General Data Protection Regulation

EXERCISE YOUR RIGHT OF ACCESS

If you are the person concerned by personal data, you have the right to exercise your right of access.
This involves asking us whether or not your personal data is being processed.

If this data is processed, you may request :

• Access to this data.
• The purposes of our processing.
• The categories of personal data concerned.
• The recipients or categories of recipients to whom the personal data has been or will be communicated, in particular recipients established in third countries or international organizations.
• Where possible, the length of time for which the personal data will be kept or, where this is not possible, the criteria used to determine this length of time.
• The existence of the right to request the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing.
• The right to lodge a complaint with a supervisory authority.
• When personal data is not collected directly from you, you may request any available information regarding its source.
• The existence of automated decision-making, including profiling, as referred to in Article 22 (1) and (4) of the GDPR, and, at least in such cases, useful information regarding the underlying logic, as well as the significance and intended consequences of such processing for the data subject.
• Where personal data is transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards, pursuant to Article 46 of the GDPR, with respect to such transfer.
• We must provide you with a copy of the personal data being processed. We may charge a reasonable fee based on administrative costs for any additional copies. Where you make your request electronically, the information will be provided in a commonly used electronic form, unless you ask us to do otherwise. The right to obtain a copy must not prejudice the rights and freedoms of others.

EXERCISE YOUR RIGHT TO RECTIFICATION

If you are the data subject of your personal data, you have the right to obtain from us, as soon as possible, the rectification of inaccurate personal data concerning you. In view of the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary declaration.

EXERCISE THE RIGHT TO ERASURE (THE RIGHT TO BE FORGOTTEN)

1. If you are the data subject of personal data, you have the right to obtain from us the erasure, as soon as possible, of personal data concerning you and we are obliged to erase such personal data as soon as possible, where one of the following reasons applies:

• The personal data is no longer required for the purposes for which it was collected or otherwise processed.
• You withdraw the consent on which the processing is based, pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
• You object to the processing under Article 21(1) of the GDPR, and there is no compelling legitimate ground for the processing, or you object to the processing under Article 21(2) of the GDPR.
• Personal data has been processed unlawfully.
• Personal data must be erased to comply with a legal obligation that is provided for by Union law or by the law of the Member State to which we are subject.
• Personal data has been collected in connection with the provision of information society services as referred to in Article 8(1) of the GDPR.

2. If we have made personal data public and are required to erase it pursuant to paragraph 1, and taking into account available technology and the costs of implementation, we will take reasonable steps, including technical steps, to inform those processing such personal data that you have requested us to erase any links to such personal data, or any copies or reproductions thereof, through intermediaries.

3. Paragraphs 1 and 2 shall not apply insofar as such processing is necessary:

• To exercise the right to freedom of expression and information.
• To comply with a legal obligation which requires processing under Union law or the law of the Member State to which we are subject, or to carry out a task carried out in the public interest or in the exercise of official authority vested in the controller.
• For reasons of public interest in the field of public health, in accordance with Article 9(2)(h) and (i) of the RGPD, as well as Article 9(3) of the RGPD.
• For archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the RGPD, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously compromise the achievement of the purposes of the said processing, or
• For the establishment, exercise or defence of legal claims.

EXERCISE YOUR RIGHT TO RESTRICT PROCESSING

1. If you are the data subject of personal data, you have the right to obtain from us the restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by you, for a period of time allowing us to verify the accuracy of the personal data.
• The processing is unlawful and you object to the deletion of your personal data, demanding instead that we restrict their use.
• We no longer need your personal data for processing purposes, but you still require it for the establishment, exercise or defense of legal claims.
• You have objected to the processing under Article 21 (1) of the GDPR, during the verification as to whether the legitimate grounds we are pursuing override yours.

2. Where processing has been restricted under paragraph 1, such personal data may, with the exception of storage, only be processed with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or on important grounds of public interest of the Union or of a Member State.

3. If you have obtained the restriction of processing under paragraph 1, we will inform you before the restriction of processing is lifted.

EXERCISE YOUR RIGHT TO DATA PORTABILITY

1. If you are the data subject of a personal data, you have the right to receive such data concerning you that you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit such data to another data controller without our hindrance, where:

• The processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b) of the GDPR; and
• The processing is carried out using automated processes.

2. When you exercise your right to data portability pursuant to paragraph 1, you have the right to obtain that personal data be transmitted directly from one data controller to another, where technically possible.

3. The exercise of the right referred to in paragraph 1 of this article is without prejudice to Article 17 of the RGPD. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

4. The right referred to in paragraph 1 shall not affect the rights and freedoms of third parties.

EXERCISE YOUR RIGHT TO OBJECT & PROFILING

1. If you are the data subject of personal data, you have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Article 6(1)(e) or (f) of the GDPR, including profiling based on these provisions. We will no longer process personal data unless it can be demonstrated that there are compelling legitimate grounds for the processing which override your interests and rights and freedoms, or for the establishment, exercise or defence of legal claims.

2. Where personal data is processed for canvassing purposes, you have the right to object at any time to the processing of your data for such canvassing purposes, including profiling insofar as it is linked to such canvassing.

3. If you object to the processing of your personal data for canvassing purposes, the data will no longer be processed for such purposes.

4. At the latest at the time of the first communication with you, the right referred to in paragraphs 1 and 2 is explicitly brought to your attention and is presented clearly and separately from any other information.

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by means of automated procedures using technical specifications.

6. Where personal data is processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, you have the right to object, on grounds relating to its particular situation, to the processing of personal data concerning you, unless the processing is necessary for the performance of a task in the public interest.