Privacy Policy

1.1. The controller shall provide the data subject with all information and every notice relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. Where requested by the data subject, information may also be provided orally.

1.2. The controller shall facilitate the exercise of the data subject's rights.

1.3. The controller shall inform the data subject of the actions taken on a request under the exercise of the data subject's rights without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, subject to the conditions laid down in the Regulation.

1.4. If the controller does not take action on the request of the data subject, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action, and of the possibility of lodging a complaint with a supervisory authority.

1.5. The controller shall provide the information and notice on the data subject's rights free of charge; however, a fee may be charged in the cases set out in the Regulation.

2.1. The data subject is entitled to receive information on the facts and information relating to the processing before the processing begins. The data subject must be informed of: the identity and contact details of the controller; the contact details of the data protection officer; the purposes and legal basis of the intended processing of the personal data; the recipients of the personal data; the fact of any transfer of data to a third country.

2.2. In order to ensure fair and transparent processing, the controller must inform the data subject of: the period for which the personal data will be stored; the data subject's rights (access, rectification, erasure, restriction, objection, data portability); the right to withdraw consent; the right to lodge a complaint with a supervisory authority; the consequences of failing to provide the data; the fact of automated decision-making.

2.3. Where the controller intends to further process the personal data for a purpose other than that for which they were collected, the controller shall inform the data subject prior to that further processing.

3.1. Where the controller has not obtained the personal data from the data subject, the data subject must be informed at the latest within one month of obtaining the data; if the data are used for communication with the data subject, at the latest at the time of the first communication with the data subject; if disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

3.2. The other rules set out under point 2 above (Right to prior information) apply accordingly.

4.1. The data subject is entitled to obtain confirmation from the controller as to whether or not personal data concerning them are being processed, and where such processing is being carried out, to obtain access to the personal data and the related information.

4.2. Where personal data are transferred to a third country or to an international organisation, the data subject is entitled to be informed of the appropriate safeguards relating to the transfer.

4.3. The controller shall provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.

5.1. The data subject is entitled to have the Controller rectify, without undue delay, inaccurate personal data concerning them.

5.2. Having regard to the purposes of the processing, the data subject is entitled to have incomplete personal data completed, including by means of providing a supplementary statement.

6.1. The data subject is entitled to have the controller erase personal data concerning them without undue delay, and the controller is obliged to erase personal data concerning the data subject without undue delay where: the personal data are no longer necessary; the data subject withdraws consent and there is no other legal basis for the processing; the data subject objects to the processing; the personal data have been unlawfully processed; there is a legal obligation to erase the data.

6.2. The right to erasure does not apply to the extent that processing is necessary for exercising the right of freedom of expression; for compliance with a legal obligation; for archiving purposes in the public interest or for scientific research purposes; or for the establishment, exercise or defence of legal claims.

7.1. Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject's consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

7.2. The data subject is entitled to obtain restriction of processing from the Controller where: the accuracy of the personal data is contested by the data subject; the processing is unlawful and the data subject opposes erasure; the Controller no longer needs the data, but the data subject requires them for a legal claim; the data subject has objected to the processing.

7.3. The data subject must be informed in advance before a restriction of processing is lifted.

The controller shall communicate any rectification, erasure or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

9.1. Subject to the conditions set out in the Regulation, the data subject is entitled to receive personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller – where the processing is based on consent or on a contract and the processing is carried out by automated means.

9.2. The data subject may also request direct transmission of the personal data between controllers.

9.3. The right to data portability does not apply where processing is necessary for the performance of a task carried out in the public interest. This right shall not adversely affect the rights and freedoms of others.

10.1. The data subject is entitled, on grounds relating to their particular situation, to object at any time to the processing of personal data concerning them based on public interest or legitimate interest, including profiling. In such case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests of the data subject.

10.2. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such purposes. Where the data subject objects, the personal data shall no longer be processed for such purposes.

10.3. At the latest at the time of the first communication with the data subject, these rights shall be explicitly brought to the data subject's attention and shall be presented clearly and separately from any other information.

11.1. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

11.2. This right shall not apply if the decision is necessary for entering into, or the performance of, a contract between the data subject and the controller; is authorised by Union or Member State law; or is based on the data subject's explicit consent.

11.3. In the cases referred to in points (a) and (c), the controller shall implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, including at least the right to obtain human intervention.

Union or Member State law to which the controller or processor is subject may restrict, by way of a legislative measure, the scope of the rights and obligations (Articles 12–22, 34 and 5 of the Regulation), where such a restriction respects the essence of the fundamental rights and freedoms.

13.1. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the breach to the data subject without undue delay. This communication shall describe the nature of the breach; provide the contact details of the data protection officer; describe the likely consequences of the breach; and describe the measures taken to address it.

13.2. The data subject need not be informed if: the controller has implemented appropriate protective measures (e.g. encryption); the controller has taken subsequent measures which ensure that the high risk is no longer likely to materialise; it would involve disproportionate effort (in which case a public communication or similar measure must be used instead).

The data subject has the right to lodge a complaint with a supervisory authority – in particular in the Member State of their habitual residence, place of work or place of the alleged infringement – if they consider that the processing of personal data relating to them infringes the Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint.

15.1. Without prejudice to any other administrative or non-judicial remedy, every natural and legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

15.2. Every data subject has the right to an effective judicial remedy where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months of the progress or outcome of the complaint lodged.

15.3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

15.4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

16.1. Without prejudice to any available administrative or non-judicial remedy, every data subject has the right to an effective judicial remedy where they consider that their rights under the Regulation have been infringed as a result of the processing of their personal data in non-compliance with the Regulation.

16.2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Such proceedings may also be brought before the courts of the Member State where the data subject has their habitual residence.