointed Upzelo employee hears the complaint, undertakes any required investigation into the circumstances of the allegation, agrees resolution with the Complainant and implements solution.
The Complainant confirms in writing that they are satisfied with the resolution.
Timeframe: Immediate to within 5 working days.
Method: Verbal initially; reference to DPM and his response to be in writing.
The complaint is received either verbally, in writing by email, phone, website or by personal submission.
The complaint is logged and reported to the DPM to deal with and action.
Receipt of the complaint is acknowledged within one working day.
Investigation of the complaint by the DPM will then proceed.
As above, if it is reasonably established that a Data Protection breach of the use or application of personal data has occurred which is reportable to the ICO, then Upzelo Limited shall as soon as reasonably possible formally notify the ICO.
The Complainant will receive a response from Upzelo Limited authorised by the DPM within 10 working days.
If applicable, the results of the investigation into the matter shall be shared with the ICO and Upzelo Limited shall liaise with the ICO if and as required.
The Complainant has 10 working days after the response has been issued in which to respond further; in the absence of which it will afterwards be assumed the complaint is resolved.
Timeframe: Between one working day and, at the latest, 21 working days after submission of complaint.
Method: Email, verbal or written complaint submission; written response.
This applies where the Complainant confirms:
a) that they are not content with the proposed course of action, explanation or resolution, and
b) the DPM does not consider the case to be vexatious or of no merit such as a Stage 3 is justified for purposes of transparency; or
c) the ICO considers that there has been a breach.
Receipt of the escalated complaint is acknowledged within one working day.
The DPM fully briefs the Director hearing the complaint concerning its history and the details and conclusions of any prior Stage 1 or Stage 2 investigations.
Within 5 working days, the Complainant is advised of when the relevant Director of Upzelo Limited will be considering the complaint which will be no more than 2 working weeks from the date of the acknowledgement of the escalated complaint. The Complainant will be invited to make a final written submission to the said Director.
If the Complainant is asked to attend a meeting in person, the Complainant may be accompanied by an independent person for the purposes of support.
The Director concerned will proceed with review of the substance of the case and its handling.
The Complainant will receive a response from the Director or, as he may delegate such task, the DPM within 10 working days after the Director’s consideration of the complaint.
The Director’s decision is final, subject to any ruling or information relating thereto from the ICO.
Timeframe: Between one working day and, at the latest, 28 working days after submission of complaint.
Method: Written response from a Director or on his behalf by the DPO.
Receipt of the escalated complaint is acknowledged within one working day.
The DPM fully briefs the Director hearing the complaint concerning its history and the details and conclusions of any prior Stage 1 or Stage 2 investigations.
Within 5 working days, the Complainant is advised of when the relevant Director of Upzelo Limited will be considering the complaint which will be no more than 2 working weeks from the date of the acknowledgement of the escalated complaint. The Complainant will be invited to make a final written submission to the said Director.
If the Complainant is asked to attend a meeting in person, the Complainant may be accompanied by an independent person for the purposes of support.
The Director concerned will proceed with review of the substance of the case and its handling.
The Complainant will receive a response from the Director or, as he may delegate such task, the DPM within 10 working days after the Director’s consideration of the complaint.
The Director’s decision is final, subject to any ruling or information relating thereto from the ICO.
Timeframe: Between one working day and, at the latest, 28 working days after submission of complaint.
Method: Written response from a Director or on his behalf by the DPO.
Persisting in a complaint after being advised that there are insufficient or no grounds for their complaint or that Upzelo Limited is not the appropriate authority.
Refusing to co-operate with the complaints process, without good reason, whilst still wanting their complaint to be resolved, including a failure or refusal to specify the grounds of a complaint despite offers of assistance, changing the basis of the complaint as inquiries of a complaint despite offers of assistance, changing the basis of the complaint as inquiries are made and introducing trivial or irrelevant new information and expecting this to be taken into account and commented on.
Submitting repeat complaints, after the complaints procedure has been completed essentially about the same issues, with additions/variations which the Complainant then insists on being treated as new complaints and put through the full Complaints Policy procedure again.
Refusing to accept the outcome of the {R Complaints Policy procedure after its conclusion, repeatedly arguing the point, complaining about the outcome, and/or denying that an adequate response has been given.
Upzelo Limited will ensure that correspondence and/or complaints are being, or have been, investigated properly according to the appropriate procedure and are notified to the ICO if applicable and required.
If a decision has been taken to record the complaint formally, Upzelo Limited then has to decide on the next steps. This is the point at which it may consider whether a complaint is vexatious, persistent, repetitive or otherwise an abuse of process.
When the decision has been taken to apply this Complaints Policy, the individual will be written to with reasons for the decision and what action is being taken, subject to any requirements of the ICO. That decision may be amended if the individual Complainant continues to behave in a way which is unacceptable.
Where a Complainant’s behaviour is so extreme or it threatens the immediate safety and welfare of staff, Upzelo Limited may consider other options, for example reporting the matter to the police or taking legal action.
Document Owner and Approval
The DPM is the owner of this document and is responsible for ensuring that this Complaints Policy is reviewed from time to time.
A current version of this Complaints Policy is available to all members of staff.
This Complaints Policy was approved by the Board of Directors of Upzelo Limited on 10th February 2022.
Dated: 10th February 2022
