Complaints Procedure
How to raise a concern about our website, services or handling of personal information.
1. How to complain
Raise a complaint by emailing enquiry@cipherstone.co.uk. Include enough information for us to understand the issue, the outcome you are seeking and how we can contact you. If it concerns personal information, identify it as a “data-protection complaint”.
2. Data-protection complaints
Where a complaint concerns our handling of personal information, we will maintain a process designed to meet applicable UK data-protection complaint-handling obligations. This includes a clear route for complaints, acknowledgement, appropriate investigation and communication of the outcome.
Our policy is to acknowledge a data-protection complaint as soon as reasonably practicable and, in any event, within 30 days of receipt. We will consider the nature, complexity and seriousness of the issue, review relevant evidence and explain the outcome and any action we propose to take.
3. Other complaints
For complaints relating to our website, communications or professional services, we will assign the matter to an appropriate person who is sufficiently independent where practicable. Client-engagement complaints may also be governed by the applicable contract or engagement terms.
4. Information and security
We may request additional information, evidence or identity verification where necessary to investigate securely and fairly. Please avoid sending unnecessary sensitive or confidential information through unencrypted channels.
5. Outcomes
Depending on the circumstances, an outcome may include an explanation, correction, control improvement, rectification or deletion of information, process change, escalation or another proportionate remedy.
6. Escalation to the ICO
If the complaint concerns personal information and you remain dissatisfied, you may complain to the UK Information Commissioner’s Office. The ICO generally expects you to raise the issue with the organisation first. See the ICO complaints service.
7. Confidentiality and records
Complaint information will be shared only with people who reasonably need it for investigation, response, advice or legal obligations. We will retain complaint records for an appropriate period having regard to the issue and applicable requirements.
8. No retaliation
Cipherstone will not intentionally disadvantage a person merely because they raised a genuine complaint in good faith. This does not prevent proportionate action in response to abusive, fraudulent or unlawful conduct.