Purpose

This policy sets out how Ocasa Management Limited (“the Company”) will manage and respond to complaints relating to the handling of personal data. It aims to ensure that concerns are dealt with fairly, consistently and promptly, while promoting transparency and accountability in our data protection practices.

We encourage individuals to raise any concerns with us in the first instance so that we have the opportunity to investigate and, where appropriate, resolve the matter. Nothing in this policy prevents an individual from exercising their legal right to raise concerns with the UK Information Commissioner’s Office (ICO).

Scope

This policy applies to complaints relating to the Company’s processing of personal data. Parties including but not limited to the following list may refer to this policy:

• Current or former employees;
• Job applicants;
• Contractors or agency staff;
• Customers or prospective customers;
• Suppliers or business partners; or
• Any other individual whose personal data is processed by the Company.

The policy covers complaints concerning compliance with applicable data protection legislation, including concerns about the collection, use, storage, sharing, retention, security or accuracy of personal data, or the handling of an individual’s data protection rights.

This policy may be amended at any time.

Raising a data protection complaint

Individuals who believe that their personal data has been handled incorrectly or who have concerns about the Company’s data protection practices should contact the Company as soon as possible, providing sufficient information to allow the issue to be investigated.

Where possible, the complaint should include:

• That the individual is seeking to make a complaint;
• The nature of the concern;
• Any relevant dates or events;
• The personal data or processing activity involved; and
• The outcome the individual is seeking.

Complaints must be submitted to the following email address: privacy@ocasahomes.co.uk

Our approach to complaints

The Company is committed to handling data protection complaints fairly, objectively and without unnecessary delay.

Upon receipt of a complaint, we will:

• Acknowledge receipt of the complaint within 30 days;
• Assess the nature of the concern and any immediate actions required;
• Investigate the issues raised, seeking further information where necessary;
• Take appropriate steps to address any identified issues or rectify errors; and
• Provide a response to the individual explaining the outcome of our investigation and any actions taken, where appropriate.

We will aim to investigate complaints without undue delay and will keep the complainant updated during the course of the investigation. The complexity of complaints may vary, and the time required to investigate will depend on the circumstances. If additional time is required to fully investigate the complaint, the complainant will be informed.

Records of complaints

All data protection complaints will be recorded on the Company’s internal Complaints Register.

The register will include the following details, where appropriate:

• The date the complaint was received;
• The date the complaint was acknowledged;
• The name or identifier of the complainant;
• A summary of the complaint;
• The actions taken to investigate and respond;
• The outcome of the complaint;
• The date the complaint was resolved and
• Any corrective actions required.

Escalation

If an individual remains dissatisfied after receiving the Company’s response, they may choose to raise their concerns with the UK Information Commissioner’s Office or seek any other remedies available to them under applicable law.

The Company will cooperate with any lawful enquiries from the relevant regulatory authorities and will continue to engage constructively with individuals seeking to resolve data protection concerns.

Quality and compliance review

We value feedback and use information gathered through complaints to help us review our data protection practices where appropriate.

Where relevant, the outcome of a complaint may inform our ongoing assessment of our policies and procedures to support the effective handling of personal data and compliance with applicable data protection requirements.