Data Protection Complaints
How to raise a concern about your personal information
Effective date: 25 April 2025
If you’re unhappy with how we’ve handled your personal information, we want to hear from you. We take every concern seriously and we’ll do our best to put things right.
This notice explains what counts as a data protection complaint, how to raise one, what happens next, and what you can do if you’re not satisfied with our response.
What is a data protection complaint?
A data protection complaint is when you believe we haven’t handled your personal information in the way the law requires. For example, you might want to complain if:
We collected or used your information without proper reason to do so
We didn’t respond properly when you asked to see, correct, or delete your information
We shared your information with someone we shouldn’t have
We kept your information for longer than necessary
You experienced a data breach that affected your personal information
You’re concerned about the accuracy of information we hold about you
We didn’t handle your information securely
How to raise a complaint
You can contact us in any of the following ways. Please use whichever is easiest for you.
Online form
Contact form on our website - this is the quickest way to reach us.
Email
Post
Stefanie Clarke
Jotterbox Support
Office 5851, 58 Peregrine Road
Hainault, Ilford
Essex, IG6 3SZ
What to include in your complaint
It helps if you can tell us:
Your name and contact details
What happened and when (as best you can remember)
How this has affected you
What outcome you’re looking for
Don’t worry if you don’t have all of this to hand, we’ll work with you to understand what happened.
What happens after you complain
Step 1: We acknowledge your complaint (within 30 days)
We’ll confirm we’ve received your complaint within 30 calendar days. This acknowledgement will include the name of the person handling your complaint and what you can expect to happen next.
Step 2: We investigate
We’ll look into what happened without unnecessary delay. The depth of our investigation will depend on the nature and complexity of your complaint. We’ll keep you informed of progress along the way and let you know if we need more time.
Step 3: We give you our response
We aim to provide a full response within three months of receiving your complaint. More complex cases may take longer, but we’ll always keep you updated. Our response will be written in plain English and will explain:
What we found
What action we’ve taken (if any)
Your right to take the matter further if you’re not happy with our response
Complaints about data we handle on behalf of our clients
As a virtual assistant and operations support provider, we sometimes handle personal information on behalf of our clients as part of the services we provide. In those situations, we act as a data processor, meaning we follow our client’s instructions when using that information, rather than deciding how it’s used ourselves.
If your complaint relates to personal information that one of our clients is responsible for, the right place to raise it is directly with that client. They are the data controller for that information and are responsible for making decisions about how it’s used.
You can find the data controller’s contact details in their own privacy notice. If you’re not sure who to contact or which organisation is responsible for your information, please get in touch with us and we’ll point you in the right direction.
When we are the data controller
We are the data controller for the personal information we hold about our own clients, contacts, and website visitors. This includes information such as names, contact details, and records of our working relationship. Complaints about how we handle this information are covered by this notice in full.
When we act as a data processor
When working on client projects, we may access or process personal information belonging to our clients’ customers, employees, or other individuals. In these cases:
• Our client decides how and why that information is used, they are the data controller
• We act on their instructions and in line with our data processing agreement with them
• Any complaint about that information should be directed to our client in the first instance
• If a complaint is sent to us in error, we will let you know promptly and direct you to the right organisation
We are committed to handling any misdirected complaints with the same care and professionalism that we apply to all aspects of our work. We will never leave you without a clear next step.
If you’re not happy with our response
If you feel we haven’t resolved your complaint to your satisfaction, you have the right to take it to the UK’s independent data protection regulator - the Information Commissioner’s Office (ICO).
Under the Data (Use and Access) Act 2025, we ask that you give us the opportunity to respond before contacting the ICO. This is now a formal part of the complaints process - the ICO will typically expect to see that you raised your complaint with us first.You can contact the ICO in the following ways:
• Website: https://ico.org.uk/make-a-complaint/
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
About us
Stefanie Clarke is the founder of Jotterbox Support, a UK-based virtual assistant and operations support practice providing calm, structured, and reliable admin, communications, and operational support to creative and values-led founders, entrepreneurs, and small businesses.
As a data controller, we hold and process personal information in line with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as updated by the Data (Use and Access) Act 2025.
We are registered with the ICO as a data controller. Our ICO registration number is: ZB817422.
Contact us
If you have any questions about this notice or how we handle personal information more generally, please get in touch.
Email: hello@jotterbox.co.uk
Website: www.jotterbox.co.uk
This notice was last updated on 25 April 2025. We review it regularly and update it whenever our processes change or the law requires it.
This notice covers complaints about personal information only. It does not cover complaints about the quality of our services.