Basic Information on Data Protection

• RIGHT OF ACCESS

  The right of access is your right to contact the data controller to know whether or not your personal data is being processed and, if such processing is taking place, to obtain the following information:

  • A copy of your personal data being processed
  • The purposes of the processing
  • The categories of personal data concerned
  • The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
  • The envisaged period for which the personal data will be stored, or if not possible, the criteria used to determine this period
  • The existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject or to object to such processing
  • The right to lodge a complaint with a Supervisory Authority
  • Where the personal data are not collected directly from you, any available information as to their source
  • The existence of automated decision-making, including profiling, and at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
  • When personal data are transferred to a third country or an international organization, you have the right to be informed of the appropriate safeguards relating to the transfer

Download the form

• RIGHT TO RECTIFICATION

  The exercise of this right means that you can obtain from the controller the rectification of inaccurate personal data concerning you without undue delay.

  Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

  In your request, you must indicate which data you are referring to and the correction to be made. Additionally, where necessary, you must accompany your request with documentation justifying the inaccuracy or incomplete nature of your data.

  Download the form

• RIGHT TO ERASURE (RIGHT TO BE FORGOTTEN)

  You may exercise this right before the controller by requesting the erasure of your personal data when any of the following circumstances apply:

  • If your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
  • If the processing of your personal data was based on the consent you provided, and you withdraw it, provided that the processing is not based on another legal ground
  • If you have objected to the processing of your personal data by exercising your right to object in the following circumstances:
    • The processing by the controller was based on legitimate interest or the performance of a task carried out in the public interest, and no overriding legitimate grounds for the processing exist
    • Your personal data are processed for direct marketing purposes, including profiling related to such marketing
  • If your personal data have been unlawfully processed
  • If your personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject
  • If the personal data have been collected in relation to the offer of information society services mentioned in Article 8(1) (conditions applicable to child’s consent in relation to information society services).

  Furthermore, the GDPR connects this right with the so-called “right to be forgotten,” meaning that this right to erasure is extended so that a controller who has made personal data public is obliged to inform other controllers processing such data to erase any links to, or copies or replications of, those personal data.

  However, this right is not absolute; erasure may not be feasible when processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, or for the establishment, exercise, or defense of legal claims.

Download the form

• RIGHT TO RESTRICTION OF PROCESSING

  This right allows you to obtain from the controller the restriction of processing of your data, and it has two main aspects:

  You can request the suspension of the processing of your data:

  • When you contest the accuracy of your personal data, for a period enabling the controller to verify their accuracy
  • When you have objected to the processing of your personal data based on legitimate interest or a task in the public interest, while the controller verifies whether those grounds override yours

  You can request the controller to preserve your data:

  • When the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead
  • When the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims

  Download the form

• RIGHT TO OBJECT

  As the name suggests, this right means you can object to the controller processing your personal data in the following cases:

  When processing is based on a task carried out in the public interest or on legitimate interest, including profiling:

  • The controller shall no longer process the data unless they demonstrate compelling legitimate grounds which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims

  When processing is for direct marketing purposes, including the aforementioned profiling:

  • Once this right is exercised for this purpose, personal data shall no longer be processed for such purposes

  Download the form

• RIGHT TO DATA PORTABILITY

  The purpose of this right is to further strengthen control over your personal data. When processing is carried out by automated means, you receive your personal data in a structured, commonly used, machine-readable, and interoperable format, and you can transmit those data to another controller, provided the processing is based on consent or within the framework of the execution of a contract.

  However, by its very nature, this right does not apply when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

  Download the form