What is a data protection complaint?

A data protection complaint is a concern about how we have collected, used, shared, stored, or otherwise handled your personal information. This might include concerns about:

• How we handled a data subject rights request. For example, if you are concerned about how a subject access request was handled, such as the response received or how the request was managed.
• Marketing and communication preferences. For example, if we have continued to send you emails, newsletters or other communications after you asked us not to.
• Membership or other customer records. For example, if you are concerned about how we have handled a request to correct information we hold about your membership, booking or account.
• How your personal information has been used or shared. For example, if you believe your personal information has been used, or shared with other organisations, in a way you are concerned about.
• Security of personal information. For example, if your personal information appears to have been shared with, or accessed by, someone who should not have received it.
• Accuracy or retention of personal information. For example, you are concerned about how inaccuracies in your personal information have been handled, or about your personal information continuing to be held when you believe it should no longer be retained.

Getting your concern to the right place

We want to make sure your concern is handled in the most appropriate way.
This process is for concerns about how English Heritage has handled personal information. Where a concern relates to handling of personal information it will be treated as a data protection complaint.

If your complaint relates to something else, such as your experience when visiting our properties, your membership, or any other matter, our Customer Experience team will be happy to look into it for you.

Get in touch with us

If you contact us about more than one issue, we will look at any data protection concerns under this process, and make sure other matters are passed to the right team to be considered separately.

Making a data protection complaint

A data protection complaint can be made by the person to whom the personal information relates, or by someone authorised to act on their behalf.

Where a complaint relates to your own personal information, we will usually rely on the information you provide in your complaint to confirm who you are. If we are unable to do this, or if additional checks are needed to protect personal information, we may ask you for further information to help verify your identity. This may include asking you to provide a copy of an identity document.

If you are making a complaint on behalf of someone else, we require evidence that you are authorised to do so. This helps us ensure personal information is only shared with the right people.

You can make a data protection complaint by contacting us:

Via email: Data.Protection@english-heritage.org.uk
By post: Data Protection Team, English Heritage, The Engine House, Firefly Avenue, Swindon, SN2 2EH

To help us understand your concern and respond appropriately, it is helpful if you include a clear explanation of the issue, how it relates to the handling of your personal information, and any relevant dates, reference numbers or correspondence, if available.

What to expect once we have received your complaint

We will acknowledge your data protection complaint as soon as possible after it is received, and no later than 30 calendar days.

We will then review and investigate your concerns. The time required to provide a full response will depend on the nature and complexity of your complaint. We will keep you informed where an investigation is likely to take longer or where we need further information to help us understand your complaint.

Once our investigation is complete, we will write to you to explain the outcome.
If you remain dissatisfied after receiving our response, you have the right to raise your concern with the Information Commissioner’s Office (ICO), the UK’s data protection regulator. Further information about the ICO and how to raise a concern is available on the ICO’s website.