1. Scope
This policy applies where a person believes Paulioskos has collected, used, disclosed, retained, secured, corrected, deleted or otherwise handled personal information improperly. It also covers concerns about transparency, direct marketing, cookies, privacy rights and the handling of an earlier request.
A complaint does not need to use legal terminology or a particular form. Privacy rights requests are managed under the same controlled register where appropriate, but the legal rules and response periods for the specific right continue to apply.
2. How to complain
The preferred route is [email protected]. Complaints may also be submitted through the website enquiry form or another accessible arrangement agreed with the complainant. Postal correspondence may be sent to the registered office at Unit A, 82 James Carter Road, Mildenhall, IP28 7DE.
Please provide, where possible:
your name and appropriate contact details;
a description of what happened and when;
the information, communication, page or service involved;
any relevant enquiry, project or correspondence reference;
the effect the issue has had on you; and
the outcome or remedy you are seeking.
Do not send passwords, private keys or unnecessary sensitive information. Paulioskos will ask for additional information only where it is reasonably necessary to understand or investigate the concern.
3. Identity and representatives
Paulioskos uses a risk-based approach to identity verification. Most matters can be confirmed using an email address already held, an enquiry or project reference, relevant dates, organisation details or a callback through existing contact information.
Where identity remains uncertain and the response would disclose personal information, Paulioskos may request proportionate evidence such as photographic identification or recent proof of address. Irrelevant details may be redacted. The verification method and date will normally be recorded instead of retaining a copy of the identity document.
A representative must provide signed authority or evidence of legal authority, the names and contact details of both parties, the scope of the complaint and confirmation of whether the representative may receive personal information. Paulioskos may also verify the representative’s identity.
4. Acknowledgement and communication
Paulioskos will acknowledge a data-protection complaint within 30 days of receipt, as required by the current complaints framework. The internal aim is to acknowledge much sooner and, where the issue is straightforward, provide a substantive response within 14 days.
The acknowledgement will identify the complaint reference, owner, expected next step and any further information needed. Paulioskos will keep the complainant informed without undue delay where the investigation is continuing or the expected completion date changes.
5. Investigation process
Record the complaint in the restricted Privacy Rights and Complaints Register.
Confirm the scope, relevant systems, people and information.
Preserve relevant evidence and apply any immediate containment or correction needed.
Search appropriate mailboxes, databases, file stores, logs and controlled records.
Obtain factual input from relevant personnel, suppliers or advisers where necessary.
Assess the applicable privacy notice, lawful basis, data-protection principles, contract and internal controls.
Consider whether information should be corrected, restricted, deleted, disclosed or retained.
Record the decision, rationale, approver, outcome and corrective actions.
Communicate the outcome in clear language and explain further complaint rights.
6. Ownership and evidence
Dianne Finn is the primary privacy and compliance coordinator and is responsible for logging, acknowledgement, deadline tracking and correspondence. Paul Finn acts as deputy and approval owner for matters involving technical searches, legal risk, refusal, restriction, disclosure or erasure. Edward Finn may assist with authorised technical searches or actions under the direction of the case owner.
The original request and correspondence are retained in the controlled privacy mailbox. The register, decision record and procedural evidence are retained in the restricted compliance area. Sensitive supporting evidence is kept in a restricted case location and is not placed in public BookStack content.
7. Outcomes and remedies
Depending on the facts, an outcome may include an explanation, correction, access response, deletion or restriction, suppression of marketing, control improvement, supplier action, staff guidance, policy update, apology or another proportionate remedy. A complaint may be upheld, partly upheld or not upheld.
Where Paulioskos cannot provide the requested outcome, the response will explain the main reason, any applicable limitation and the available escalation route. Nothing in this policy restricts a legal or regulatory right.
8. Fair treatment and confidentiality
Raising a complaint will not result in adverse treatment. Information is shared only with people who need it for investigation, advice, remediation or a lawful requirement. Professional advisers, relevant suppliers, insurers, regulators or law-enforcement bodies may receive minimum necessary information where disclosure is lawful and proportionate.
9. Retention and improvement
Complaint and privacy-rights case evidence is normally retained for six years after closure, then securely deleted or anonymised. Paulioskos reviews themes, outcomes and overdue actions to identify recurring issues and improve policies, notices, systems and working practices.
10. Complaining to the ICO
Paulioskos encourages complainants to give it an opportunity to understand and resolve the concern. A person may also complain to the Information Commissioner’s Office. In most cases, the ICO will expect the concern to have been raised with the organisation first, but this policy does not prevent a person from contacting the ICO or exercising another legal right.
Contact
| Route | Details |
|---|---|
| Privacy complaints | [email protected] |
| Alias | [email protected] |
| Website | https://www.paulioskos.com |
| Postal correspondence | Postal correspondence may be sent to the registered office: Unit A, 82 James Carter Road, Mildenhall, IP28 7DE. |
| UK regulator | Information Commissioner’s Office - make a complaint |
Reference framework
These references explain the legal and good-practice framework used when preparing this document. They do not represent certification, accreditation, endorsement or legal advice.