Data Protection Complaints Policy
1. INTRODUCTION
1.1. This policy documents the process for making and handling complaints involving personal data controlled and/or processed by BPP Holdings Limited and its UK based subsidiaries (“BPP”). It sets out how BPP ensures data subjects have a fair and transparent mechanism to raise data protection concerns, and how BPP investigates and resolves such complaints in line with its obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. PURPOSE & SCOPE
2.1. This policy provides details of:
(a) the mechanism for data subjects to raise data protection concerns directly with BPP;
(b) the process for investigating and resolving data protection complaints promptly and effectively;
(c) how BPP identifies and addresses potential data protection compliance issues at an early stage;
(d) the means by which BPP maintains trust and confidence with learners, customers, employees and other stakeholders; and
(e) how BPP demonstrates accountability and commitment to data protection compliance.
2.2. This policy applies to all complaints relating to the processing of personal data by BPP Holdings Limited and its UK based subsidiaries.
3. DEFINITION
3.1. Data Protection Complaint: Any complaint regarding BPP’s processing of personal data will be handled in line with this policy. Data protection complaints may relate to:
(a) how BPP collects, uses, shares, stores or deletes personal data;
(b) the lawful basis relied on for processing personal data;
(c) the accuracy or completeness of personal data held;
(d) matters relating to subject access requests or other data subject rights requests;
(e) security measures relating to the protection of personal data;
(f) automated decision-making;
(g) retention of personal data; and/or
(h) international transfers of personal data.
3.2. This policy applies to complaints about data protection matters only. It does not apply to:
(a) general complaints about BPP’s services, products or customer service (which should be directed to the relevant complaints procedure found at https://www.bpp.com/terms-and-conditions/complaints);
(b) complaints about exam marks or matters relating to academic appeals which are outside of the Data Protection Team’s scope and are covered by BPP University’s Academic Appeals Policy (which should be directed to the relevant procedure found here: https://bppassets.s3.eu-west-1.amazonaws.com/public/assets/pdf/governance-finance/upp/26.+Academic+Appeals+Policy.pdf);
(c) matters of academic judgment; or
(d) employment-related grievances or disputes (which should be directed to BPP’s HR Grievance Procedure).
4. RESPONSIBILITIES
4.1. BPP’s Data Protection Team have responsibility for all matters regarding personal data processing within BPP. In relation to this policy, it is the responsibility of the Data Protection Team to:
(a) acknowledge receipt of data protection complaints within seven (7) business days;
(b) request verification of identity, clarification or further information from the complainant where necessary to enable the Team to investigate the complaint;
(c) investigate complaints promptly and thoroughly;
(d) provide a substantive response to the complainant within one (1) calendar month of receipt of the complaint, or notify the complainant if a longer period is required due to complexity or the need for further information; and
(e) confirm the outcome of the complaint in writing, including any actions taken to resolve the complaint if upheld, and information about the right to escalate to the ICO if not upheld.
4.2. It is the responsibility of all BPP staff to cooperate with the Data Protection Team in the investigation and resolution of data protection complaints.
5. HOW TO MAKE A DATA PROTECTION COMPLAINT
5.1. If you wish to raise any concerns or to complain about the way in which BPP has processed your personal data, please write to the Data Protection Team by email at dataprotection@bpp.com or by post to: BPP Education Group, 4th Floor, 1 Portsoken Street, London E1 8BT.
5.2. To help the Data Protection Team deal with your complaint as promptly and efficiently as possible, please provide a full written explanation of your concerns which includes:
(a) Your full name or, if you are complaining on behalf of someone else, their full name together with written authority to act on their behalf;
(b) Your contact details, including email address or, if preferred, postal address;
(c) Your relationship to BPP (for example, current or former student, applicant, employee, contractor, supplier, website visitor or other), and any reference number you hold (such as a student ID or staff number) to help us locate your records;
(d) A clear description of your complaint setting out what has happened and any concerns;
(e) The date(s) or time period when the issue occurred or was discovered, and whether it is ongoing;
(f) The individuals, departments, or systems involved, so far as known to you;
(g) Copies of any supporting documents or evidence you wish to rely on; and
(h) Confirmation of whether you have already raised the matter with BPP and, if so, with whom and when.
5.3. A complaint form, which sets out the minimum information required above and which complainants are encouraged (but not required) to use, is attached at Appendix 1 to this policy. Use of the form helps BPP to investigate and respond to complaints promptly, but a complaint will not be rejected solely because the form has not been used, provided the information set out above is supplied.
5.4. A member of the Data Protection Team will acknowledge your email within seven (7) business days and may ask you to clarify any matters which are not clear in your complaint. If BPP does not have sufficient information to be satisfied with your identity, you may be asked to provide proof of identification before the investigation of your complaint can proceed.
6. RESPONSES TO A DATA PROTECTION COMPLAINT
6.1. The Data Protection Team will then investigate your complaint and aim to provide you with a substantive response within one (1) calendar month of receipt of your email.
6.2. If your complaint raises complex questions or requires additional information from you or a third party to resolve, BPP may extend the time for its response to ensure the matter is investigated and addressed fully. If this is necessary, the Data Protection Team will inform you as soon as possible and will confirm the rationale for the decision.
6.3. Upon completing an investigation, the Data Protection Team will confirm the outcome of your complaint to you in writing, and will:
(a) if your complaint is upheld, set out the actions taken by BPP to mitigate your concerns and resolve your complaint; and
(b) if your complaint is not upheld, set out the reasons why and remind you of your right to escalate to the ICO .
7. RIGHT TO ESCALATE TO THE ICO
7.1. You have the right to refer the matter to the Information Commissioner's Office (“ICO”). However, we would encourage you to raise your concerns with BPP first so that we have the opportunity to investigate and put matters right. The ICO will generally expect you to have done so before taking your complaint further.
7.2. If you are dissatisfied with BPP’s response to your complaint, you do have the right to escalate this to the ICO.
7.3. Please refer to information on the ICO website regarding how to make a complaint: https://ico.org.uk/make-a-complaint/.
8. CONTACT INFORMATION
8.1. FAO of the Data Protection Officer
1 Portsoken Street
London
E1 8BT
Email: dataprotection@bpp.com
9. PRIVACY POLICY
9.1. By submitting a data protection complaint, you accept that your data will be processed in accordance with BPP’s privacy policy (www.bpp.com/privacy). BPP may need to share your data internally or with applicable third parties in order to be able to investigate your complaint.