1. Purpose

This procedure explains how SEGA Europe Limited (“SEGA”) handles complaints relating to processing of personal data. It has been established to comply with UK GDPR and Data Protection Act 2018 (as amended by Data (Use and Access) Act 2025, together “Data Protection Laws”), and to ensure that individuals can raise concerns about how their personal data is handled.

Under Data Protection Laws, individuals have the right to raise concerns or complaints with us about how we handle their personal data. This may include concerns about how personal data has been collected, used, stored, shared, retained or otherwise processed . We encourage individuals to raise concerns with us first so that have an opportunity to investigate and address them directly before they are escalated to the Information Commissioner's Office (ICO) 

SEGA aims to investigate and respond to complaints fairly, consistently and within appropriate timeframes as outlined in this procedure.

This procedure may be updated from time to time to reflect legal, regulatory or operational changes.

2. Scope

This procedure applies to all individuals — not just customers or employees — who wish to raise a concern about the way SEGA has handled their personal data, where the relevant processing is subject to Data Protection Laws. This includes but is not limited to:

• How a subject access request (DSAR) or other data rights request was handled
• The way personal data has been collected, used, stored, retained, shared or kept accurate
• The security and protection of personal data, including concerns arising from an actual or suspected personal data breach
• Any other alleged infringement of Data Protection Laws

For the avoidance of doubt, this procedure applies regardless of the communication channel through which a complaint is received.

Where necessary, SEGA may request additional information from you in order to determine whether the complaint falls within the scope of this procedure and the applicable data protection laws.

SEGA aims to make this complaints process accessible to all individuals. Reasonable adjustments and appropriate support may be provided where required, including for individuals with disabilities, communication needs or vulnerabilities.

3. How to Make A Complaint

We offer multiple accessible channels for submitting a data protection complaint. Individuals may use whichever method suits them — there is no obligation to use a specific channel.

We use internal case management systems (including Zendesk) to record, manage and track complaints.. You are not obliged to create a Zendesk account to submit or pursue a complaint. Information relating to your complaint will be handled in accordance with our Privacy Policy.

Complaints may be submitted on behalf of another person, provided appropriate evidence of authority to act on that individual’s behalf (e.g. signed authorisation, power of attorney or evidence of parental responsibility).

To protect personal data, we may ask for information to verify the identity of the complainant or their authority to act on another individual’s behalf before providing information relating to the complaint.. Where a complaint concerns a child, we may also need to involve or verify the authority of a parent or guardian where appropriate.

4. Our complaint-handling process

5. Complaints involving children

Complaints from or about children will be handled by us with particular care. We will respond in plain, clear language appropriate to the child's age and level of understanding. Where a complaint is submitted by a parent or guardian, we will verify their authority to act on the child's behalf and, where appropriate, consider the child’s own rights and capacity to exercise them.

6. Record-keeping

We maintain a central complaints log which records, at minimum the:

• Date the complaint was received and the channel through which it was received
• Nature and subject matter of the complaint
• Date of acknowledgement
• Steps taken during the investigation
• Date and content of the outcome communicated to the complainant
• Any remedial action taken
• Whether the complaint was escalated to the ICO or otherwise resulted in regulatory engagement

Complaint records will be retained in accordance with SEGA’s retention policies and applicable legal obligations. 

7. Transparency and publication

We provide information about individuals' data protection rights, including how to raise a complaint with SEGA or the Information Commissioner's Office (ICO), through our Privacy Policy and other relevant privacy notices.

8. Escalation to the ICO

Any individual who remains dissatisfied after receiving our outcome — or who has not received a response from us within a reasonable period — may escalate their complaint to the ICO directly: