DATA PROTECTION COMPLAINTS POLICY
The Hurlingham Club (“the Club”) is committed to protecting personal data and to giving members, staff and other individuals a straightforward way to raise concerns about how we handle it. This policy explains how the Club deals with data protection complaints, and reflects the requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the statutory complaint-handling duties introduced by the Data (Use and Access) Act 2025, in force from 19 June 2026. It should be read together with the Club’s Privacy Notice, which can be found here.
1. Purpose
This policy explains how individuals can raise a data protection complaint with the Club, how the Club will acknowledge, investigate and respond to it, and how individuals can take a complaint further to the Information Commissioner’s Office (ICO) if they remain dissatisfied.
2. Scope
a. This policy applies to complaints from any individual whose personal data the Club processes, including members, job applicants, staff, contractors and visitors.
b. A “data protection complaint” is any expression of dissatisfaction, however made, about the Club’s compliance with data protection law in relation to an individual’s personal data. Examples include, but are not limited to:
(1) collecting or using personal data without a lawful basis;
(2) sharing personal data with a third party without proper justification;
(3) failing to respond to, or incorrectly handling, a request to exercise a data protection right (for example, a request for access, correction or erasure);
(4) keeping personal data for longer than necessary;
(5) holding inaccurate personal data; and
(6) failing to keep personal data secure, including a suspected data breach.
c. This policy does not cover general complaints about Club services, staff conduct or membership matters that do not concern the handling of personal data – these are dealt with under the Club’s other complaints or grievance procedures. Where a complaint raises both data protection and other issues, the data protection element will be handled under this policy.
3. Our commitment
a. We will not charge a fee for handling a complaint, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act.
b. We will accept a complaint however it is made, including by letter, email, telephone, or in person.
c. Individuals will not be disadvantaged in their membership or employment for raising a complaint in good faith.
d. We will handle every complaint fairly, proportionately and in confidence, sharing details only with those who need them to investigate and resolve it.
4. How to make a complaint
a. Complaints should ideally be made to the Club’s data protection contact:
(1) by email to dataprotection@hurlinghamclub.org.uk;
(2) by post to Matthew Sommerich, Head of Membership, The Hurlingham Club, Ranelagh Gardens, London SW6 3PR; or
b. It helps the Club deal with a complaint quickly if the individual provides their name and contact details, a description of the issue, and, where possible, the outcome they are looking for – but a complaint will not be refused solely because this information is incomplete.
5. Who deals with complaints
a. Day-to-day responsibility for receiving and investigating data protection complaints sits with the Head of Membership, supported by the Deputy Secretary. The Club also works with an external consultant who assists with data protection matters.
b. Where a complaint concerns the conduct of the Head of Membership, or otherwise raises a potential conflict of interest, it will be escalated to and handled by the Secretary to preserve impartiality. The Secretary may delegate handling of the complaint to another member of the Club’s Senior Leadership Team, or the Club’s data protection partner.
c. Complaints that involve a data breach that was not previously known to the Club will be dealt with in line with the Club’s Data Breach Policy in conjunction.
6. Complaints made on behalf of someone else, or by children
a. Where a complaint is submitted by someone on behalf of another individual (for example, a relative, friend or adviser), the Club will take reasonable steps to verify that they are authorised to act on that individual’s behalf before investigating the complaint or disclosing any information in response to it.
b. Where a complaint is made by, or on behalf of, a child, the Club will consider whether the child has sufficient understanding to complain in their own right, use clear and age-appropriate language in its response, and, where appropriate, involve a parent or guardian.
7. Our process and timescales
a. The Club will acknowledge receipt of a complaint within 30 days.
b. The Club will begin looking into the complaint without undue delay, and will carry out an investigation that is reasonable and proportionate to the nature and complexity of the issues raised.
c. While the complaint is being investigated, the Club will keep the individual informed of progress, including if a delay is expected and why.
d. Once the investigation is concluded, the Club will, without undue delay, tell the individual the outcome, including:
(1) a summary of the steps taken to look into the complaint;
(2) what was found, and any action taken or to be taken as a result;
(3) where the complaint is not upheld, the reasons why; and
(4) a reminder of the individual’s right to complain to the ICO (paragraph 9), whether or not the complaint is upheld.
8. When we may decline to investigate a complaint
a. We aim to consider all data protection complaints fairly and proportionately. However, there may be circumstances in which we decide not to investigate a complaint, or not to investigate it further.
We may do so where:
(1) the complaint does not concern our processing of personal data or otherwise falls outside the scope of data protection law;
(2) the same complaint has previously been considered and responded to, and the complainant has provided no material new information or raised any new issues which would justify reopening the matter;
(3) the complaint is manifestly unfounded or excessive, taking into account its nature, scope and any pattern of repetitive requests or correspondence;
(4) the complaint is abusive, threatening or otherwise appears to have been made primarily to cause disruption rather than to raise a genuine data protection concern;
(5) there is insufficient information to identify the issue complained of and the complainant does not provide reasonably necessary clarification after being given an appropriate opportunity to do so; or
(6) the matter would be more appropriately dealt with under another complaints, appeal or legal process and there is no separate data protection issue requiring investigation.
b. A decision not to investigate will not be made solely because a complaint is inconvenient, complex, critical of the Club, or is made by an individual who has previously submitted complaints.
c. Where we decide not to investigate a complaint, or to bring an investigation to an end, we will explain the reasons for our decision. Where appropriate, we will also inform you of your right to raise your concerns with the Information Commissioner's Office (ICO).
9. Record keeping
a. The Club will keep a record of every data protection complaint, including the date it was received, the date it was acknowledged, the steps taken to investigate it, and its outcome.
b. These records will be retained in accordance with the Club’s data retention schedule and may be requested by the ICO to demonstrate compliance.
10. Your right to complain to the Information Commissioner’s Office
a. Individuals have the right to complain to the ICO about the Club’s handling of their personal data at any time; they do not have to wait for the Club to finish investigating a complaint, or to be dissatisfied with the Club’s response, before doing so.
b. The ICO can be contacted:
(1) online at ico.org.uk/make-a-complaint;
(2) by telephone on 0303 123 1113; or
(3) by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
c. The Club will refer to this right in its outcome letters and in its responses to requests to exercise data protection rights.
11. Related documents
a. This policy should be read alongside the Club’s Privacy Notice, which sets out in more detail how the Club collects, uses and safeguards personal data.