Privacy Policy

General Data Protection Regulation (‘GDPR’) – What Are Your Data Protection Rights?

If you live in certain territories, including the EU, you have a number of rights in relation to your personal information.

Data protection is a fundamental right set out in Article 8 of the EU Charter of Fundamental Rights. The General Data Protection Regulation (‘GDPR’) is applicable from 25^th May 2018 and is designed to give individuals more control over their personal data.

The key principles under the GDPR are:

• Lawfulness, fairness and transparency
• Purpose Limitation
• Data minimisation
• Accuracy
• Storage Limitation
• Integrity and confidentiality
• Accountability

While some of these rights apply generally, certain rights apply only in certain limited cases. I describe the rights of individuals under the General Data Protection Regulation below:

1. The right to be informed (Article 13 & 14 of the GDPR)
   Where the personal data is collected from you, the data controller must provide you with the following information:
   • Identity and contact details of the data controller (and where applicable, the controller’s representative);
   • Contact details of the Data Protection Officer (person with responsibility for data protection matters within the organisation);
   • Purpose(s) of the processing and the lawful basis for the processing;
   • Where processing is based on the legitimate interests of the controller or a third party, the legitimate interests of the controller;
   • Any other recipient(s) of the personal data;
   • Where applicable, details of any intended transfers to a third country (non-EU member state) or international organisation and details of adequacy decisions and safeguards;
   • The retention period (how long an organisation holds onto data) or, if that is not possible, the criteria used to determine the retention period;
   • The existence of the following rights – Right of Access, Right to Rectification, Right to Erasure, Right to Restrict Processing, Right to Data Portability, Right to Object and to request these from the data controller.
   • Where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
   • The right to lodge a complaint with a supervisory authority;
   • Whether the provision of personal data is a statutory or contractual requirement, necessary to enter into a contract, an obligation, and the possible consequences of failing to provide the personal data;
   • The existence of any automated decision making processes that will be applied to the data, including profiling, and meaningful information about how decisions are made, the significance and the consequences of processing.
2. The right to access information (Article 15 of the GDPR)
   You may have the right to access and receive a copy of the personal information I hold about you by contacting me using the contact information below.
3. The right to rectification (Articles 16 & 19 of the GDPR)
   If your personal data is inaccurate, you have the right to have the data rectified, by the controller, without undue delay. If your personal data is incomplete, you have the right to have data completed, including by means of providing supplementary information.
4. The right to erasure (Articles 17 & 19 of the GDPR)
   You may also have rights to change, restrict my use of, or delete your personal information. Absent exceptional circumstances (like where I am required to store data for legal reasons) I will generally delete your personal information upon request
5. The right to data portability (Article 20 of the GDPR)
   You have the right to request that I transfer the data that I have collected to another organisation, or directly to you, under certain conditions. If you make a request, I have one [1] month to respond to you. If you would like to exercise any of these rights, please contact me at [email protected].
6. The right to object to processing of personal data (Article 21 of the GDPR)
   You can object to (i) my processing of some of your information based on my legitimate interests and (ii) receiving marketing messages from me after providing your express consent to receive them. In such cases, I will delete your personal information unless I have compelling and legitimate grounds to continue using that information or if it is needed for legal reasons.
7. The right of restriction (Article 18 of the GDPR)
   You have a limited right of restriction of processing of your personal data by a data controller. Where processing of your data is restricted, it can be stored by the data controller, but most other processing actions, such as deletion, will require your permission.
8. Your rights in relation to automated decision making, including profiling (Article 22 of the GDPR)
   You have the right to not to be subject to a decision based solely on automated processing. Processing is “automated” where it is carried out without human intervention and where it produces legal effects or significantly affects you.

The right to complain. If you live in the EU and wish to raise a concern about my use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local data protection authority.