Data Protection Complaints Procedure

1. Our commitment

Hall-McLean & De Watts (HM-D) Ltd ("we", "us"), trading as GetBrent, is committed to protecting your personal data and handling any concerns promptly and fairly. This procedure sets out how to raise a data protection complaint and what to expect from us, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This procedure is published to comply with the ICO's mandatory complaints-procedure requirement effective 19 June 2026.

2. What you can complain about

You may complain if you believe we have:

• used your personal data without a lawful basis;
• failed to respond to a data subject rights request (access, erasure, rectification, portability, objection) within the statutory one-month period;
• shared your data with a third party without proper authority;
• failed to keep your data secure;
• sent you marketing communications without your consent or a valid soft-opt-in basis;
• set non-essential cookies without your prior consent; or
• any other alleged breach of your data protection rights.

3. How to raise a complaint with us

Please contact our data protection lead in writing at the address below. Include:

• your full name and email address;
• a description of the issue, including relevant dates; and
• any reference numbers from previous correspondence with us.

4. Our response timeline

• Acknowledgement: within 5 working days of receipt.
• Full response: within 28 calendar days. If we need longer (e.g. because the complaint is complex) we will inform you and give an updated date.
• Record: we log every complaint in our internal complaints register and retain the record for 6 years.

5. Escalation to the ICO

If you are not satisfied with our response, or if we have not responded within 28 days, you have the right to complain directly to the Information Commissioner's Office (ICO), the UK's data protection supervisory authority:

You may also contact the ICO directly if you prefer not to raise the complaint with us first, though the ICO generally encourages organisations to have the opportunity to respond before a formal ICO complaint is submitted.

6. Your data subject rights

Separately from the complaints procedure, you have the following rights under UK GDPR, which you may exercise at any time by contacting us at the address above:

• Right of access (subject access request)
• Right to rectification
• Right to erasure ("right to be forgotten") — note that certain legal obligations may prevent full erasure; we will explain any such constraints
• Right to restriction of processing
• Right to data portability
• Right to object
• Rights in relation to automated decision-making and profiling

See our full Privacy Policy for more detail on how we process your data and your rights.