Third Space are committed to handling data protection complaints in accordance with the Data Protection Act 2018 and UK GDPR (“UK Data Protection Laws”). This Complaint Handling Policy (the “Policy”) outlines our approach to handling data protection complaints. It should be read together with other applicable policies. It applies to complaints from any data subject or their authorised representative.

Under the UK Data Protection Laws, if you believe that Third Space has breached its data protection obligations in relation to your personal data, you have the right to complain to Third Space, as well as to the UK data protection regulator or to pursue a legal claim. This Policy explains what a complaint is for the purposes of UK GDPR, how to make a complaint to Third Space and what Third Space will do when we receive a data protection complaint.

2. Scope

This Policy applies to all employees, workers, contractors and third parties acting on behalf of Third Space Holdings Limited with company number 05538574 and registered address of 1 Bow Churchyard, London, United Kingdom EC4M 9DQ and its subsidiaries (“Third Space”).

3. Complaint

Any complaint made under this Policy must relate to data protection. Examples of data protection complaints include:

• Third Space not using personal data in accordance with Third Space’s Privacy Notice;
• the way in which Third Space have handled a data subject access or data subjects’ rights request;
• how long Third Space keep personal information;
• how Third Space secure personal data; or
• marketing communications that Third Space send.

You can complain about Third Space’s services or other matters, whilst also exercising you data protection rights. These complaints would not count as data protection complaints. Examples of unrelated complaints include:

• a complaint about a membership issue, accompanied by a request that Third Space delete their information – this is a service related complaint and a request for erasure; and
• an employee grievance, accompanied by a request for a copy of the personal data Third Space hold about them – this is an issue for the People Team and a data subject access request.

If you exercise a data protection right whilst making a separate complaint, the request should be dealt with in accordance with Third Space Data Subjects’ Rights Policy and the complaint should be dealt with in accordance with the applicable procedure. Where a complaint includes both data protection and non-data protection issues, Third Space will handle the data protection aspects of such a complaint under this Policy and the non-data protection issues in accordance with the applicable procedure.

4. Responsibility

All employees, workers, contractors and third parties acting on behalf of Third Space (“Team Members”) are responsible for recognising complaints and referring them to data@thirdspace.london.

The Head of Legal, Risk and Compliance is responsible for co-ordinating how Third Space handle data protection complaints, involving relevant stakeholder from the business as needed. The Head of Legal, Risk and Compliance is responsible for ensuring that Team Members are aware of and are suitably trained to deal with data protection complaints.

5. Transparency

You are advised of your right to complain to Third Space via the Third Space Privacy Notices and in Third Space responses to data subject access and data subjects’ rights requests.

6. How to make a complaint

You can make a complaint in the way that is most convenient for you, including in person and by email. To expedite your complaint, Third Space recommends using one of the following options for making a compliant:

• by email: data@thirdspace.london; or
• by post: Third Space Holdings Limited, 1 Bow Churchyard, London, United Kingdom EC4M 9DQ

We will accept and route any complaints to our Head of Legal, Risk and Compliance. Where a complaint is made through social media or another insecure public channel, Third Space will ask you to continue the complaint through a more secure method to protect their data.

7. Additional Information and ID Verification

Some complaints may require further investigation. Where reasonably necessary to investigate a complaint, Third Space may ask you for additional information, including information to verify your identity or to clarify the scope of your complaint. Third Space will only request information that is reasonable and proportionate to the compliant and will not request more information than needed to identify any person making a complaint or their representative.

Where a complaint is made on behalf of another person, Third Space may require evidence indicating that that person’s representative is authorised to act on their behalf. Third Space cannot progress complaints unless adequate proof of authority is provided. Where this is the case, Third Space will explain it to the person who submitted the complaint.

8. Response

Third Space will acknowledge receipt of a complaint within 5 days of receipt and investigate and respond to complaints without undue delay. Third Space aims to:

• request any further information including for clarification or identification purposes within 10 working days of the date of the complaint; and
• reach an outcome within 45 days of the date of the compliant.

9. Investigation

Third Space will take reasonable and proportionate steps to investigate complaints fairly and in a timely manner. It may take Third Space longer to investigate and resolve complaints which are complex, serious or which relate to multiple data protection issues.

If an investigation is ongoing, Thid Space will notify you and provide an initial estimate of the expected timescale for resolving the complaint. Third Space will keep you updated on our progress where possible, including the next steps, any additional information required and the anticipated timing of the final outcome.

10. Outcome

Third Space will inform you of the outcome of any investigation as soon as possible, including details of Third Space findings, any follow up actions and, if no action is taken, the reasons for that decision.

If you raise concerns about how your complaint has been handled, or you challenge the outcome or any aspect of Third Space response, the matter will be escalated to the Head of Legal, Risk and Compliance, whose decision will be final. No further internal action will be taken, and you will be informed accordingly. Where the complaint is upheld, the Head of Legal, Risk and Compliance will ensure that appropriate steps are taken.

If you are dissatisfied with the outcome of your complaint, you have the right to lodge a complaint with the Information Commissioner, although complaints can be made to the Information Commissioner at any time. You can also make a claim before the Court of England and Wales at any time.

11. Record Keeping

Third Space will keep appropriate records of all data protection complaints, including:

• date of receipt;
• date of acknowledgement;
• relevant correspondence, conversations and documents; and
• outcome of the complaint, including escalation, and any actions taken in response.

These records will be used to demonstrate compliance, for audit and monitoring purposes, training, to support consistent handling and to identify recurring issues, trends or areas for organisational improvements or remediation.

Third Space will not retain personal data relating to complaints for longer than is necessary and will handle such records in accordance with our retention and data protection policies.

12. Third Parties

Where a complaint received relates to the processing of personal data by our service providers, Third Space will ask these providers to provide details and information relevant to the complaint as soon as possible and in accordance with any agreed and specified terms within Third Space’s contract with the service provider. Third Space remain responsible for handling and responding to the complaint.

Where a service provider receives a complaint about how they or Third Space processes personal data, the service provider must promptly forward this to us. Service providers are under no obligation to handle complaints on Third Space behalf unless previously agreed between Third Space and the relevant service provider. Where possible, Third Space will ask service providers to handle these complaints in line with Third Space policies and procedures.

Where a complaint relates to joint arrangements Third Space has with its partners, Third Space may choose to agree separate complaint handling procedures as part of those arrangements. Team Members handling such complaints will be given adequate training and supporting resources to manage these effectively.

13. Policy review

Third Space monitor and audit our data protection complaint handling procedure to ensure we comply with UK Data Protection Laws. This Policy will be reviewed annually and updated as required. The most recent version of this Policy can be requested from data@thirdspace.london.