Data Protection Complaint Policy

 

Purpose of the Policy

GES & Sons Ltd, t/a Sworders Fine Art Auctioneers (thereafter referred to as ‘Sworders’, ‘we’, ‘us’, etc) will only collect and process your data where the law allows us to, and in accordance with our Privacy Policy.

Sworders is committed to protecting the privacy and security of personal data and recognise that you have the right to raise concerns or complaints with us if you believe that we have processed your data unfairly, unlawfully, or in a manner that is inconsistent with data protection law.

We have set out below how you can make a complaint to us, if you are not happy with how we have processed your data and the process we will follow in response.

The policy is designed to ensure compliance with UK legislation and demonstrates our commitment to fair and transparent processing of personal data.

Scope

This policy applies to:

  • all individuals whose personal data is held or processed by Sworders, including but not limited to customers, employees, contractors, suppliers, and partners
  • all employees, volunteers, contractors, and third parties who process personal data on behalf of Sworders
  • all methods of data processing, whether electronic, paper-based, or otherwise.

Definition of a Data Protection Complaint

A data protection complaint is any expression of dissatisfaction or concern from an individual regarding the way Sworders handles personal data. This may relate to, but is not limited to:

  • collection, storage, use or sharing of personal data without appropriate consent or lawful basis
  • inaccurate, incomplete, or out-of-date personal information
  • failure to uphold data subject rights (e.g., access, rectification, erasure, restriction, portability, objection)
  • unauthorised disclosure or data breaches
  • unlawful or unfair processing practices

How to Make a Complaint

You can make a complaint to us about how we process your data by:

  • completing a data protection complaint form, available here or from the Data Protection Manager
  • sending an email to our Data Protection Manager at dataprotection@sworder.co.uk
  • writing a letter addressed to the Data Protection Manager at Sworders Auctioneers, Cambridge Road, Stansted Mountfitchet, Essex, CM24 8GE
  • contacting us by telephone on 01279 817778

We would ask that you provide to us:

  • a clear description of the issue
  • details of any relevant circumstances, dates, or individuals involved
  • any evidence or documentation supporting your complaint
  • full contact details for correspondence purposes

Complaints Handling Procedure

ACKNOWLEDGEMENT 

We will acknowledge receipt of your compliant within five working days and will include:

  • a summary of your complaint received
  • the name and contact details of the person handling the complaint
  • an expected timeframe for resolution

We may contact you to acknowledge your complaint by sending you an email or writing to you at the address you have provided us with.

INVESTIGATION

The Data Protection Manager, or a designated officer, will undertake a thorough investigation of your complaint, taking into account all records, evidence provided by you, or identified subsequently and by speaking to all those involved. We may also contact you for more information.

We will ensure the investigation is carried out impartially and confidentially.

RESOLUTION

We will write to you following the outcome of our investigation, with a clear explanation of our findings, and any action we have taken as a result. Where we uphold your complaint, we will take steps to prevent a recurrence. If we do not uphold your complaint, we will let you know the reasons for our decision.

TIMESCALES

We will aim to resolve your complaint within thirty calendar days of receipt. If we are unable to do so, due to the complexity of the complaint, or where we need to gather additional information before we can conclude our findings, we will let you know as soon as possible of our revised timescale, and the reasons for the delay.

ESCALATION

If you are not satisfied with the outcome of our investigation, you may request that the complaint is reviewed by a Director.

In all cases, you retain the right to complain to the Information Commissioner’s Office (ICO) where you believe that your rights under data protection law have not been upheld. You can contact the Information Commissioner’s Office at ico.org.uk/concerns/ or telephone: 0303 123 1113

Confidentiality and Data Security

We will ensure that all complaints are managed in strict confidence and compliance with UK legislation. We will only use personal data provided during the complaints process for the purposes of investigating and resolving the complaint and will ensure that appropriate technical and organisational measures are in place to protect all data, ensuring it is processed and accessed only by those who need it.

Record Keeping

We will keep a record of your data protection complaint, which will be maintained by the Data Protection Manager. This register will include:

  • date of receipt of your complaint
  • the nature of your complaint
  • the action we have taken
  • the resolution and outcome
  • any further correspondence or actions, including referrals to the ICO

We will retain a record of all complaints in accordance with our data retention policy and in line with our statutory obligations and will provide this to regulatory authorities if required to do so by law.

Training and Awareness

We will ensure our staff have appropriate training on data protection obligations, understand how to process a complaint, and the importance of protecting personal data. Regular updates and refresher training will be provided as necessary.

Monitoring and Review

We will review this policy regularly to assess its effectiveness, or in response to legislative or organisational changes to ensure continuous compliance and best practice.

Contact Details

For further information about this policy or to make a data protection complaint, please contact:

Data Subject Rights

You have a right to be informed about the information we collect and how we use it. This is a key transparency requirement under the UK GDPR. You can ask us if we are processing information about you, for access to the information we hold about you, or for us to take certain steps in relation to that information. This is set out in the UK GDPR, articles 13 and 14 and includes:

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling

All requests concerning these rights will be handled in accordance with our data protection procedures and within the statutory time limits.

 

 

Questions?