Data Protection Complaints Procedure

Our approach
We are committed to processing personal data in line with our data protection obligations and based on the UK GDPR principles, i.e.:
processing personal data lawfully, fairly and in a transparent way;
collecting personal data for specific and legitimate purposes and not processing personal data in a way that is incompatible with those purposes;
collecting and using adequate, relevant and minimal personal data;
taking reasonable steps to make sure personal data is accurate and kept up to date;
not keeping personal data longer than necessary; and
implementing appropriate security measures to protect personal data.
There may be times when we don’t get it right, and, if so, we want you to let us know. We take complaints very seriously and aim to learn from them to improve our standards of service and data protection controls.

How to make a data protection complaint

By completing our data protection complaint form

The form can be found here or we can post a copy to you.
You can submit the form online or email it to us at dpo@urw.com or post it to us at DPO, 4th Floor, 1 Ariel Way, London, W12 7SL.
Using the data protection form is entirely optional and you may prefer to complain to us using one of the other methods set out in this table.

By emailing us

You can email us with details of your complaint at dpo@urw.com

By writing to us

You can write to us with details of your complaint at DPO, 4th Floor, 1 Ariel Way, London, W12 7SL

What happens next?
We will acknowledge your complaint within 30 days of receiving it.
We may ask for information to check your identity and if someone is making a complaint on your behalf we will also need to check that the person making the complaint is allowed to do so.
If we are unable to identify you / verify the authority of the person making the complaint, we may not be able deal with it.

Considering and investigating your complaint
We will consider your complaint without undue delay and keep you/your authorised representative updated at appropriate intervals on the progress of our investigation.
The usual steps in the process are:
reviewing your complaint;
locating and reviewing relevant information we hold relating to the complaint;
establishing the relevant facts;
consulting staff involved in handling your personal data;
considering compliance with our policies and procedures; and
Taking steps to resolve the complaint and improve future compliance.
We may need to ask you for further information or documents. If so, we will ask you to provide the information within a specific period of time so that we can respond to your complaint within a reasonable time frame.

Notifying you of the outcome of our investigation
We will let you/your authorised representative know the outcome of the complaint without undue delay.
We will explain clearly what we've done to deal with your complaint and, where appropriate, any action we have taken as a result.

If we can’t resolve your complaint
We hope that we will be able to resolve your complaint to your satisfaction, but, if you are unhappy with the outcome, you can complaint to the UK or EEA data protection regulator, in particular, the regulator for the Member State in which you reside or work, or in the member state where the activity which gave rise to the complaint occurred or our lead supervisory authority as applicable. In the United Kingdom, the data protection supervisory authority is the Information Commissioner’s Office (ICO).
The ICO’s contact details are:

Address

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

More details on how to complain to the ICO are available on the Complaints page of the ICO’s website. You should usually submit your complaint to the ICO within three months of your last contact with us.

Data protection rights and non-data protection related complaints
Please note that if you are looking to exercise one of your rights under UK GDPR (right to access, information, rectification, restriction, erasure, object, portability, rights in relation to automated decision making) we have a separate procedure for this and we will handle your request in accordance with this procedure.
You can find more information about your data protection rights and how to exercise them in our privacy notice, which can be found here.
If your complaint does not relate to data protection, please see email Guest Services at help@urw.com .