Bloume Data Protection Complaints Procedure

Last Updated: July 2026

This procedure sets out how we handle complaints relating to our handling of your personal data in line with our obligations under the Data Use and Access Act 2025, UK.

Scope

This procedure applies to any complaint from individuals who believe that we have infringed applicable data protection law in the way we have collected, stored, used, shared, retained, secured or otherwise handled their personal data.

This procedure supplies strictly to individuals whose data is processed in relation to Bloume services including our mobile application, website and any other services relating to Bloume or our activities around Bloume. This may be consumers, employees, contractors, suppliers or visitors to our services.

When is it a Data Protection Complaint?

A data protection complaint is any expression of dissatisfaction, or concern that relates to the way in which we have handled personal data or complied with data protection law. This may include concerns relating to:

• How we have responded to a data subject access request, erasure request or other privacy rights request
• The lawfulness of our processing or in meeting our transparency obligations
• Maintaining personal data, such as accuracy, retention, security and confidentiality
• The way in which we have shared or transferred personal data to third parties or internationally
• The use of personal data for direct marketing
• The handling of a data protection incident or breach

An individual does not need to use legal terminology, reference applicable law, statute or cases for a complaint to be considered a data protection complaint. Where an individual has a complaint regarding their data and is unsure as to whether or not it constitutes a data protection complaint, we will clarify with the individual as part of our processing.

How to Submit a Complaint

You can make a complaint directly to our Privacy team using the details below:

• Email: [email protected]
• Address: DPO, Wellnourish, 16-18 Barnes Wallis Road, Fareham PO15 5TT

When submitting a complaint via email or post, please include the following as a minimum:

• Name and contact information
• Details of your complaint
• Any relevant evidence or correspondence you would like us to consider

We have provided a template form at the end of this procedure to assist in submitting a complaint, or alternatively, use our online form to submit all relevant information.

Our Next Steps

Upon receipt of your data protection complaint we will log the complaint, the date received and acknowledge your complaint within 30-days. Within our acknowledgement, we will set out our next steps, your point of contact for the duration of your complaint, and clarifications required. We may request ID verification at this stage if it is necessary for us to confirm the identity of the individual to whom we are responding, please note this is to protect you and your information from unauthorised access or disclosure.

We commit to only requesting additional information which is proportionate and relevant to the complaint you have raised, and will never use this procedure to gather more data than is necessary for the purposes of responding to your complaint.

Investigations

Your complaint will be investigated without undue delay and in a manner which is appropriate for the seriousness and complexity of the issue raised, including any risk of harm to you or others. What is appropriate will be determined on a case by case basis and reviewed throughout the investigation to determine any changes in our assessment, including on receipt of new information that may change the risk of harm or complexity of the issue.

Investigative steps may include:

• Review of relevant systems and processes
• Speaking to staff, contractors or third parties
• Reviewing decision making processes and outcomes
• Reviewing actions to determine any breach of law or internal policy
• Determining any remedial action to prevent escalation or recurrence

All complaints will be reviewed by the Privacy team and overseen by our CEO. We aim to resolve data protection complaints within 3-months and without undue delay. Where an issue is especially complex and more time is needed, we will notify you in writing and maintain regular communications on progress, including reasons for delay and expected timeframes for completion.

Outcomes

Following the completion of our investigation, we will inform you of the outcome within 1-week. Our communication will include:

• An explanation of our investigation and our decision
• Any action that we have taken as a result of the decision or that we will take and the expected timeframe for completion
• Any explanations relevant to the decision including how we have complied with data protection laws and our obligations under such
• Where disclosure of any outcome would infringe on the privacy rights of others, or expected confidentiality we may limit the information provided to you to that which is appropriate

If You Disagree

If you are not satisfied with the outcome of your complaint, or feel we have not handled your complaint in a manner which is appropriate or compliant with governing law, you may escalate your complaint to the Information Commissioner Office (ISO)

https://ico.org.uk/make-a-complaint/

Record Keeping and Continuous Improvement

Wellnourish Group Limited is committed to putting privacy at the centre of what we do, we believe in protecting individual privacy rights and encourage a culture of continuous improvement and have implemented internal record keeping procedures aligned with the requirements of the Data Use and Access Act, all data protection complaints will be recorded via our internal systems for a minimum of 3 years, including:

• Date of receipt
• Issues raised
• Date of acknowledgement
• Actions taken
• Correspondence records
• Outcomes and lessons learned

Training and Accountability

Records will be reviewed to identify trends, areas of improvement and to demonstrate compliance and accountability. Where areas of improvement are identified, we will take steps to understand our shortfall and develop our processes to enhance privacy and user experience across our services.

All employees receive training on data protection and privacy including how to recognise a data protection complaint and what to do on receipt of such. Where changes to company process, law or regulatory guidance necessitate, this procedure will be updated and training reissued to ensure continued compliance.

Accessibility and Fairness

Data protection complaints are handled fairly, and objectively. We do not discriminate against individuals for raising a data protection complaint and no one will be disadvantaged as a result of exercising their right to complain.

Data Protection Complaint Form

Please send your completed form, and associated evidence to [email protected] or alternatively, provide the requested information in an email.

1. Does this complaint relate to data about you, or someone else:

• My personal data
• Personal data of my child or a child for whom I hold parental responsibility
• Personal data relating to a vulnerable adult for whom i hold legal power of attorney
• Personal data relating to an adult who has consented to the me acting on their behalf

Please note that we may require evidence of identity, legal power of attorney, consent or guardianship prior to actioning your request. This is to ensure that we are only processing and disclosing personal data to those authorised to receive it. We will only request such information where we do not hold the necessary details to confirm such without it.

2. Your Details

   1. Name:
   2. Email:
   3. Contact Number (if telephone contact preferred):

3. What is your preferred contact method:

• Email
• Phone

4. Organisation the Complaint Refers to:

• Wellnourish Group Limited (Bloume)
• One of our processors (please specify):

5. Nature of Your Complaint

• Unlawful use of my personal data
• Data shared without my consent
• Inaccurate personal data held
• Refusal to comply with my data protection rights
• Delay in responding to my data protection rights
• Personal data processing in relation to marketing activities
• Lack of transparency in the processing of my personal data
• Other (please specify):

6. Please provide details of the incident, including relevant dates, what happened, where (i.e. email, app, social media) and any member of the team you interacted with (if known):

7. Please provide any supporting evidence you have in relation to your complaint, please note that while this is optional, it will hel;p to expedite any investigations relating to your complaint.

• Copies of correspondence including emails or letters
• Social media links or screenshots of social media interactions
• Screenshots of other evidence, such as advertisements or engagement
• Other (please specify):

8. Do you have a desired outcome or action you would like us to take in resolving your complaint?

• Yes
• No
  1. Please detail any desired outcome or action:

9. Declaration

• I confirm that the information i have provided is accurate to the best of my knowledge
• I confirm that I am submitting a complaint in relation to my own data or with the explicit consent, or legal authority, relating to the data subject concerned.
• I can confirm that I will cooperate with the investigation and provide reasonable information to facilitate the resolution of such and understand that, where I choose not to provide such information, the ability of Wellnourish Group to investigate and resolve my complaint may be limited and that remediation action may be impacted as a result.