Document release: 2026-09-18.6 · Effective: 2026-09-18

Save this document (.md)

Complaints, Abuse Reports and Privacy Requests

You can contact Backends, operator of Free S3, without creating an account or paying a fee. This procedure does not limit statutory rights, urgent court action or access to regulators.

1. Contact routes

Use the route most convenient to you. A genuine complaint received elsewhere in our organisation is still referred to the appropriate person. We will make reasonable accessibility adjustments; tell us what would help. An account login, specific subject line, paid service, legal vocabulary or use of our template is not a condition of being heard.

Signed-in customers may also open and track a case through the portal. This is an optional additional route, not a requirement to create an account or abandon email/post. An operator can log a report received elsewhere so that ownership, deadlines and actions are tracked. The person complained about does not automatically see a restricted abuse case.

2. What to include

Explain what happened, when it happened, any safe account/case/object identifiers and what outcome you seek. Give a way to reply. If you act for someone else, explain your authority; we may verify it proportionately before disclosing their information. Send only information relevant to the issue.

Do not send passwords, S3 secrets, unnecessary personal data, malware attachments or copies of suspected child sexual abuse material. A signed object URL may itself grant access and contain credential information; use the hostname and object identifier instead. We can agree a secure method if further evidence is necessary.

Our optional privacy complaint template can be completed electronically and emailed, or printed and posted. Downloading or filling that document does not itself transmit a complaint. You may instead use the authenticated case form or complain in your own words through another route.

3. Privacy complaints

We acknowledge a personal-data complaint as soon as reasonably possible and no later than 30 days after receipt. This is an acknowledgement deadline, not permission to postpone investigation or a promise that every case will be resolved within 30 days.

We make appropriate enquiries without undue delay, tell you about progress, and explain the outcome and any action or remedy. We may ask focused questions if needed. Where a complaint also contains an access, erasure or other rights request, that request is tracked separately against its applicable legal deadline.

You have the right to complain to the UK's Information Commissioner's Office. The ICO complaints page explains its process and contact options. We will explain the relevant escalation route in our outcome. This procedure does not remove rights to approach another competent authority, obtain independent advice or seek a judicial remedy.

4. Service complaints and suspension appeals

We log the issue, consider relevant evidence and give a reasoned response as promptly as we reasonably can. The free service has no general guaranteed support response or resolution time. This does not reduce the specific legal duties and deadlines applicable to privacy complaints, breaches or rights requests.

For an appeal, give the restriction or case reference and explain the mistake or corrective action. We arrange human consideration, separate from the initial automated result, and explain whether access will be restored, conditions changed or the decision maintained, so far as lawful. Good-faith complaints do not themselves justify retaliation or termination.

5. Abuse and intellectual-property reports

Reports can be made by a customer or a third party. Identify the relevant object or activity, explain why it is unlawful or breaches the Acceptable Use Policy, and include focused supporting information. For an intellectual-property report, identify your rights or authority and the work allegedly infringed.

We assess risk and evidence rather than automatically accepting every allegation. We may contact the customer, restrict relevant access, preserve limited evidence or refer a matter to an appropriate authority where lawful. We will not disclose another person's identity or confidential material simply because it is requested in a complaint. We may need to withhold investigation details to protect people or comply with law.

We prioritise credible immediate risks, but the mailbox is not an emergency service or a claim of continuous 24-hour monitoring. If there is an immediate danger to life or safety, contact emergency services. Do not obtain or reproduce unlawful material in order to prove a report.

6. Records and confidentiality

Complaint and appeal records are used to handle the case, meet legal obligations and improve appropriate safeguards. Access is limited to those who need it; some relevant information may need to be shared fairly with the person complained about or with an authority. We explain significant disclosures where appropriate and lawful. Retention follows the Privacy Notice.

Portal case narratives and notes are encrypted at rest with the application vault key. Searchable metadata such as the reference, category, status, assignee, priority and deadlines remains in the case database. Reminder emails contain a reference and authenticated link rather than the case narrative. Encryption does not remove the need for restricted administrator access, secure backups, retention and careful handling after decryption.