Requests and accuracy
A subject access request was answered late or incompletely, or a request to delete, correct or restrict your data was not acted on when it should have been.
All services
Your information, your rights
Data Protection Complaints
If you are concerned about how I have handled your personal information, I want to hear from you. I take your privacy seriously and will do my best to put things right.
This notice explains your rights, how to raise a concern with Smallbizbod, and what to expect next.
How to raise a concern
You do not need legal language or a particular format to make a complaint.
About this notice
A concern does not have to be a data breach
You can raise any concern about how I collect, use, share, store or delete your personal data. This includes the use of automated tools or AI where it affects your information.
Use and sharing
Your information was collected or used without a valid lawful basis, used for a purpose you were not told about, or shared with someone it should not have been.
Storage and security
Your information was kept for longer than necessary, or a data breach or security incident affecting your personal data was not handled correctly.
Marketing and clarity
You kept receiving marketing after opting out, or my privacy information was unclear, incomplete or did not accurately explain how your data is used.
Your contact: Sarah Ingleby
I am the owner of Smallbizbod and responsible for data protection.
Derby, ENG, GB
Complaints are not available by post. Please contact me by email instead.
Getting started
Tell me what has happened
You can raise your concern verbally or in writing. I accept complaints by email, phone, social media or in person, and will log and handle them in the same way however they reach me.
These details can help me understand and investigate your concern:
-
Your name and contact details
So I know how to get back to you.
-
A description of your concern
What happened, when it happened and who was involved.
-
Relevant information
Reference numbers, screenshots or correspondence that help explain the issue.
-
The outcome you would like
Tell me what you would like to happen to resolve your concern.
You do not need all of this to make a valid complaint. If you are unsure what to include, just get in touch and I will help you from there.
A practical approach
What to expect next
My aim is to understand your concern, look into what happened and explain the outcome clearly.
-
01 / Record
Understand the concern
I will log your complaint. If anything is unclear, I may ask for more information so I can understand what needs investigating.
-
02 / Review
Look into what happened
I will consider the information you provide and the relevant handling of your personal data.
-
03 / Respond
Explain the outcome
I will explain my response and any steps to put things right. If you remain unhappy, you can take your concern to the ICO.
UK data protection law
Your information, your say
The UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025 give you rights over your personal data. Some rights depend on the circumstances and the legal basis for using your information.
- Access: ask to see the personal data I hold about you, sometimes called a subject access request or SAR.
- Correction: ask me to correct information that is wrong or incomplete.
- Deletion: ask me to delete your data in certain circumstances.
- Restriction: ask me to restrict how I use your data while a complaint is being looked into.
- Portability: receive a copy of your data in a commonly used, portable format.
- Objection: object to your data being used in certain ways.
- Automated decisions: protections apply to decisions made solely by automated means that have a significant effect on you.
- Explanation and human review: ask for a plain-language explanation of an automated decision affecting you, request review by a person and ask for the outcome to be reconsidered.
You can contact me directly
Your right to complain directly to Smallbizbod is a statutory right under the Data (Use and Access) Act 2025. You do not need to go to the Information Commissioner’s Office, or ICO, first.
You are also free to contact the ICO directly if you prefer.
Contact me about your rightsFinding the right route
When a different process applies
Not every concern is a data protection complaint. If you are unsure, please contact me anyway and I will help you direct it to the right place.
Service and payment queries
General dissatisfaction with my service, where personal data is not the issue, and billing or payment queries are handled separately. Email me and I will do my best to help.
This process does not cover dissatisfaction with the outcome of a subject access request that was handled correctly and on time. If you believe your data rights were not respected, please explain your concern.
Website terms and conditionsOther organisations and HR
Complaints about a third party’s conduct or professional practice should go to the relevant professional body or regulator.
Employment or HR grievances follow a separate process, even where a data request forms part of the grievance.
Ask which route to useA little reassurance
Questions about raising a concern
Do I need to make a formal written complaint?
No. There are no formal requirements. You can raise a concern verbally or in writing, without using a particular format or legal terminology.
Can I ask to exercise a right without complaining?
Yes. You can contact me to ask for access, correction or another data protection right without making a complaint. Just explain what you would like me to do.
What if I am not satisfied with your response?
Please tell me what remains unresolved so I can understand your concern. You also have the right to raise the matter with the Information Commissioner’s Office, the UK’s data protection regulator. You can contact the ICO directly if you prefer.
Let’s get it to the right place
Unsure where to start?
Tell me what is worrying you. You do not need to know which data protection right applies before getting in touch.