DATA PROTECTION COMPLAINTS POLICY

How to raise a concern about your personal data

1. Introduction

We take the protection of personal data seriously. If you believe that Atompi Academy® has not handled your personal data correctly, or you are unhappy with how we have used it, you have the right to complain directly to us.

This policy explains how to make a data protection complaint, what happens after we receive it and the timescales you can expect. It supports our duties under section 164A of the Data Protection Act 2018, as inserted by the Data (Use and Access) Act 2025.

2. Your right to complain

You may complain if you believe there has been a problem with how we collected, stored, used, shared, secured, retained or otherwise handled your personal data. You do not need to prove that something has gone wrong before raising a concern.

A complaint may concern:

how we collected or used your personal data;

how we shared or protected your personal data;

the accuracy of the information we hold;

how long we have kept personal data;

direct marketing or consent;

our response, or failure to respond, to a data protection rights request; or

any other concern about your rights under data protection law.

A data protection complaint and a rights request, such as a subject access request, are separate matters and may have different statutory timescales. If your communication contains both, we will identify and handle each part appropriately.

3. How to make a complaint

You may make a complaint using any of the following methods. No special legal wording or form is required:

Email: [email protected]

Post: FAO Data Protection, Atompi Academy®, 16 Fern Place, Cardiff CF5 3HG

Telephone: 07806 940495

If you need help to make a complaint, including because of your age, disability, accessibility needs or preferred way of communicating, please tell us. We will take reasonable steps to help you.

To help us investigate efficiently, please include, where available:

your name and contact details;

the name of the person whose information is involved, if different;

a clear description of what happened and any relevant dates;

relevant reference numbers, correspondence or supporting information; and

the outcome you would like, if you have one in mind.

Please do not send original documents or more personal information than is reasonably necessary.

4. What happens next

4.1 Acknowledgement

We will acknowledge receipt within 30 days beginning on the day we receive the complaint. Our acknowledgement will normally provide a reference number, identify the person or role handling the matter, explain the next steps and request any additional information reasonably needed.

4.2 Investigation

Without undue delay, we will take appropriate steps to investigate and respond. Depending on the issue, this may include reviewing records, systems, consent information, privacy notices, security controls, retention arrangements and communications, and making appropriate enquiries of relevant people or service providers.

We will keep you informed about the progress of the complaint. If we need more information or the investigation will take longer because of its complexity, we will explain this and provide an update.

4.3 Outcome

Without undue delay after completing our investigation, we will tell you the outcome. We will explain what we found, whether the complaint is upheld in full or in part, any action taken or planned, and your options if you remain dissatisfied.

5. Identity and authorised representatives

To protect personal data, we may need to verify your identity before disclosing information about our investigation. We will request only information that is reasonable and proportionate.

You may authorise another person to complain on your behalf. Before sharing personal data with that person, we may ask for evidence of their authority, such as a signed letter of authority or another appropriate document.

6. Complaints involving children

Children have data protection rights. If a complaint is made by or on behalf of someone under 18, we will:

take account of the child’s best interests;

communicate in clear, age-appropriate language;

consider the child’s understanding and ability to exercise their own rights; and

where a parent, guardian or other representative acts for the child, verify their authority where appropriate and consider the child’s own views.

A student will not be disadvantaged because they, their parent or an authorised representative has made a complaint.

7. Fairness, confidentiality and conduct

We will handle complaints impartially, respectfully and as confidentially as possible. Complaint information will be shared only with people who need it to investigate, respond or take corrective action, or where disclosure is required by law.

We expect communications to remain respectful. If behaviour is abusive, threatening or unreasonably persistent, we may place proportionate limits on the method or frequency of contact while continuing to meet our legal obligations. We will explain any such limits.

8. If you are not satisfied

8.1 Ask us to review the outcome

If you believe that we have not fully addressed your concerns, please tell us and explain what remains unresolved. As Atompi Academy® is operated by a sole trader, a wholly independent internal review may not be possible, but we will reconsider the points raised and correct any error identified.

8.2 Complain to the Information Commissioner’s Office

You have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. You do not have to complete our review process before contacting the ICO.

Website: www.ico.org.uk

Telephone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

9. How we use complaint information

When you make a complaint, we process personal data as necessary to investigate, respond, demonstrate compliance and improve our practices. Our lawful bases may include compliance with our legal obligations under data protection law and our legitimate interests in resolving concerns and maintaining appropriate records. Where special category data is involved, we will also identify an applicable condition under data protection law.

We will collect only information reasonably needed for these purposes, protect it appropriately and retain complaint records in accordance with our retention arrangements. Further information is available in our Privacy Notice at www.atompiacademy.co.uk/privacy-notice.

10. Records, learning and review

We keep an appropriate record of complaints, key dates, investigation steps, the outcome and corrective action. We review complaints for recurring issues and use relevant findings to improve policies, training, systems and working practices.

This policy will be reviewed regularly and whenever there is a material change to the law, our systems or our processing activities.

Updated 2 August 2026

Document owner: Carol Paddon, Data Controller

This document has been adapted from a Suzanne Dibble Legal Academy data protection complaints policy template. It is a working final-review draft and should be checked before formal adoption. It does not constitute legal advice.

Atompi Academy® - Updated 2 August 2026