Fair and documented handling

Complaints and Escalation Policy

This policy distinguishes complaints, support, security reports, and appeals and defines intake, triage, investigation, decision, and escalation.

Published and effective as an operational document, without claiming external legal review

This is a public operational text. It does not replace a project contract, a product-specific privacy notice, or legal review based on the organization and its actual service providers.

Document code
POL-PUB-COMPLAINT-001
Version
1.0.0
Effective date
Content review
Next review
Owner
Governance and privacy
Authoritative version
Arabic. If translations differ, the Arabic text prevails, subject to applicable law and contract.
Contact channel
studio@cupcodestudio.com
Scope

Public website, accounts, and connected digital services

Audience

Visitors, users, and clients

Jurisdiction

Kingdom of Saudi Arabia, subject to other mandatory laws where applicable

Operational publication authority

Cup Code operational publication catalog

Document summary

This policy distinguishes complaints, support, security reports, and appeals and defines intake, triage, investigation, decision, and escalation.

Choose the channel

Use Support for technical issues, security disclosure for vulnerabilities, Privacy for data rights, Council appeals for moderation decisions, and Complaints for conduct, service, or obligation issues. Misrouted requests are transferred while preserving reference and history.

Intake

We record a reference, scope, channel, date, category, and owner. We request only needed information and provide a secure route for sensitive files. A complainant does not need to publish a complaint publicly.

Triage and priority

Priority follows harm, persistence, affected group, and legal and security risk, not the complainant’s status alone. Personal and employee data is restricted to people who need it.

Investigation

The reviewer gathers evidence, hears relevant parties, establishes source and time, and checks conflicts. A person does not investigate a complaint about themselves or a decision they joined where an alternative exists.

Updates and timing

We acknowledge receipt and show the current stage and configurable target date. If delayed, we explain why without disclosing protected details. A privacy request keeps its legal deadline even if received through Complaints.

Outcome

The outcome states established facts, applied policy, action, remedy, and appeal route to the extent privacy, security, and employee rights allow. We do not promise a specific result before investigation.

Non-retaliation

A good-faith complainant is not penalized merely for complaining, even if not upheld. Deliberately malicious reports are prohibited, and intent is assessed from evidence rather than simple error.

External escalation

You may contact a competent authority or court. This policy does not limit a lawful remedy or require giving up a right in exchange for internal review.

Versions

Change log

  1. Version 1.0.0

    Published the first operational version with clear scope, responsibilities, rights, and escalation routes.