Data protection complaints notice

About this notice

We take the privacy and security of your personal data seriously. If you have a concern about how we have collected, used, shared, stored or deleted your personal information, including how we have used any automated tools or AI in a way that affects your personal data, we want to hear about it. We will do our best to put things right.

This notice explains your rights, how to raise a concern with us, what to expect when you do, and what to do if you are not satisfied with our response.

Your right to complain directly to us is a statutory right under the Data (Use and Access) Act 2025. You do not need to go to the Information Commissioner’s Office first. We are your first point of contact, though you are always free to contact the ICO directly if you would rather.

Your rights under UK data protection law

Under UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, you have the right to:

  • Access the personal data we hold about you. This is sometimes called a subject access request, or SAR.

  • Ask us to correct information that is wrong or incomplete.

  • Ask us to delete your data in certain circumstances.

  • Ask us to restrict how we use your data while a complaint is being looked into.

  • Receive a copy of your data in a commonly used, portable format.

  • Object to us using your data in certain ways.

  • Not be subject to a decision made solely by automated means, where that decision has a significant effect on you.

  • Under the Data (Use and Access) Act 2025, ask us to explain in plain terms how an automated decision affecting you was made, request that a person reviews that decision, and ask us to reconsider the outcome.

If you would like to exercise any of these rights, please contact us using the details below.

Who we are and who to contact

Lucy Oldershaw Training and Consultancy Ltd is the controller responsible for the personal data covered by this policy. The company is registered in England and Wales under company number 17368269, with its registered office at 124 City Road, London, EC1V 2NX. You can contact us at [email protected].

We accept complaints however they reach us, whether by email, phone, post, social media, in person or through an online form. However your complaint arrives, we will log it and handle it in the same way. You do not need to use a particular form or format to make a complaint.

Data protection at Lucy Oldershaw Training and Consultancy Ltd is the responsibility of:

Responsible person: Lucy Oldershaw, Director

Email: [email protected]

Online form: https://lucy-oldershaw.fillout.com/data-complaint

What counts as a data protection complaint

A data protection complaint is any concern you raise about how we have collected, used, stored, shared or deleted your personal data. That is deliberately broad. It covers far more than formal data breaches.

Examples of the types of concern we can investigate

  • We did not respond to a subject access request within the required time, or our response was incomplete.

  • We collected or used your personal data without a valid lawful basis, or for a purpose you were not told about.

  • We shared your personal data with someone we should not have, or without a lawful reason to do so.

  • We did not action a request to delete, correct or restrict your personal data when we were required to.

  • We kept your personal data for longer than necessary.

  • A data breach or security incident affected your personal data and we did not handle it correctly.

  • You continued to receive marketing from us after you had opted out.

  • Our privacy notice was unclear, incomplete, or did not accurately describe how we use your data.

  • We used AI or an automated tool in a way that affected your personal data without proper safeguards, transparency or human oversight.

  • You believe an automated or AI-assisted decision affected you unfairly, and your request for a human review was not handled properly.

  • We handled your personal data incorrectly in the course of delivering training, for example your booking details, delegate record, certificate record or feedback.

  • We handled your personal data incorrectly in the course of a consultancy or audit engagement, for example recruitment or vetting records we saw as part of that work.

Where we handle personal data on behalf of someone else

For most of what we do, we are the data controller. That means we decide why and how your personal data is used, and we are responsible for it. This applies to enquiries, course bookings, delegate records, certificates, feedback, newsletter subscriptions and our own client records.

Sometimes we handle personal data on behalf of an organisation that has engaged us, rather than on our own account. This happens in consultancy and audit work, where we may review a client’s recruitment files, vetting records or safeguarding documents in order to advise them. In those situations the organisation is the controller and we act as their processor. We follow their instructions, and we cannot make decisions about that data ourselves.

If your complaint relates to data we hold in that capacity, we will still acknowledge it within 30 calendar days. We will then pass it to the organisation responsible without undue delay, and tell you who they are and that we have done so. We will support their investigation and will not simply leave you to start again. If it turns out we are the controller after all, we will handle the complaint ourselves under this notice.

What this process does not cover

Some concerns are important but are not data protection matters. The following are handled elsewhere.

  • A safeguarding concern about a child, or an allegation about an adult who works with children. These must never be delayed by a data protection process. If you are worried about a child, contact children’s social care in the area where the child lives, or the police if a child is at immediate risk. If your concern is an allegation against an adult working with children, contact the Local Authority Designated Officer for the area in which that organisation is based, within one working day.

  • General dissatisfaction with the quality of our training or consultancy, where personal data is not the issue. Please contact us at [email protected] and we will do our best to help.

  • Billing or payment queries. Please contact us at [email protected].

  • Complaints about accreditation, certification or course standards set by an awarding body. These should be raised with the relevant body, and we will point you to the right route if you are not sure who that is.

  • Complaints about the outcome of a subject access request that was handled correctly and on time.

  • Complaints about a third party’s conduct or professional practice. These should go to the relevant professional body or regulator.

  • Employment or HR grievances. These follow a separate process, even where a data request forms part of the grievance.

If you are not sure whether your concern is a data protection matter, please contact us anyway and we will help you get it to the right place.

How to raise a complaint with us

There are no formal requirements for how you raise a complaint. You can contact us verbally or in writing, through any of the routes above. To help us look into your concern as quickly as possible, it helps if you can tell us:

  • Your name and contact details.

  • A clear description of your concern, including what happened, when, and who was involved.

  • Any relevant reference numbers, screenshots or correspondence.

  • What outcome you would like.

    You do not need to provide all of this for your complaint to be valid. If you are not sure what to include, just get in touch and we will take it from there.

What happens when we receive your complaint

Here is what you can expect from us, step by step:

  • Step 1: Acknowledgement, within 30 calendar days

    We will send you a written acknowledgement within 30 calendar days of receiving your complaint. That period includes weekends and bank holidays, and day one is the day after we receive it.

    • Our acknowledgement will confirm:

      • That we have received your complaint, and the date we received it.

      • The name of the person handling it.

      • What happens next, and the timescale you can expect.

  • Step 2: Investigation

    We will investigate your complaint fairly and thoroughly, without undue delay. That may include reviewing our records and system logs, and speaking to any associates, suppliers or awarding bodies involved.

  • Step 3: Keeping you informed

    We will not go quiet on you while we are investigating. If we need more information from you, or if anything changes, we will be in touch as soon as we can.

  • Step 4: Our response

  • We aim to give you a full response within one calendar month of receiving your complaint. In complex cases we may extend this by up to a further two months. If we need to do that, we will tell you within the first month and explain why.

    • Our response will explain:

      • What we investigated, and how.

      • What we found, and the reasons for our decision.

      • What action we have taken or will take as a result, if any.

      • Your right to take your complaint to the ICO if you are not satisfied.

We will not charge a fee for handling your complaint, unless it is clearly unfounded or excessive, in which case we will explain that to you before going any further.

Complaints about AI or automated decisions

If your concern relates to how AI or an automated tool has been used in connection with your personal data, we will review:

  • Whether AI or an automated tool was used, and at what stage of the process.

  • Whether that use was lawful, fair and transparent.

  • Whether appropriate human oversight was in place at the point any decision was made.

We will not use AI alone to decide the outcome of a data protection complaint. A named person will handle the investigation and the response personally.

Where your complaint relates to an automated or AI-assisted decision, you have additional rights under the Data (Use and Access) Act 2025. These include the right to ask us to explain in plain English how the process worked, to request a human review, and to ask us to reconsider the outcome. The person carrying out that review has full authority to change the original decision, not simply to confirm it.

To be clear about how we work: we do not use AI or automated tools to make decisions about individuals in our training or consultancy. We use AI in supporting ways, such as drafting and administration, always with a person reviewing the output before it is used. We keep a register of the tools we use and the personal data they can access.

Third-party tools and suppliers

We use external tools, platforms and suppliers to help deliver our training and consultancy, including systems for our website, bookings, forms, email and record keeping. We keep a register of these suppliers, what they process, and where that data is held.

Where our processes involve those tools or suppliers, we remain your single point of contact for any data protection complaint. You do not need to contact our suppliers directly. We will liaise with them on your behalf as part of our investigation and keep you informed of the outcome.

How we keep records

We keep records of all data protection complaints we receive, the steps we take to investigate them, and the outcomes. This helps us respond consistently, spot any recurring issues, and demonstrate compliance if we need to.

Complaint records are held securely and only accessed by those who need to handle the matter. Please note that the Information Commissioner’s Office may request access to our complaint records as part of its regulatory role, and we are required to provide them.

If you are not satisfied with our response

If you remain unhappy after we have responded, or at any point during our process, you have the right to refer the matter to the Information Commissioner’s Office, the UK’s independent data protection regulator. You do not have to wait for us to finish before contacting the ICO, and you do not have to raise your concern with us first, though we would always appreciate the chance to put things right.

  • Website - ico.org.uk

  • Helpline - 0303 123 1113, Monday to Friday, 9am to 4:30pm

  • Live chat - Available at ico.org.uk

  • Post - Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Our ICO registration

Lucy Oldershaw Training and Consultancy Ltd is registered with the Information Commissioner’s Office under registration number ZC218349. You can verify this on the register of fee payers at ico.org.uk.

Accessibility

We want this process to be open to everyone. If you need this notice in a different format, for example in large print, or if you would rather speak to someone directly than put things in writing, please let us know and we will do our best to help.

Contact us at [email protected].

Effective date: 28 August 2026.

Review date: 28 August 2027, or sooner following a material change.

Stay in the Loop

Safer Recruitment updates, straight to your inbox.

QUICK LINKS

Home

About

Training

Consultancy

Contact

CONTACT

124 City Road, London, EC1V 2NX

© 2026 Lucy Oldershaw Training and Consultancy Ltd · Registered in England and Wales, Company No. 17368269 · ICO ZC218349