Data protection complaint policy

Gunning Marketing Limited

Effective Date: April 2026

This Data Protection Complaint Policy describes the policies of Gunning Marketing Limited. Gunning Marketing Limited is the data controller for all personal data described in our Privacy Policy.

We take the handling of your personal data seriously. If you believe we'ven’t handled it correctly – or you’re unhappy with how we’ve collected, used, stored, or shared it – you have the right to complain directly to us.

This policy explains how to make a data protection complaint, what happens when you do, and the timescales you can expect.

From 19 June 2026, all data controllers are legally required to have a formal internal complaints procedure under section 164A of the Data Protection Act 2018, as inserted by the Data (Use and Access) Act 2025. This policy fulfils that requirement.

Your right to complain

You can complain to us if you believe there’s been a problem with how we've handled your personal data. You don’t need to prove that something has gone wrong. If you have a concern, we want to hear about it.

Your complaint can be about any aspect of data protection, including:

• How we collected your personal data
• How we’re using, storing, or sharing your data
• The accuracy of the data we hold about you
• How long we’re keeping your data
• A response (or non-response) to a data subject access request
• How we've handled your data in connection with marketing
• Any other concern about your data protection rights

You can also authorise someone else to complain on your behalf. We may ask for proof of that authority before sharing details with them.

How to make a complaint

You can submit a complaint by any of the following means:

To help us look into your complaint quickly, please include:

• Your name and contact details
• A description of what’s happened or what you’re concerned about
• Any relevant dates, reference numbers, or correspondence
• The outcome you’re hoping for, if you have one in mind

Section 164A(2) of the Data Protection Act 2018 requires us to provide at least one electronic means for submitting complaints. Email satisfies this requirement.

What happens next

Acknowledgement

We’ll acknowledge your complaint within 30 days of receiving it. This is a legal deadline. Our acknowledgement will include a reference number and confirmation of who’s handling your complaint.

Investigation

We’ll then investigate your complaint. This may involve reviewing our records and systems, speaking to anyone involved in the processing concerned, and, where relevant, contacting any third-party processor whose work is the subject of your complaint.

We’ll keep you updated on progress. If the investigation is taking longer than expected, we'll write to you to explain why, give a revised timeframe, and confirm your point of contact.

Outcome

Once we've completed our investigation, we'll write to you with our findings. We’ll clearly explain:

• What we found during the investigation
• Whether your complaint is upheld in full, in part, or not upheld
• What action we've taken or will take as a result
• Your options if you remain unhappy

We aim to resolve complaints without undue delay. For straightforward matters, we'll normally respond within a few weeks of acknowledgement.

Verifying your identity

To protect your personal data, we may need to verify your identity before sharing details about our investigation with you. We’ll only ask for information that is reasonable and proportionate to the request.

If someone is making a complaint on your behalf, we'll ask them to confirm they have your authority before discussing the details with them.

Complaints involving children

Children under 18 have the same data protection rights as adults. If a complaint is made by or on behalf of a child, we'll:

• Prioritise the child's best interests throughout the process
• Use clear, age-appropriate language in our communications
• Consider the child's capacity to understand and exercise their rights on a case-by-case basis
• Where a parent, guardian, or other representative makes the complaint, verify their authority and take account of the child's own views where appropriate

If you’re not satisfied

• Ask us to review our decision: If you feel we've not fully addressed your concerns, please let us know. We’ll arrange for a senior review of the complaint. We aim to complete any such review within 14 days of your request.
• Complain to the ICO: You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator. The ICO generally expects you to raise your concern with us first, to give us the opportunity to put things right.

How we use your complaint data

When you make a complaint, we collect and process personal data about you in order to investigate and respond. We do this on the basis of our legal obligation under section 164A of the Data Protection Act 2018, and our legitimate interests in resolving complaints and demonstrating compliance.

We will only collect information that’s necessary. We’ll keep complaint records for 6 years from the date the complaint is closed to demonstrate our compliance and allow us to identify improvements.

Full details of how we handle personal data are in our Privacy Policy.

Unreasonable or abusive complaints

We’re committed to treating all complainants fairly and with respect, and we ask the same in return. If a complaint is made in a way that is abusive, threatening, or vexatious, we reserve the right to limit our engagement while still meeting our legal obligations under data protection law. We’ll always explain our reasons if we take this step.

Key timescales at a glance

Review of this policy

This policy was last reviewed in April 2026. We will review it whenever there are material changes to the law or to our business practices, and at least annually.

Document Control

This policy reflects the requirements of section 164A of the Data Protection Act 2018 as inserted by the Data (Use and Access) Act 2025. It should be read alongside our Privacy Policy. It does not constitute legal advice.