Our data management policy

The personal data provided by the Data Subject to the Controller must be true, complete and accurate in all respects. The Data Subject may request information about the processing of his or her personal data, and may request the rectification, erasure or withdrawal of his or her personal data, except for mandatory processing, and exercise his or her right to data portability and objection, in the manner indicated when the data were collected or by contacting the Controller at the above contact details. The right to be informed may be exercised in writing via the contact details indicated in this notice.

The data subject’s right of access: the data subject shall have the right to obtain from the controller information as to whether or not his or her personal data are being processed and, if such processing is taking place, the right to access the personal data and the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom or with whom the personal data have been or will be disclosed, including in particular recipients in third countries or international organisations;
• the envisaged period of storage of the personal data;
• the right to rectification, erasure or restriction of processing and the right to object;
• the right to lodge a complaint with a supervisory authority;
• information on the data sources;
• the fact of automated decision-making, including profiling, and the logic used and clear information on the significance of such processing and its likely consequences for the data subject

The Data Controller shall provide the data subject with a copy of the personal data processed. For additional copies requested by the data subject, the controller may charge a reasonable fee in line with the administrative costs.

At the request of the data subject, the Data Controller shall provide the information in electronic form. The Controller shall provide the information within a maximum of one month from the date of the request.

Right of rectification: 

The data subject may request the rectification of inaccurate personal data relating to him or her processed by the Controller and the completion of incomplete data.

Right to erasure: 

The data subject shall have the right to obtain from the Controller, upon his or her request and without undue delay, the erasure of personal data relating to him or her, on one of the following grounds:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the data subject withdraws his or her consent on the basis of which the processing was carried out and there is no other legal basis for the processing;
• the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
• the personal data have been unlawfully processed;
• the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is subject;
• the personal data have been collected in connection with the provision of information society services

The erasure of data cannot be initiated if the processing is necessary:

• to exercise the right to freedom of expression and information;
• for the purposes of complying with an obligation under Union or Member State law to which the controller is subject to which the processing of personal data is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for archiving purposes, scientific and historical research purposes or statistical purposes in the public interest in the field of public health;
• or for the establishment, exercise or defence of legal claims.

Right to restriction of processing:

At the request of the data subject, the Controller will restrict processing if one of the following conditions is met:

• the data subject contests the accuracy of the personal data, in which case the restriction applies for a period of time which allows the accuracy of the personal data to be verified;
• the data processing is unlawful and the data subject opposes the erasure of the data and instead requests the restriction of their use;
• the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or – the data subject has objected to the processing; in this case, the restriction applies for the period until it is established whether the legitimate grounds of the controller override the legitimate grounds of the data subject. Where processing is subject to restriction, personal data, other than storage, may be processed only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or of an important public interest of the Union or of a Member State. The Controller shall inform the data subject in advance of the lifting of the restriction on processing.

The right to data portability:

The data subject shall have the right to obtain the personal data concerning him or her which he or she has provided to the controller in a structured, commonly used, machine-readable format and to transmit such data to another controller.

The right to protest:

The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of his or her personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling based on those provisions. In the event of an objection, the controller may no longer process the personal data, unless there are compelling legitimate grounds for doing so which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such purposes, including profiling, where it is related to direct marketing. In the event of an objection to the processing of personal data for direct marketing purposes, the data shall not be processed for those purposes.

Automated decision-making on individual cases, including profiling:

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. The above right shall not apply where the processing is: – necessary for entering into, or the performance of, a contract between the data subject and the controller; – permitted by Union or Member State law applicable to the controller, which also lays down appropriate measures to protect the rights and freedoms and legitimate interests of the data subject; or – based on the data subject’s explicit consent.

Right of withdrawal:

The data subject has the right to withdraw his or her consent at any time. Withdrawal of consent does not affect the lawfulness of the processing based on consent prior to its withdrawal. The data controller shall do so without undue delay, but in any event from the date of receipt of the request.

Updated: 30th of September, 2023