Privacy Rights and Data Protection Complaints

1. Our commitment

Iconic Management Solutions UK Limited respects individual data protection rights and provides a clear process for submitting privacy requests and complaints. IMS UK does not sell personal data.

We may disclose personal data to group companies, clients, carriers, suppliers, professional advisers and service providers for the purposes described in our UK Privacy Notice. Such disclosures are not sales of personal data.

2. Your privacy rights

Subject to applicable legal conditions and exemptions, you may ask IMS UK to:

• provide access to your personal data;
• correct inaccurate personal data;
• complete incomplete personal data;
• erase personal data;
• restrict certain processing;
• stop processing based on legitimate interests;
• stop using personal data for direct marketing;
• provide certain personal data in a portable format;
• recognise withdrawal of consent; or
• provide information and safeguards relating to a qualifying automated decision.

You may also submit a complaint if you believe that IMS UK has processed personal data in a manner that does not comply with applicable data protection law.

3. How to submit a request or complaint

You may use any of the following methods:

• complete the electronic Privacy Rights and Data Protection Complaints form on the IMS UK website;
• email privacy@iconicms.co.uk; or
• write to Data Protection Enquiries, Iconic Management Solutions UK Limited, 6 Baker Street, Middlesbrough, England, TS1 2LH.

A request does not need to use a particular form or legal phrase. We will treat any communication that clearly asks us to exercise a data protection right, or raises dissatisfaction about our handling of personal data, according to its substance.

4. Electronic form requirements

The website form should request only information reasonably necessary to identify the requester, understand the request and locate relevant records.

4.1 Required fields

• full name;
• email address;
• relationship to IMS UK;
• type of request or complaint; and
• description of the request or concern.

4.2 Optional fields

• organisation;
• telephone number;
• relevant client or account reference;
• relevant date or date range;
• desired resolution;
• supporting attachment; and
• preferred method of contact.

4.3 Request type options

• Access my personal data
• Correct my personal data
• Delete my personal data
• Restrict processing
• Object to processing
• Object to direct marketing
• Withdraw consent
• Request data portability
• Ask about an automated decision
• Make a data protection complaint
• Other privacy enquiry

4.4 Confirmation statement

“I confirm that the information provided is accurate to the best of my knowledge and that I am the person identified in this request, or I am authorised to act on that person’s behalf.”

The initial form should not require a street address, telephone number, copy of identity documentation or other excessive information unless that information is genuinely needed for the particular request.

5. Identity and authority verification

We may request additional information where reasonably necessary to confirm identity, confirm authority to act for another person, locate the relevant records or prevent unauthorised disclosure. We will not request more information than is reasonably necessary and will use verification data only for the verification and related compliance purpose.

6. How we handle data protection rights requests

We will respond within the period required by applicable law. The ordinary response period is one month from receipt, subject to any permitted pause while proportionate identity information is awaited and any permitted extension for complex or numerous requests. If an extension is required, we will notify the requester and explain the reason within the initial response period.

Rights are subject to statutory conditions and exemptions. We do not ordinarily charge a fee. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act where permitted by law. We will explain any refusal and available complaint rights.

7. How we handle data protection complaints

When IMS UK receives a data protection complaint, it will:

1. record and acknowledge the complaint within 30 days of receipt;
2. identify the issues raised and the relevant processing activity;
3. take appropriate steps to investigate, including making appropriate enquiries and preserving relevant records where necessary;
4. keep the complainant appropriately informed of progress;
5. assess whether remedial or corrective action is required; and
6. communicate the outcome without undue delay.

The outcome may include an explanation, correction, erasure or restriction, a process change, additional guidance or training, a refusal based on a legal exemption, or another proportionate action.

IMS UK may consolidate overlapping complaints or requests where appropriate, but will ensure that each material issue is addressed.

8. Direct marketing objections

You have an absolute right to object to the use of your personal data for direct marketing at any time. You may use the unsubscribe link in a marketing email or contact privacy@iconicms.co.uk. We may retain a minimal suppression record to ensure that the objection is respected.

9. Records and confidentiality

We will keep appropriate records of requests and complaints to demonstrate compliance, manage follow-up action and protect legal rights. Information will be shared internally and with advisers or service providers only where reasonably necessary to handle the matter, comply with law or protect rights. Retention will be proportionate to the nature of the matter and applicable legal requirements.

10. Contact