Complaints Inquiry Handling Procedures
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document describes the comprehensive policies and procedures for receiving, investigating, and resolving complaints, inquiries, and disputes related to personal data handling by QA Touch. It covers complaints from data subjects, B2B customers, third parties, and regulatory authorities, defining response timelines, escalation paths, and resolution standards. Supports SOC 2 Privacy criterion P8.1 (Complaints and Dispute Resolution) and P1.1.
2. Types of Complaints and Inquiries Covered
| Type | Description | Examples |
|---|---|---|
| Data Subject Privacy Complaint | Individual alleges QA Touch violated their privacy rights or mishandled their personal data. | Unauthorised disclosure; DSR not actioned; data retained beyond retention period; suspected breach |
| Data Subject Privacy Inquiry | Individual requests information about QA Touch’s data practices without alleging a violation. | ‘What data do you hold about me?’ ‘How long do you keep my data?’ ‘Who do you share data with?‘ |
| Customer / Workspace Admin Complaint | B2B customer alleges violation of the Data Processing Agreement (DPA) or mishandling of workspace data. | Cross-tenant exposure; failure to delete data on termination; sub-processor non-compliance |
| Third-Party / Media Complaint | Third party raises a privacy concern about QA Touch’s practices publicly or via referral. | Reported via press inquiry; industry body tip-off; regulatory referral from another authority |
| Regulatory Authority Inquiry | A data protection supervisory authority contacts QA Touch regarding a data subject complaint or investigation. | DPA-forwarded complaint from EU resident; ICO formal information request; regulatory audit |
| Internal Complaint | QA Touch employee raises a concern about internal data handling practices. | Employee observes potential policy violation; internal whistleblower report on data misuse |
| Security / Breach Report | Individual or third party reports a suspected data security incident affecting personal data. | User finds own data in wrong account; reports suspected phishing; reports vulnerability via responsible disclosure |
3. Complaint Intake Channels
| Channel | Contact / Access | Monitoring and Assignment |
|---|---|---|
| Privacy Complaint Email | privacy@qatouch.com [VERIFY] | Privacy / Compliance Officer — monitored on all business days; auto-acknowledgement within 24 hours |
| Online Data Request Form | [VERIFY URL] — includes ‘Submit a Privacy Complaint’ category | Privacy Officer via form routing; auto-acknowledgement and DSR ID generated |
| Security Incident Report | security@qatouch.com [VERIFY] | Security team — monitored 24/7 via on-call rotation; Incident Response Plan triggered for confirmed breaches |
| Customer Support Portal | In-app support chat or ticket system | Support team triages; all privacy/data complaints escalated to Privacy Officer within 1 business day |
| Regulatory Authority | Via supervisory authority’s notification to QA Touch’s registered data protection contact | Legal Officer + Privacy Officer — immediate escalation to CISO and CEO; legal hold considered |
| Internal Whistleblower | Internal ethics hotline or direct to CISO / HR [VERIFY channel] | CISO + HR — handled confidentially; whistleblower protection policy applies |
4. Complaint Handling Process — Step by Step
| # | Activity | Responsible Party | Timeline |
|---|---|---|---|
| 1 | Complaint received via any intake channel. Automated (or manual if via phone/letter) acknowledgement sent with unique complaint reference number. | System / Privacy Officer | Within 24 hours of receipt |
| 2 | Complaint logged in tracking system: complainant name and contact, complaint type, description, date received, unique complaint ID, assigned investigator. | Privacy / Compliance Officer | Within 24 hours |
| 3 | Initial triage: determine complaint category and priority (see Section 5). Assign appropriate team lead. Determine if urgent escalation (P1/P2) is required immediately. | Privacy Officer | Within 1 business day |
| 4 | Formal acknowledgement to complainant: confirmation of receipt, complaint reference, responsible handler (or team name), expected response timeline, and right to escalate to supervisory authority. | Privacy Officer | Within 5 business days of receipt (GDPR Art. 12 requires ‘without undue delay’) |
| 5 | Investigation: gather relevant facts; access internal systems and logs with appropriate authorisation; consult Engineering, Security, or Legal as needed. Document all investigation steps and evidence reviewed. | Privacy Officer + relevant teams | Within 15 calendar days of receipt (standard); within 24 hours for breach reports |
| 6 | Draft response and proposed resolution: actions to be taken or explanation of why complaint is not upheld. Legal review mandatory for regulatory complaints and potential breach notifications. | Privacy Officer + Legal | Within 25 calendar days of receipt |
| 7 | Deliver response to complainant: written (email or formal letter), clear resolution statement, specific actions taken or to be taken, escalation options if dissatisfied (supervisory authority details provided). | Privacy Officer | Within 30 calendar days of receipt (GDPR Art. 12) |
| 8 | Remediation (if applicable): implement corrective actions — data deletion, access correction, policy update, technical control enhancement, process improvement. Document timeline and accountability. | Privacy Officer + Engineering/Security | Per remediation plan; critical: immediate; standard: 30-day completion target |
| 9 | Complainant follow-up: confirm with complainant (where appropriate) that issue is resolved and remediation completed. Obtain acknowledgement if possible. | Privacy Officer | Within 5 business days of remediation completion |
| 10 | Close complaint: update tracking system with resolution type, actions taken, lessons learned, date closed. Flag for quarterly trend report. | Privacy Officer | On resolution completion |
5. Complaint Priority and Escalation Matrix
| P | Trigger Condition | Escalation Path | Response SLA |
|---|---|---|---|
| P1 | Confirmed or suspected personal data breach; regulatory authority formal notice; complaint affecting large numbers of individuals; media inquiry about data incident. | Immediate: Privacy Officer → CISO → CEO → Legal Officer. Board notification if material breach. Incident Response Plan invoked. | Acknowledge within 1 hour; initial response within 24 hours; GDPR DPA notification within 72 hours if applicable. |
| P2 | DSR not actioned within legal deadline; alleged DPA violation by QA Touch; repeated complaint from same individual. | Privacy Officer → CISO → Legal Officer. | Acknowledge within 24 hours; full response within 10 calendar days. |
| P3 | Standard individual privacy complaint; inquiry about data practices; B2B customer question about data handling. | Privacy Officer handles; escalates to Legal if legal interpretation needed. | Acknowledge within 5 business days; full response within 30 calendar days. |
| P4 | General privacy inquiry; product feature question with privacy angle; help documentation request. | Support team handles with Privacy Officer available for consultation. | Response within 5 business days via standard support channels. |
6. Resolution Types
| Resolution Type | Description and Action |
|---|---|
| Upheld — Fully Remediated | Complaint valid. Remediation completed (data corrected, deleted, or disclosed; policy or control updated). Complainant notified of specific actions taken and effective date. |
| Upheld — Partially Remediated | Some aspects upheld; others not. Partial remediation applied with explanation of which aspects were not upheld and the legal or factual basis. |
| Not Upheld | Complaint investigated and found not to constitute a privacy violation. Complainant notified with full explanation and their right to escalate to supervisory authority. |
| Referred | Complaint relates to data held by a B2B customer as controller, not QA Touch. Referred to the appropriate controller with complainant notified of referral and controller contact. |
| Withdrawn | Complainant withdraws complaint during investigation. Record updated; closed with no further action. Complainant informed of their right to resubmit. |
7. GDPR Personal Data Breach Notification Requirements
A complaint may reveal or trigger identification of a personal data breach. The following obligations apply:
- GDPR Article 33: QA Touch must notify the relevant supervisory authority within 72 hours of becoming aware of a breach if it is likely to result in a risk to individuals’ rights and freedoms.
- GDPR Article 34: QA Touch must notify affected data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
- Incident Response Plan (QAT-SEC-IRP-001 [VERIFY]) is invoked immediately upon a P1 privacy complaint revealing a potential breach.
- Breach notification records retained for 5 years minimum: nature of breach, categories and number of affected individuals, likely consequences, measures taken or proposed to address the breach.
ASSUMPTION: The QA Touch Incident Response Plan document must be referenced and aligned with GDPR Article 33/34 notification timelines. Verify the IRP document ID and DPA contact details with the Legal team.
8. Complaint Trend Reporting and Continuous Improvement
- All closed complaints reviewed quarterly by the Privacy Officer; trend report prepared and shared with CISO and Legal Officer.
- Recurring complaint themes trigger a root-cause analysis and formal corrective action plan with assigned owner and deadline.
- Annual privacy audit reviews complaint resolution rates, average response times, and complaints referred to supervisory authorities.
- Complaint metrics and resolution rates included in the SOC 2 audit evidence package as P8.1 compliance evidence.
- Lessons learned from significant complaints incorporated into training materials and policy updates within 60 days of closure.
9. Record Retention
- All complaint and inquiry records retained for minimum 5 years after closure.
- Regulatory complaint and breach notification records retained for the duration of any related proceedings plus 3 years.
- Complaint tracking system access restricted to Privacy/Compliance Officer, Legal Officer, and CISO.