Data Protection Complaints Procedure
How to raise a concern about the handling of personal information.
Purpose
This procedure explains how individuals may complain to Ebis Risk Services Limited about the way we have collected, used, stored, disclosed or otherwise processed their personal information.
How to Submit a Complaint
Complaints may be submitted through the Contact page on this website, by email to [email protected], or by post to our registered office. A complaint does not need to refer to data protection legislation. If the substance of the concern is that Ebis has mishandled personal information, we will treat it as a data protection complaint.
What to Include
Please provide your name, contact details, a description of the concern, any relevant dates, correspondence or reference information, and the outcome you are seeking. We may ask for further information where this is necessary to understand or investigate the complaint.
We may also request information reasonably necessary to verify identity, protect personal information and clarify the scope of the complaint.
Acknowledgement
We aim to acknowledge receipt of a data protection complaint within five working days. Where a complaint is submitted through the online form, an automated confirmation may also be generated.
How Complaints Are Handled
Complaints will be reviewed by a director or another suitably senior person who was not materially involved in the matters complained of, where reasonably practicable. Where this is not possible, Ebis will take appropriate steps to manage any actual or perceived conflict of interest.
Where a complaint concerns personal information processed on behalf of a client or another controller, we may need to refer the matter to that organisation or coordinate our response with it, subject to applicable legal and confidentiality obligations.
Investigation
We will take appropriate steps to investigate the complaint without undue delay and will keep the complainant informed of progress where appropriate. This may include reviewing relevant records, considering the legal basis for processing, assessing whether exemptions apply and speaking with personnel or advisers involved in the matter.
Outcome
Once our review is complete, we will provide an outcome in writing. Where appropriate, the response will explain our findings, any action taken or proposed, any decision not to take action and the reasons for that decision.
Escalation
If you remain dissatisfied, you have the right to complain to the Information Commission (formerly known as the Information Commissioner's Office (ICO)), the United Kingdom's independent regulator for data protection and information rights. Further information is available on its website at www.ico.org.uk.
Record Keeping
We maintain records of data protection complaints separately from routine enquiries for accountability, audit, risk management, insurance and legal purposes. Records are retained only for as long as reasonably necessary, having regard to the nature of the complaint, any action taken and applicable legal, regulatory and limitation periods.
Document Information
Version: 2.0
Effective Date: 1 August 2026
Last Reviewed: 1 August 2026