VIII. Rights of the data subject

Whenever personal data is processed, the data subject defined in GDPR has the following rights vis-à-vis the data controller:

1. Right to information
Data subjects (users) can request the GFZ’s controller on behalf of ICDP to confirm whether or not the ICDP is processing their personal data.

If this is the case, data subjects are entitled to request the following information from the GFZ’s controller on behalf of ICDP:

• the purposes for which the personal data is being processed;
• the recipient or category of recipient to whom your personal data has been or is to be disclosed;
• the period for which your personal data will be stored, or, if no specific information can be provided, the criteria used to determine that period;
• the existence of a right to request the controller to rectify or erase your personal data, to restrict the controller’s processing of your personal data, or to object to such processing;
• the existence of a right to complain to a supervisory authority;
• where the personal data is not collected from the data subject, any available information as to its source.

2. Right to rectification
Data subjects have the right to request the GFZ’s controller, acting on behalf of ICDP, to rectify and/or complete their personal data insofar as that of their personal data being processed is incorrect or incomplete. In such cases, the GFZ’s controller, acting on behalf of ICDP, must rectify the data immediately.

3. Right to restriction of processing
Data subjects are entitled to request restrictions on the processing of their personal data in the following circumstances:

• if the accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data;
• if the controller no longer needs the personal data for the purposes for which it was processed but it is still required by the data subject for the establishment, exercise, or defense of legal claims;
• if the data subject has objected to the processing of his/her data pursuant to Article 21 no. 1 GDPR and it has not yet been established whether the legitimate grounds of the GFZ override those of the data subject.

If the processing of the data subject’s personal data has been restricted, this data may – with the exception of storage – only be processed with the data subject’s consent, or to establish, exercise, or defend legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest within the EU or an EU member state.

A data subject who has obtained restriction of processing under the conditions specified above must be informed by the GFZ’s data controller, acting on behalf of ICDP, before the restriction of processing is lifted.

Back