1. Purpose
This Data Protection Complaints Procedure (the “Procedure”) sets out the process that Lupa Pets Ltd (“Lupa Pets” or “We”) follows to receive, assess, investigate, respond to, and record data protection complaints submitted by data subjects or by persons duly authorised to act on their behalf.
The Procedure is intended to ensure that data protection complaints are handled promptly, fairly, consistently, and confidentially, in accordance with applicable data protection laws and regulatory guidance. In particular, it is designed to support Lupa Pets in meeting its obligations to provide individuals with a clear way to submit data protection complaints, acknowledge receipt of such complaints within the applicable timeframe, take appropriate steps to respond without undue delay, keep complainants informed of the progress of the complaint, and communicate the outcome of the complaint.
2. Addressees and field of application
This Procedure applies to all Lupa Pets’ directors, managers, employees, workers, interns, contractors, consultants, and any other persons who are authorised to access, process, manage, or receive communications relating to personal data on behalf of Lupa Pets (the “Addressees”). All Addressees must comply with this Procedure whenever they receive, identify, handle, escalate, investigate, or otherwise support the management of a data protection complaint (the “Complaints”).
This Procedure applies to data protection complaints submitted by data subjects, or by persons duly authorised to act on their behalf, concerning the processing of personal data carried out by Lupa Pets where Lupa Pets acts as Controller. The Complaints must be promptly escalated to the Privacy Officer (the “Officer”), who will assess the matter and coordinate any necessary action in accordance with the applicable data protection requirements.
3. Legal framework and commitments
This Procedure has been drafted taking into account the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, applicable guidance issued by the Information Commissioner’s Office (ICO), and any other applicable data protection laws and regulations. Lupa Pets is committed to handling data protection complaints promptly, fairly, consistently, and confidentially.
Lupa Pets will take appropriate steps to assess and investigate data protection complaints without undue delay, keep complainants informed as required, and provide the outcome of the complaint in accordance with applicable law.
4. Definitions
In this Procedure, the following terms shall have the meaning indicated hereinbelow.
- Data Protection Laws: the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, and any other applicable data protection laws and regulations.
- Complaint: a data protection complaint.
- Complainant: the data subject who submits a Complaint, or any person duly authorised to act on their behalf.
- Outcome: the response provided by Lupa Pets to the Complainant after assessing and, where appropriate, investigating the Complaint.
- Personal Data: any information relating to an identified or identifiable natural person.
5. General principles
Complaints must be handled promptly, fairly, consistently, and confidentially. All Addressees must promptly escalate any Complaint received to the Officer and must provide any information or support reasonably required for its assessment and management.
Access to information relating to a Complaint must be limited to those persons who need to know it for the purposes of handling the Complaint. Lupa Pets must keep appropriate records of the Complaints received, the steps taken, and the relevant outcome, in accordance with applicable Data Protection Laws.
6. How to submit a data protection complaint
Complaints should preferably be submitted by email to privacy@lupapets.com. The Complaint should include a description of the matter raised and any information reasonably useful to allow Lupa Pets to assess it.
Lupa Pets will also accept Complaints received through other channels, such as the contact module available on its website www.lupapets.com. If a Complaint is received through a channel that is not suitable for sharing Personal Data, Lupa Pets may ask the Complainant to provide an alternative contact method.
Lupa Pets must publish, or otherwise make available to data subjects in a clear and accessible manner, the method through which Complaints may be submitted.
7. Identification and authority checks
Lupa Pets may request a proof of identity and the additional information necessary to verify the data subject identity before providing a substantive response to the Complaint.
Where a Complaint is submitted by a person acting on behalf of a data subject, Lupa Pets may request appropriate evidence of authority, such as a signed letter of authority or a power of attorney. Lupa Pets will not investigate the Complaint or disclose information relating to it until the required identity or authority checks have been completed.
8. Roles and responsibilities
The Officer is responsible for overseeing this Procedure and coordinating the management of Complaints. In particular, the Officer receives or is informed of Complaints, assesses their nature, coordinates any necessary identity or authority checks, determines the appropriate internal involvement, coordinates the assessment and investigation of the Complaint, ensures that the Complainant is kept informed where required, provides or coordinates the outcome, and maintains the relevant records.
All Addressees must be able to recognise a Complaint and must promptly escalate it to the Officer. Any person or team involved in the processing activities relevant to a Complaint must provide the Officer with the information and support reasonably required for its assessment and management. Where necessary, the Officer may involve management, technical teams, or external advisors in the handling of complex or higher-risk Complaints.
9. Procedure for handling Complaints
Upon receipt of a Complaint, the Officer will assess its nature (i.e. whether it is a data protection complaint), verify whether any identity or authority checks are required, and coordinate any necessary internal review. Should the Complaint not concern data protection, Lupa Pets will handle it accordingly through a different procedure. Lupa Pets will acknowledge receipt of the Complaint within 30 days of receiving it.
Lupa Pets will assess and, where appropriate, investigate the Complaint without undue delay. Where necessary, the Officer may request information from the relevant internal teams and keep the Complainant informed of the progress of the handling of the Complaint.
Once the assessment or investigation has been completed, Lupa Pets will inform the Complainant of the Outcome without undue delay – and in any case within 30 days from its receipt – including any action taken or proposed by Lupa Pets, where applicable.
10. Records, retention and confidentiality
Lupa Pets must keep appropriate records of Complaints received and handled under this Procedure, including the date of receipt, the acknowledgement, a brief description of the matter, the steps taken, the Outcome, and any relevant action adopted.
Complaint records must be accurate, kept confidential, and accessed only by persons who need to know them for the purposes of managing the Complaint or complying with applicable legal obligations. Such records must not be retained for longer than necessary and must be deleted or anonymised in accordance with Lupa Pets’ applicable retention rules.
The Officer will be responsible for the duly keeping and updating of the special record of Complaints mentioned above.
11. Monitoring, lessons learned and continuous improvement
Lupa Pets may periodically review Complaints handled under this Procedure to identify recurring issues, improvement opportunities, or corrective actions relating to Lupa Pets’ processing of Personal Data.
12. Policy status and review
This Procedure will be reviewed periodically and, in any case, whenever required due to changes in applicable Data Protection Laws, ICO guidance, Lupa Pets’ internal processes, or other relevant circumstances.
13. Further complaints
The data subject may lodge a complaint with the Information Commissioner’s Office (ICO) if they believe that their rights have not been respected or their queries have not been answered in accordance with the law:
The ICO’s address is:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire
SK9 5AF.
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Effective date: June 2026