How to make a data protection complaint

If you have a concern about how we have handled your personal data, we want to hear from you. You do not need a specific form. An email with the details below is enough for us to start looking into it.

Email us at hello@carents.co.uk and include:

• Your name
• Your contact details
• The date your concern arose
• A description of the complaint

If your complaint relates to someone else's data rather than your own, we may need to confirm that you have the authority to raise it on their behalf.

What happens next

• Acknowledge: We will acknowledge receipt of the complaint within 30 days of receiving it.

• Investigate: We will examine the circumstances, data logs, and interactions to understand what occurred.

• Inform: We will keep the complainant informed of progress if the investigation takes longer than expected.

• Respond & Remedy: We will communicate the final outcome and, if needed, outline corrective actions taken and lessons learned without undue delay.

What we investigate

We handle complaints about the way personal data has been processed by Strata Nostra Ltd t/a Carents Room. This includes concerns such as:

• Unauthorised access to personal data
• Inaccurate or incomplete data held about you
• Failure to respond to a Subject Access Request
• Any other matter relating to how we collect, use, or store your personal data

If you are not satisfied

If you are unhappy with our response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

ICO website: ico.org.uk
ICO helpline: 0303 123 1113

We would always prefer to resolve concerns directly, but this right is yours to use at any time.

How we handle your complaint data

The information you provide when making a complaint will be used only to investigate and respond to your concern. It will not be used for any other purpose. We keep complaint records for three years in line with our data retention policy, after which they are securely deleted.

Legal basis and review

This policy is issued in accordance with the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It is reviewed annually, or sooner if relevant legislation changes.