Complaints and Inquiry Handling Procedures
Version 1.0 Effective Date April 2026 Review Cycle Annual Document Owner Chief Information Security Officer (CISO) Classification CONFIDENTIAL — Internal Use Only Applicable Standard SOC 2 Type II
1. Purpose
This document describes the end-to-end process for receiving, acknowledging, investigating, and resolving privacy-related complaints, inquiries, and disputes submitted by data subjects, customers, third parties, or regulators in relation to DCKAP Integrator’s handling of personal data.
2. Scope
Complaints from end consumers whose data has been processed via a customer’s integration flow.
Complaints from DCKAP portal users regarding their own personal data.
Inquiries from customers about how DCKAP handles data in their integration pipelines.
Complaints or notices from data protection regulators or supervisory authorities.
Third-party disputes relating to data shared or received via DCKAP Integrator.
3. Complaint Intake Channels
Channel Contact / URL Monitored By Email privacy@dckap.com Privacy Team (daily review) Online Form dckap.com/privacy/complaint Privacy Team (daily review) Product Portal Help → Contact Us → Privacy Concern Support Team (triaged to Privacy) Postal [DCKAP Registered Address] — marked ‘Privacy Complaint’ Privacy Team (weekly scan) Regulator / Legal Notice legal@dckap.com or registered address Legal Counsel + CISO (immediate) Support Ticket Tickets tagged ‘Privacy’ auto-escalated Support Team → Privacy Team
4. Complaint Handling Process
Step Stage Actions Timeline 1 Receipt & Logging Log complaint in privacy register; assign reference number; categorise (Complaint / Inquiry / Regulator Notice) Day 0 2 Acknowledgement Send acknowledgement to complainant with reference number, expected timeline, and point of contact Within 3 business days 3 Initial Assessment Privacy Lead assesses complaint: Is it within DCKAP’s scope? Urgent? Regulatory? Days 3–5 4 Escalation (if needed) Regulatory notices or P1 data incidents escalated immediately to CISO + Legal Day 3 (if applicable) 5 Investigation Gather relevant records (logs, configuration, communications). Interview relevant staff if necessary. Days 5–20 6 Resolution Determination Determine whether complaint is upheld (fully, partially, or not upheld). Identify remediation actions. Days 20–25 7 Response to Complainant Provide written response with: outcome, reasoning, actions taken or planned, and right to escalate to supervisory authority. By Day 30 8 Remediation Implement any agreed changes, corrections, or security improvements. Per action plan 9 Record Closure Update privacy register with outcome. Record any systemic issues for privacy risk register. On completion
5. Response Timelines
Complaint Type Acknowledgement Resolution Target Extension Permitted? Standard privacy complaint 3 business days 30 calendar days Yes — up to 60 extra days with notice Simple inquiry (non-complaint) 1 business day 10 business days Yes — with notice Regulatory / supervisory notice Same day Per regulator’s deadline Only if regulator grants extension Data breach complaint Same day 72 hours (notification); 30 days (full resolution) No — regulatory obligation Third-party dispute 3 business days 30 calendar days Yes — 60 extra days with notice
6. Escalation Paths
6.1 Internal Escalation
Complaints involving potential data breach: immediately to CISO + Legal.
Complaints involving senior management conduct: to the CEO / Board.
Regulatory notices: to Legal Counsel within 24 hours of receipt.
6.2 External Escalation — Data Subjects’ Rights
If a data subject is not satisfied with DCKAP’s response, they have the right to:
Escalate to the relevant Data Protection Authority / Supervisory Authority in their jurisdiction (e.g., ICO in the UK, DPC in Ireland).
Seek judicial remedy through the courts.
DCKAP will always inform data subjects of this right in our complaint response letters.
7. Complaint Register Template
Reference Date Received Complainant Type Nature Status / Outcome COMP-2026-001 [Date] Data Subject Erasure request dispute Resolved — data deleted COMP-2026-002 [Date] Regulator Subject access complaint Under investigation INQ-2026-001 [Date] Customer Data retention question Resolved — guidance provided
8. Continuous Improvement
Privacy complaints are reviewed quarterly by the Privacy Lead for systemic trends.
Recurring complaint types trigger a root cause analysis and product/process improvement.
Annual complaint statistics (anonymised) are reviewed by the CISO and fed into the privacy risk register.
9. Placement in Product
Product Location Screen / Page Audience Public Website dckap.com/privacy/complaint (complaint form) All Data Subjects, Third Parties Product Portal Help → Contact Us → Privacy Concern Portal Users Privacy Policy dckap.com/privacy → How to Complain Section All Data Subjects Internal Wiki Legal → Privacy Ops → Complaint Handling Procedure Privacy Team, Support, Legal Compliance Folder SOC 2 Evidence → Privacy Complaints Register External Auditors, CISO
