Data Protection Complaint Policy

1. Purpose

The UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), Data (Use and Access) Act 2025 (“DUAA”), and the Privacy and Electronic Communications Regulations (“PECR”) (together, the “Data Protection law”), give data subjects and applicable third parties rights in relation to personal data. This procedure details how ServiceMaster will respond to complaints from data subjects and third parties relating to the use of personal data.

For full details on ServiceMaster’s compliance with Data Protection law, please refer to our Data Protection Policy.

2. Scope

This policy applies to all data subjects whose personal or sensitive data is held or processed by ServiceMaster Limited, including customers, employees, contractors, and service users.

This policy addresses complaints made by data subjects regarding the use of their personal data, including marketing. Complaints may be made in relation to any aspect of the ServiceMaster’s processing of personal data including individual rights requests.

3. Responsibility

The Data Protection Co-ordinator has overall responsibility for this policy.

All Employees are responsible for ensuring that any complaints that are made in relation to this procedure are reported to the Data Protection Co-ordinary (privacy@servicemaster.co.uk), and for cooperating in reviewing these complaints.

The Data Protection Co-ordinator and relevant members of the team will review this procedure from time to time (and at least every two years) to ensure that its provisions continue to meet our legal obligations and reflect best practice.

4. Complaints

A complaint is an expression of dissatisfaction about ServiceMaster’s handling of a data subject’s personal data or the data of the individual they represent. This can also include dissatisfaction with how ServiceMaster has responded to a previous data request.

5. Making a Complaint

Data subjects and third parties may make a complaint relating to ServiceMaster’s use of personal data. Complaints should be sent directly to the Data Protection Co-ordinator at privacy@servicemaster.co.uk.

Please include the following information:

• Your full name and contact details
• A clear description of the issue
• The date or period of the incident
• Supporting evidence (if applicable)

A member of the team will normally acknowledge the complaint within 5 working days. However, we reserve the right to extend the period we need for response during holiday and business closures.

Although a complaint may be brought at any time, there may be limits as to what we can do in historic cases.

ServiceMaster will only accept a complaint from a data subject’s representative, if the representative provides the data subject’s written consent authorising the representative to act on the data subject’s behalf in relation to the complaint.

If there is any doubt about the identity of the complainant then we will first seek to verify the data subject’s identity or third party’s entitlement to act on behalf of the individual.

6. Complaint Resolution Procedure

7. Internal Review

If the complainant does not agree with the outcome, they can request a review of the decision. This request must be made within 1 month of the original decision being communicated and should be sent to the Data Protection Co-ordinator (privacy@servicemaster.co.uk). The decision will be internally reviewed normally within 20 working days from the receipt of the request for Review. Once the internal review has been completed, we will communicate the outcome in writing.

8. External Review

If the complainant remains dissatisfied, they can escalate their complaint to the Information Commissioner’s Office (the “ICO”). Information about how to make a complaint to the ICO can be found here: Make a complaint | ICO.

9. Complaint refusal

In some scenarios we can refuse to handle the complaint. This will be when a complaint is deemed to be manifestly unfounded, abusive, vexatious or excessive. Each complaint will be considered on a case-by-case basis.

Where a complaint is deemed to be manifestly unfounded, excessive, abusive or vexatious ServiceMaster will contact the complainant and in a reasonable timeframe explain to them:

1. the reasons for refusing to consider the complaint; and
2. their right to make a complaint to the ICO;
3. Confidentiality and Protection

All complaints will be handled confidentially. Retaliation against complainants is strictly prohibited.

11. Record Keeping and Audit

Complaint records will be maintained in accordance with ServiceMaster’s Data Retention Policy. Records may be used for compliance audits and regulatory reporting.

Reviewed: August 2025