Data Protection Complaints Policy

Last reviewed: [DATE] · Version 1.0 · Effective from 19 June 2026

1. About this policy

Lucid Legal ("we", "us", "our") is committed to handling personal data responsibly and in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains how you can raise a complaint with us if you are concerned about the way we have collected, used, stored, shared or otherwise handled your personal data, and how we will deal with that complaint. It reflects our obligations under section 164A of the Data Protection Act 2018, introduced by the Data (Use and Access) Act 2025, which applies from 19 June 2026.

We aim to resolve concerns about your personal data directly and promptly. You are entitled to complain to the Information Commissioner's Office (ICO) at any time, but we would encourage you to contact us first so that we have the opportunity to put things right.

2. What this policy covers

This policy applies to complaints about how Lucid Legal, acting as a data controller, has handled your personal data. A data protection complaint is a concern that we may have breached data protection law in relation to your personal data, or the personal data of someone you are acting on behalf of.

This may include, for example, concerns that we have:

• used your personal data in a way you did not expect or agree to;
• failed to keep your personal data secure;
• shared your personal data with someone without a proper basis for doing so;
• not responded properly to a request to exercise your data protection rights (such as a request for access to, correction of, or deletion of your data);
• kept your personal data for longer than necessary; or
• failed to provide clear information about how we use your personal data.

You do not need to use any particular form of words, quote any legislation, or label your concern as a "complaint" for it to be treated as one under this policy. If your message raises a concern of the kind described above, we will treat it as a data protection complaint.

3. Complaints that are not covered by this policy

This policy deals specifically with concerns about personal data. It does not cover general complaints about our legal services, fees, or the conduct of a matter, which are handled under our separate Client Complaints Procedure. Where a single complaint raises both data protection and service issues, we will deal with the data protection elements under this policy and the remaining elements under the relevant procedure, and we will tell you how we are handling each part.

4. Who can make a complaint

You can make a complaint if you are an individual whose personal data we hold or process. This includes clients, prospective clients, website visitors, suppliers, contacts, and current or former members of staff.

You may also complain on behalf of another person where they have authorised you to do so, for example as a parent, guardian, or appointed representative. We may ask for evidence of your authority to act before we share information with you.

5. How to make a complaint

You can raise a data protection complaint with us in whichever of the following ways is most convenient for you:

• Online form: complete our data protection complaint form at [LINK TO FORM]
• Email: [email protected]
• Post: Data Protection Officer, Lucid Legal, Unit 5, Hurstwood Court, New Hall Hey Road, Rossendale, BB4 6HH
• Telephone: +44 7864 056946

If you have a disability or need any adjustment to help you make a complaint, please let us know and we will do our best to accommodate your needs.

We will accept and consider data protection complaints however they reach us, including through other channels such as a letter or email to your usual contact at the firm. To help us respond efficiently, however, please use one of the routes above where you can.

6. What to include in your complaint

To help us investigate quickly and thoroughly, it is helpful (though not essential) if you can tell us:

• your name and contact details;
• if you are complaining on behalf of someone else, their details and your authority to act;
• a clear description of your concern and what has happened;
• any relevant dates, reference numbers, or names of people you have dealt with;
• copies of any relevant correspondence or documents; and
• what you would like us to do to put things right.

7. How we will handle your complaint

Acknowledgement. We will acknowledge your complaint as soon as possible, and in any event within 30 days of receiving it.

Investigation. We will begin looking into your complaint promptly. We will take appropriate steps to investigate, which may include making enquiries internally and, where relevant, asking you for further information. We will keep you informed of the progress of your complaint.

Response and outcome. We will respond to your complaint and tell you the outcome without undue delay. Our response will explain our findings, any action we have taken or propose to take, and the reasons for our decision. If your complaint is complex, or we need more time to complete our enquiries, we will let you know and keep you updated.

We will deal with your complaint fairly, confidentially, and without any detriment to you for having raised it.

8. How we use your information when handling a complaint

We will use the personal data you provide solely to investigate and respond to your complaint, to keep a record of it, and to improve how we handle personal data. We will not use it for any unrelated purpose. Information about how we handle personal data generally is set out in our Privacy Notice.

9. Keeping records

We keep a record of the data protection complaints we receive, including the nature of each complaint, how it was handled, and the outcome. This helps us respond consistently, identify any wider issues, and demonstrate how we meet our obligations under data protection law. Records are retained in line with our retention policy and kept secure.

10. If you are not satisfied — your right to complain to the ICO

We hope to resolve your complaint to your satisfaction. If you are unhappy with how we have handled it, or with the outcome, you have the right to complain to the Information Commissioner's Office, the UK's independent regulator for data protection. You can also complain to the ICO directly at any time, although the ICO will usually expect you to have raised your concern with us first.

11. Contact us

If you have any questions about this policy, please contact our Data Protection Officer:

ICO registration number: [REGISTRATION NUMBER]

12. Review of this policy

We will keep this policy under review and update it to reflect changes in the law, regulatory guidance, or our own practices. This policy was last reviewed on 19 June 2026.