Data Protection Complaints Procedure

At Indigo Estate we are committed to protecting the privacy and personal data of everyone who engages with our work — our readers, students, members, and community. This complaints procedure sets out clearly how you can raise a data protection concern with us and what we will do about it.

This procedure has been put in place to comply with Section 164A of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, which came into force on 19 June 2026. Under this law, individuals have the right to raise a data protection complaint directly with us before escalating to the Information Commissioner’s Office (ICO).

We take all data protection complaints seriously. We will acknowledge your complaint within 30 days of receiving it and investigate it without undue delay.

You can submit a data protection complaint to us if you are:

• An individual whose personal data we hold or process
• A parent or legal guardian acting on behalf of a child whose data we hold
• An authorised representative acting on behalf of another individual — we will verify your authority before investigating

You do not need to use legal language or quote specific legislation. If you are unhappy with how we have handled your personal data, that is enough to raise a complaint.

A data protection complaint can cover any concern about how we have handled your personal data, including:

• How we collected your personal data — for example, through our website, email list, or membership platform
• How we store or secure your personal data
• Whether we had a lawful basis for processing your data
• How we responded to a previous subject access request or data rights request
• Whether we shared your data with a third party without your knowledge or consent
• How we handled your data in connection with a purchase, course enrolment, or membership
• Any automated decisions made about you
• Whether your data was involved in a security breach

This procedure covers complaints about data protection specifically. If your complaint is about our products, services, or customer experience generally, please use our general contact details and we will direct you to the appropriate team.

You can submit a complaint to us in any of the following ways. We accept complaints however they are sent — you do not need to use a specific form:

Please include the following information to help us investigate your complaint as quickly as possible:

• Your full name and contact details
• A description of your concern — what happened, when, and what data was involved
• What you would like us to do to resolve the complaint
• Any relevant reference numbers or previous correspondence with us

If you submit your complaint via social media or any other channel, we will still accept it and respond through that channel or ask you to provide contact details so we can investigate properly.

Once we receive your complaint, we will follow these steps:

If you are not satisfied with how we have handled your complaint, or if you have not received a response within a reasonable time, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO) — the UK’s independent data protection regulator.

You can contact the ICO in the following ways:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Please note that the ICO generally expects you to have raised your complaint with us first before they will investigate. This is a legal requirement under the Data (Use and Access) Act 2025.

As a platform built on the principles of sovereignty and personal empowerment, we hold ourselves to the highest standard when it comes to handling your information. We appreciate you bringing any concern to our attention.

As part of our commitment to data protection, we want to remind you of your rights under the UK GDPR:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your data in certain circumstances
• Right to restrict processing — you can ask us to limit how we use your data
• Right to data portability — you can ask us to transfer your data to another organisation
• Right to object — you can object to us processing your data in certain circumstances
• Right not to be subject to automated decision-making — you can ask for human review of automated decisions

To exercise any of these rights, contact us using the details in Section 4 of this procedure. We will respond within one calendar month.

The data controller responsible for your personal data in connection with this website is:

We review this procedure annually and whenever there are changes to data protection legislation. The current version is effective from 19 June 2026. Any significant changes will be communicated via our website.