Data Subjects are entitled to the following rights, whereby the Data Subject rights also granted to Data Subjects by provisions of dutch data protection law apply in addition to the following rights under the GDPR.
a) Right to confirmation
Every Data Subject has the right, granted by the European directives and regulations, to obtain confirmation from the data controller as to whether personal data relating to them are being processed. If a Data Subject wishes to exercise this right of confirmation, he or she may at any time contact our data protection officer or another member of the controller’s staff.
b) Right of access
Any Data Subject affected by the processing of personal data has the right, granted by the European directives and regulations, to obtain from the controller, at any time and free of charge, information on the personal data stored in relation to him or her and a copy thereof. In addition, the European directives and regulations have granted the Data Subject access to the following information:
- the processing purposes
- the categories of personal data processed
- the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations
- if possible, the planned duration of storage of the personal data or, if this is not possible, the criteria for determining this duration
- the existence of a right of rectification or erasure of personal data or restriction of processing by the controller, or the right to object to such processing
- the existence of a right to complain to a supervisory authority
- if the personal data are not collected from the Data Subject: All available information on the origin of the data
- the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the Data Subject
The Data Subject also has the right to obtain information as to whether personal data have been transmitted to a third country or to an international organisation. Where this is the case, the Data Subject also has the right to obtain information on the appropriate guarantees in connection with the transmission.
If a Data Subject wishes to exercise this right of access, he or she may at any time contact our data protection officer or another member of the controller’s staff.
c) Right to rectification
Every Data Subject affected by the processing of personal data has the right, granted by the European directives and regulations, to demand the immediate rectification of incorrect personal data. The Data Subject also has the right to the completion of incomplete personal data, including by means of a supplementary declaration, having regard to the purposes of the processing. If a Data Subject wishes to exercise this right of rectification, he or she may at any time contact our data protection officer or another member of the controller’s staff.
d) Right of erasure (right to be forgotten)
Any Data Subject affected by the processing of personal data has the right, granted by the European directives and regulations, to require the controller to immediately erase personal data relating to him or her, where one of the following reasons applies and provided that the processing is not necessary:
The personal data have been collected or otherwise processed for purposes for which they are no longer necessary.
The Data Subject revokes the consent on which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.
The Data Subject lodges an objection to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for processing, or the Data Subject lodges an objection to the processing pursuant to Art. 21 (2) GDPR.
The personal data were processed unlawfully.
The erasure of personal data is necessary to comply with a legal obligation under Union law or the law of Member States to which the controller is subject.
The personal data were collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.
If one of the aforementioned reasons applies and a Data Subject wishes to arrange for the deletion of personal data stored by Gebrüder Schulte GmbH & Co KG, he or she may at any time contact our data protection officer or another employee of the controller. The data protection officer at Gebrüder Schulte GmbH & Co KG or another employee will ensure that the request for deletion is complied with immediately.
If the personal data have been made public by Gebrüder Schulte GmbH & Co KG and our enterprise, as the controller, is obliged to delete the personal data pursuant to Article 17 (1) GDPR, Gebrüder Schulte GmbH & Co KG will, taking into account the available technology and the cost of implementation, implement reasonable measures, including technical measures, to inform other data controllers which process the published personal data, that the Data Subject has requested that those other data controllers delete all links to, or copies or replications of, the personal data, unless the processing is necessary. The data protection officer at Gebrüder Schulte GmbH & Co KG or another employee will arrange for the necessary action to be taken in individual cases.
e) Right to restrict processing
Any Data Subject affected by the processing of personal data has the right, granted by the European directives and regulations, to request that the controller restrict the processing if one of the following conditions is met: The accuracy of the personal data is contested by the Data Subject, for a period of time that allows the controller to verify the accuracy of the personal data.
The processing is unlawful, the Data Subject refuses to have the personal data deleted and instead requests that the use of the personal data be restricted.
The controller no longer needs the personal data for the purposes of the processing, but the Data Subject needs them to exercise or defend his or her rights.
The Data Subject has lodged an objection to the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether the legitimate reasons of the controller outweigh those of the Data Subject.
If one of the aforementioned conditions is met and a Data Subject wishes to request the restriction of personal data stored by Gebrüder Schulte GmbH & Co KG, he or she may at any time contact our data protection officer or another employee of the controller. The Data Protection Officer at Gebrüder Schulte GmbH & Co KG or another employee will arrange for restriction of the processing.
f) Right to data portability
Every Data Subject affected by the processing of personal data has the right, granted by the European directives and regulations, to receive his or her personal data as provided by him or her to a controller in a structured, widely available and machine-readable format. He or she also has the right to transfer these data to another controller without hindrance from the controller to whom the personal data have been made available, provided that the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and that the processing is carried out by means of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, when exercising his or her right to data portability in accordance with Art. 20 (1) of the GDPR, the Data Subject has the right to request that personal data be transferred directly from one controller to another, insofar as this is technically feasible and provided that the rights and freedoms of other persons are not affected.
To assert this right to data portability, the Data Subject may at any time contact the data protection officer appointed by Gebrüder Schulte GmbH & Co KG or another employee.
g) Right to object
Every Data Subject affected by the processing of personal data has the right, granted by the European directives and regulations, to object at any time, for reasons arising from his or her particular situation, to any processing of his or her personal data carried out on the basis of Art. 6 (1) (e) or (f) GDPR. This also applies to profiling based on these provisions.
Gebrüder Schulte GmbH & Co KG will no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or the processing is required for the assertion, exercise or defence of legal claims.
If Gebrüder Schulte GmbH & Co KG processes personal data for direct marketing purposes, the Data Subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling, insofar as it is related to such direct marketing. If the Data Subject objects to the processing by Gebrüder Schulte GmbH & Co KG of data for direct marketing purposes, Gebrüder Schulte GmbH & Co KG will no longer process the personal data for these purposes.
In addition, the Data Subject has the right on grounds relating to his or her particular situation to object to the processing of his or her personal data by Gebrüder Schulte GmbH & Co KG for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task to be carried out in the public interest.
To exercise this right to object, the Data Subject may directly contact the Data Protection Officer at Gebrüder Schulte GmbH & Co KG or another employee. The Data Subject is also free in the context of the use of information society services, notwithstanding Directive 2002/58/EC, to use automated procedures involving technical specifications to exercise his or her right to object.
h) Automated case-by-case decisions including profiling
Any Data Subject affected by the processing of personal data has the right, as granted by the European directives and regulations, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in a similar way, except where the decision is (1) necessary for the conclusion or performance of a contract between the Data Subject and the controller, or (2) authorised by Union or national law to which the controller is subject, where that law lays down adequate safeguards with respect to the rights and freedoms and legitimate interests of the Data Subject, or (3) taken with the explicit consent of the Data Subject.
If decision (1) is necessary to enter into or to perform a contract between the Data Subject and the data controller or (2) is made with the Data Subject’s explicit consent, Gebrüder Schulte GmbH & Co KG will implement suitable measures to safeguard the Data Subject’s rights and freedoms and legitimate interests, which will include at least the right to request the intervention of a person on the part of the controller, to express an opinion on the matter and to contest the decision.
If the Data Subject wishes to exercise rights relating to automated decisions, he or she may at any time contact our data protection officer or any other employee of the controller.
i) Right to revoke consent under data protection law
Every Data Subject affected by the processing of personal data has the right, granted by the European directives and regulations, to revoke his or her consent to the processing of personal data at any time.
If the Data Subject wishes to exercise his or her right to revoke consent, he or she may at any time contact our data protection officer or any other employee of the controller.