Data Protection Complaints Procedure 

1. Our Commitment to Your Data

Nazareth Trust is committed to respecting your privacy and handling your personal data lawfully, fairly and transparently. 

We process personal data in line with: 

• Our published Privacy Statement 

• All applicable UK data protection laws including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025 

• Applicable Israeli privacy laws, including the Israeli Privacy Protection Law 

• Charity governance expectations set by UK regulators 

If you have a concern or complaint about how your personal data has been collected, used, stored, shared or retained, we want to hear from you so we can put things right. 

2. What This Procedure Covers

This procedure applies to complaints or concerns about: 

• How Nazareth Trust uses your personal information 

• Accuracy or security of personal data 

• Handling of consent, communications or fundraising data 

• Responses to data rights requests (such as access or deletion requests) 

Complaints will be considered in line with Nazareth Trust’s Privacy Statement and applicable data protection law. 

3. Step One – Contact the Data Protection Officer (DPO)

Under UK GDPR Article 38, Nazareth Trust has appointed a Data Protection Officer (DPO) to oversee compliance and handle concerns. 

All data protection complaints should be sent to the Nazareth Trust’s Data Protection Officer: dataprotection@nazarethtrust.org 

Please include the following information: 

• Your name and contact details 

• A description of your concern 

• Relevant dates, communications or evidence (if available) 

4. How We Will Handle Your Complaint

Once your complaint is received: 

1. You will get an acknowledgement within 7 working days. 

1. The DPO will investigate the issue thoroughly and impartially. 

1. We may contact you for clarification or further information or to request proof of identity. 

1. We will aim to provide within 28 working days  a written response outlining: 

• Our findings 

• Any actions taken or planned 

• Any corrective or remedial measures 

• Your rights if you are unhappy with the outcome 

5. Step Two – Internal Escalation

If you are not satisfied with the DPO’s response: 

• Your complaint will be reviewed by the Chief Executive Officer (CEO) 

• The outcome and any learning will be reported to the Board of Trustees 

• Further actions or improvements will be considered where appropriate 

• Within 28 working days of the request to escalate the complaint, we will respond explaining if any additional acknowledgements or actions have been taken further to those communicated by the DPO. 

6. Step Three – Your Legal Right to Complain to the Regulator

If you remain unhappy after exhausting our internal process, you have the legal right to complain to the Information Commissioner’s Office as the supervisory authority.  Their address is given below. 

You do not need Nazareth Trust’s permission to contact the regulator, but the regulator generally expects you to have contacted the organisation first. 

Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom 

Email: icocasework@ico.org.uk 

Telephone: 0303 123 1113 

Website: https://ico.org.uk 

7. No Detriment

Raising a concern or complaint will not affect your support, involvement or relationship with the Nazareth Trust. We treat all complaints confidentially and respectfully. 

9. Continuous Improvement

Nazareth Trust uses data protection complaints to: 

• Improve our systems and processes 

• Strengthen staff training and awareness 

• Ensure ongoing compliance with UK and international privacy laws 

COMPLAINTS 

If you are not satisfied with our response to any queries or complaints you raise with us or believe we are not processing your personal data in accordance with the Data Protection laws you have the right to lodge a complaint at the Information Commissioner’s Office (ICO) (https://ico.org.uk/).