Data Protection Complaints Procedure

1. Purpose and scope

Hyndburn Leisure is committed to protecting the personal data of our members, customers, visitors, volunteers, staff and everyone else whose information we hold. This procedure explains how to make a complaint about how we have handled your personal data, and how we will deal with it.

It applies to any complaint that relates to our processing of personal data — for example, concerns about how we have collected, used, stored, shared or deleted your information, or about a request you have made to exercise your data protection rights.

This procedure sits alongside our general comments and complaints process. If your complaint is about something other than data protection (for example, the quality of a service, a booking or a facility), please use our general complaints route instead, and our team will help direct you to the right place.

2. Your right to complain

You have the right to raise a complaint with us if you believe we have not handled your personal data in line with data protection law. Making a complaint is free, and it will not affect the service you receive from us.

3. How to make a complaint

You can raise a data protection complaint in any of the following ways:

  • By email: [email protected]
  • By post: Data Protection Lead, Hyndburn Leisure, Town Hall, Blackburn Road, Accrington, BB5 1LA
  • In person or by phone: speak to a member of staff at any of our centres, or call your usual centre, and ask to raise a data protection complaint.

To help us deal with your complaint quickly, please tell us: your name and how to contact you; what your complaint is about and what happened; any relevant dates, reference numbers or staff involved; and what you would like us to do to put things right.

If you need help making your complaint — for example, in a different format or with support to put it in writing — please let us know and we will assist.

4. What happens when you complain

We will handle your complaint fairly, promptly and in line with the Data (Use and Access) Act 2025. Our process is:

Acknowledgement. We will acknowledge your complaint within 30 days of receiving it. Where we can, we will acknowledge it sooner.

Identity Verification Procedure

  • To protect your privacy and ensure personal data is not disclosed to an unauthorized third party, we must be satisfied of your identity before processing certain complaints or data requests.
  • Proportionate Checks: Where possible, we will verify your identity using information we already hold on file (such as your registered email address or account details).
  • Request for Additional ID: If we have reasonable doubts regarding your identity, or if your request involves sensitive personal data, we reserve the right to ask for official verification documents. This may include:
    • A copy of a valid photo ID (e.g., Passport or Driving License).
    • A copy of a recent utility bill or bank statement (dated within the last 3 months) showing your current address.
  • Third-Party Requests: If a complaint or request is made on your behalf by a third party (e.g., a solicitor or family member), we require written, signed authorisation from you, alongside proof of your identity.

The statutory one-month timeframe to respond to your request will be paused until we receive satisfactory proof of identity

  • Investigation. Without undue delay, we will take appropriate steps to investigate your complaint. This may include reviewing our records, speaking to the staff involved and examining how the personal data in question was handled. We will keep you informed of progress and may contact you if we need more information.
  • Outcome. Once we have completed our investigation, we will tell you the outcome, explain our findings, and set out any action we have taken or will take to put things right.

We aim to resolve complaints as quickly as possible. If a complaint is complex and will take longer, we will let you know and keep you updated on our expected timescale.

5. If you are not satisfied

If you are unhappy with our response, please contact us again and ask for your complaint to be reviewed. We will arrange for it to be looked at by someone who was not involved in the original handling, where possible.

6. Complaining to the Information Commissioner’s Office (ICO)

You also have the right to complain to the ICO, the UK’s independent data protection regulator, at any time. The ICO would generally expect you to have raised your complaint with us first.

You can contact the ICO at: • Website: ico.org.uk

  • Helpline: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

7. Keeping this procedure up to date

We will review this procedure regularly to make sure it remains accurate and effective, and we will update it whenever our processes or the law change.