Template Complaint form and Template Acknowledgement of receipt

20 June 2023 Adopted 2

Introduction Before lodging a complaint, please read more about your right to lodge a complaint [ link to page with additional information on the SA’s website ], as well as our privacy notice [ link to SA’s privacy notice ], in order to be informed about how we will process your data during this procedure. [Optional - Add reference here, as appropriate, to limitations under national law - e.g. if complaints are not admissible before your SA unless the SA is competent for the place where the complainant works or is resident, or where the infringement occurred]. [Optional - Reason to submit your complaint to this specific authority (please select the options that apply to you): a) It is the data protection authority of my place of residence; b) It is the data protection authority of my place of work; c) It is the data protection authority of the place where the alleged infringement happened; d) It is the data protection authority which is competent to the data protection supervision of the data controller. Please note that your complaint might be subject to the cooperation procedure (also known as the “One-Stop-Shop” procedure, or “OSS”), if it concerns personal data processing that takes place in multiple EU/EEA countries or affects data subjects in more than one EU/EEA country. In that case, more than one European supervisory authority will be involved in handling your complaint. You can learn more about the “One-Stop-Shop” procedure through the European Data Protection Board website , in particular through this link [and through this link ***link to national page in the national language***]

Scope of the complaint form This form is only applicable to complaints concerning possible infringements in connection with the processing of your personal data in accordance with Article 77 GDPR and [add reference to national legislation as appropriate]. Please note that this form should not be used for drawing the supervisory authorities’ attention to specific alleged infringements of data protection legislation, which do not concern you directly as a data subject. For general inquiries and information, in particular on how to exercise your data subject rights vis-à-vis the controller, please contact us through the following [link]. [ SAs with specific templates for specific types of complaints or sectors of activities (e.g. revenge porn, internet or bank sector), can add here a reference to them, e.g. for complaints concerning “revenge porn” / “data breaches”, please use the following specific template ] You can submit your complaint via this electronic form. Alternatively, you may also download it, fill it in and send it to the XX authority [indicate address]. Adopted

Please note that the use of this form is not mandatory for the submission of your complaint, but is intended to facilitate your submission, its completeness, and the procedure to handle it. 3 Complaint

Person filling the complaint ☐ You personally, as concerned data subject ☐ Legal representative acting on behalf of (a) concerned data subject(s) / Body, organisation or association acting on behalf of (a) concerned data subject(s) [ if this option is chosen, please also specify the concerned data subject(s)’ details below ] ☐ Body, organisation or association acting on its own initiative [ if this option is chosen, you may also specify the concerned data subject(s)’ details below, where relevant ]

Contact details

Data subject(s)’ contact details [each SA can indicate whether any of these fields is mandatory according to national administrative law / provisions] a) Full name and surname; b) Postal address, city, country; c) Email address - if preferred means of contact, please tick the box; d) Telephone / mobile number - if preferred means of contact, please tick the box; e) Identification details [depends on each SA - can be personal identification number, ID / passport number or copy] .

Contact details of the legal representative acting on behalf of the data subject(s) / Body, organisation or association acting on behalf of the data subjects(s) or on its own initiative 1 a) Name / surname of individual / entity; b) Postal address, city, country; c) Email address; d) Telephone / mobile number.

Subject of your complaint

Your complaint Please provide the reasons for your complaint in as much detail as possible, describing the facts in chronological order. If possible, please also clarify what is the alleged infringement of the GDPR and what is the remedy/action that you seek (e.g. rectification of your personal data; erasure of your personal data; etc.). 1 Please provide the relevant documentation under Section 3.3.3 of this form. Adopted 4

Entity / individual which is the subject of your complaint (e.g. company, association, public authority, natural person) [each SA can indicate whether any of these fields is mandatory according to national administrative law / provisions] a) Name; b) Postal address, city, country; c) Contact details, i.e. telephone number, email address and website link; d) Company registration number e) Indication of whether you contacted this entity/its Data Protection Officer/individual prior to submitting your complaint: • If [Y], please provide all exchanges, including any replies, in attachment to this submission under section 3.3.3 below; • If [N], please indicate why not [ for SAs which have such contact as a requirement, it can be handled here ]

Attachments/materials provided to support your claims [each SA to determine which ones are mandatory according to national provisions]: a) Copy of all relevant past correspondence with the entity/individual subject of the complaint (e.g. copy of the request for the exercised right(s) and documentation proving the date the entity became aware of the request; when the request was made via email, a copy of the message sent to the entity showing the date and email addresses of sender and recipient ; exhaustion of a deadline) b) Copy of any marketing messages or e-mails c) Pictures, screenshots d) Expert reports e) Witness reports f) Identification of the processing activities g) Inspection reports h) For legal representatives, document(s) demonstrating your capacity to file this complaint (e.g. power of attorney, mandate, notarial deed, court/private document identifying both grantor and representative, chamber’s id number, address and contact data) i) Other (please specify)

Acknowledgements and signature ☐ I understand that the XX SA may, for the purpose of the examination of my complaint, be required to transfer the information collected through this form to the data controller against whom the complaint is made, and/or to another SA if necessary for the cooperation Adopted 5 mechanism. The XX SA will only transfer such information if it is necessary for the handling of the complaint. In specific situations [the SA can specify, if required by national law/practice], the XX SA will maintain my anonymity. ☐ [Optional] I declare, [under civil and criminal liability], that the data provided by this complaint are true and no information has been omitted or misrepresented. [Signature of complainant / legal representative] [SAs can choose to have a specific authentication method when implementing this template] Date and place: