The General Data Protection Regulation states that the data subject has certain rights.
Right of access (register extract)
As data subject, you are entitled to request information regarding what personal data the university holds on you, free of charge, once per calendar year. To do so, please contact us at firstname.lastname@example.org. If possible, please specify if you have been in contact with us as student, staff, in a research project, or something else.
Right to rectification
As data subject, you are entitled to request that personal data concerning you, held by the university, is corrected if it is not correct. To exercise this right, send a request to your nearest contact person, course manager, line manager or other authorized person. The university is required to correct erroneous personal data without undue delay.
The right to be forgotten
As data subject, you are entitled to have personal data concerning you erased when it is no longer needed for the purpose it was collected. There may be other legislation that supersedes this rule, which means that personal data cannot always be allowed to be erased.
In case of disclosure of personal data to another party, the university shall take reasonable steps to notify this party about the erasure. In cases where there are legal barriers to erasure of personal data, the university will limit the processing of this data only to the extent of legal requirements.
The right to limitation of personal data
As data subject, you are entitled to request that the processing of personal data concerning you be limited to certain specific purposes only. The right to limitation can be exercised in the following cases:
- If personal data is incorrect and the university needs time to inspect the accuracy of the data.
- If personal data is no longer required for the university's activities, but the you request further retention due to legal action.
- If you oppose processing performed by the university. The processing is limited in that case until a balance is reached between the reasons of the data subject and the university's compelling legitimate reasons.
- In the event that you requests that the university delete personal data concerning you, but for some reason, the university cannot accept this.
Right to object to processing
In some cases, you may object to the processing of your personal data. If there are no compelling reasons for the university to continue processing the personal data, such as for meeting legal requirements, then the university will cease processing.
Right to data portability
You have the right to get your personal data from the university or to ask us to transfer your data to another controller. This only applies to personal data that you have given to us and when we are processing your data based on your consent or when processing is necessary for the performance of a contract.