ABOUT THIS NOTICE
I take the privacy and security of your personal data seriously. If you have a concern about how I have collected, used, shared, stored or deleted your personal information – I want to hear from you. I will do my best to put things right.
This notice explains your rights, how to raise a concern with me, what to expect when you do, and what to do if you are not satisfied with our response.
Your right to complain directly to me is a statutory right under the Data (Use and Access) Act 2025. You do not need to go to the ICO first – I am your first point of contact, though you are always free to contact the ICO directly if you prefer.
YOUR RIGHTS UNDER UK DATA PROTECTION LAW
Under UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, you have the right to:
- Access the personal data I hold about you (sometimes called a subject access request, or SAR).
- Ask me to correct information that is wrong or incomplete.
- Ask me to delete your data in certain circumstances.
- Ask me to restrict how I use your data while a complaint is being looked into.
- Receive a copy of your data in a commonly used, portable format.
- Object to me using your data in certain ways.
- Not be subject to a decision made solely by automated means where that decision has a significant effect on you.
- Under the Data (Use and Access) Act 2025, ask me to explain in plain terms how an automated decision affecting you was made, request that a person reviews that decision, and ask me to reconsider the outcome.
If you would like to exercise any of these rights, please contact me using the details below.
Data protection at Artie Carden is the responsibility of:
Responsible person: Artie Carden
Email: artiecardenbusiness@gmail.com
Online form: GDPR / Data Protection Complaints Form
I accept complaints in the following ways: by email or through my online form. However your complaint arrives, I will log it and handle it in the same way. Due to my disabilities please use either email or my online form to make a complaint.
WHAT COUNTS AS A DATA PROTECTION COMPLAINT
A data protection complaint is any concern you raise about how I have collected, used, stored, shared or deleted your personal data. This is broad – it covers a wide range of situations, not just formal data breaches.
Examples of the types of concern I can investigate
- I did not respond to a data subject access request (a request to see what information I hold about you) within the required time, or the response was incomplete.
- I collected or used your personal data without a valid lawful basis, or for a purpose you were not told about.
- I shared your personal data with someone I should not have, or without a lawful reason to do so.
- I did not action a request to delete, correct or restrict your personal data when I was required to.
- I kept your personal data for longer than necessary.
- A data breach or security incident affected your personal data and I did not handle it correctly.
- You continued to receive marketing from me after you had opted out.
- My privacy notice was unclear, incomplete or did not accurately describe how I use your data.
WHAT THIS PROCESS DOES NOT COVER
- General dissatisfaction with the quality of our service, where personal data is not the issue – please contact me at artiecardenbusiness@gmail.com and I will do our best to help.
- Billing or payment queries – please contact me at artiecardenbusiness@gmail.com.
- Complaints about the outcome of a data subject access request that was handled correctly and on time.
- Complaints about a third party’s conduct or professional practice – these should be directed to the relevant professional body or regulator.
- Employment or HR grievances – these follow a separate process, even where a data request forms part of the grievance.
If you are not sure whether your concern is a data protection matter, please contact me anyway and I will help you direct it to the right place.
There are formal requirements for how you raise a complaint due to my disabilities. Please contact me, in writing through any of the channels listed above.
HOW TO RAISE A COMPLAINT WITH ME
To help me investigate your concern as quickly as possible, it helps if you can tell me:
- Your name and contact details.
- A clear description of your concern – what happened, when, and who was involved.
- Any relevant reference numbers, screenshots or correspondence.
- What outcome you would like.
You do not need to provide all of this to make a valid complaint. If you are not sure what to include, just get in touch and I will help you from there.
WHAT HAPPENS WHEN I RECIEVE YOUR COMPLAINT
Here is what you can expect from me, step by step:
Step 1 – Acknowledgement (within 30 calendar days)
I will send you a written acknowledgement within 30 calendar days of receiving your complaint, including weekends and bank holidays. Day one of that period is the day after I receive it.
My acknowledgement will confirm:
- That I have received your complaint and the date I received it.
- The name of the person who will be handling it.
- What happens next and an expected timescale.
Step 2 – Investigation
I will investigate your complaint fairly and thoroughly, without undue delay. This may include reviewing records and system logs, and speaking to relevant team members or suppliers.
Step 3 – Keeping you informed
I will not go silent while I am investigating. If I need more information from you, or if anything changes, I will get in touch as soon as possible.
I aim to give you a full response within one calendar month of receiving your
complaint. In complex cases, I may extend this by up to a further two months. If I need to do this, we will tell you within the first month and explain why.
My response will explain:
- What I investigated and how.
- What I found, and the reasons for our decision.
- What action (if any) I have taken or will take as a result.
- Your right to take your complaint to the ICO if you are not satisfied.
I will not charge a fee for handling your complaint, unless it is clearly unfounded or excessive – in which case I will explain this to you before proceeding.
THIRD-PARTY TOOLS AND SUPPLIERS
Where my processes involve third-party tools, platforms or suppliers, I remain your single point of contact for any data protection complaint. You do not need to contact my suppliers directly – I will liaise with them on your behalf as part of our investigation and keep you informed of the outcome.
HOW I KEEP RECORDS
I keep records of all data protection complaints I receive, the steps I take to investigate them, and the outcomes. This helps me respond consistently, identify any recurring issues, and demonstrate compliance if needed.
Complaint records are held securely and only accessed by those who need to handle the matter.
Please note that the Information Commissioner’s Office (ICO) may request access to our complaint records as part of its regulatory role, and I are required to provide them.
IF YOU ARE NOT SATISFIED WITH MY RESPONSE
If you remain unhappy after I have responded – or at any point during our process – you have the right to refer the matter to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. You do not have to wait for me to finish before contacting the ICO, and you do
not have to raise your concern with me first, though I would always appreciate the opportunity to put things right.
ICO Website: ico.org.uk
Helpline: 0303 123 1113 (Monday to Friday, 9am to 4:30pm)
Live chat: Available at ico.org.uk
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ACCESSIBILITY
I want this process to be accessible to everyone. If you need this notice in a different format – for example, in large print, or if you would like to speak to someone directly rather than communicate in writing – please let me know and I will do my best to help.
Contact me at: artiecardenbusiness@gmail.com
Last updated: 2nd October 2026
