Data subjects are all those whose personal data are recorded or processed by ROTO. This procedure describes the ROTO approach to the rights of data subjects. Initially, data subjects will be informed about the “processing of personal data” in a “general notice”, such as employees being informed about salary administration in their employment contract and a cookie notice for website visitors. This disclosure requirement does not apply if the registration is self-evident and necessary from a business point of view in order to conduct business properly, for example between suppliers and buyers.
The DPO ensures that data subjects can avail themselves of their legal rights and is responsible for handling requests pursuant to these rights. A request to exercise one or more of the above rights must be submitted in writing to email@example.com or by post to Roto B.V., Molenstraat 28, 1911 DA Uitgeest.
Data subjects whose personal data are processed or recorded have the right to information (Articles 13 & 14 of the GDPR) and may also authorise other persons to exercise the aforementioned rights on their behalf, with a request from minors who have not yet reached the age of 16 being made by their legal representative. After it has been established that the applicant is a legitimate data subject and it is clear which right or rights the data subject wishes to exercise, the DPO will process the request. If a data subject cannot provide adequate identification, the request will be denied.
The data subject may request data free of charge no more than twice a year unless the request is manifestly unfounded or excessively burdensome (as in the case of repeat requests).
On the basis of the data subject’s request, the DPO will conduct an investigation and will inform the data subject in writing of the decision taken within four weeks of the request. The decision will state the reasons on which it is based, be formulated in a concise, clear and understandable manner, and state the option of lodging an objection or appeal, or of submitting a complaint, to the Dutch Data Protection Authority.
Unless this is impossible or unless it requires a disproportionate amount of effort, third-party recipients/users of the personal data will be informed about the possible consequences of the investigation such as a rectification or deletion of personal data or a restriction on the further retention or processing of certain data.
The General Data Protection Regulation (GDPR - Chapter 2) sets out the rights of the data subjects whose data (including privacy-sensitive data) may be recorded. In addition to the right to information (Articles 13 and 14 of the GDPR), data subjects also have the following rights:
Each data subject has the right to access their own data and to request the data stored or processed by ROTO. Here, the following information will be provided to the extent the data are processed and this information is available:
Every data subject may submit a request with regard to personal data relating to the subject for rectification, erasure or restriction of the processing of the data:
A data subject may ask for data to be forwarded to another party, usually another controller/data controller. The DPO will check whether the data are being processed automatically (i.e. not in paper files) and whether there is a legal basis for this third party to process the data concerned on the basis of an agreement or the consent of the data subject. Personal data are then provided in a structured and machine-readable form and the receiving party accepts only those data which are necessary and relevant for the intended purpose. This will be the case even if ROTO itself is the receiving party.
The data subject may object at any time to the processing if the processing of data is not necessary for the performance of a task within the scope of the legitimate interests of the controller. This may therefore be an objection to processing for the purposes of direct marketing and/or to the processing of data for scientific or historical research or for statistical purposes based on the specific situation of the data subject.
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the automated processing is necessary for the performance of a contract, is authorised by a legal provision or if the data subject has given his or her explicit consent.
Data subjects who disagree with the decision of the DPO relating to one or more of the aforementioned rights inform the DPO and then the management of ROTO about their objections. Data subjects also have the right to submit a complaint to the Dutch Data Protection Authority.
We use functional cookies that are needed for our website to function correctly. We also use analytical cookies that allow us to tailor our website to your wishes and therefore to improve your user experience.
We ask your consent to place social media cookies and marketing cookies. Social media buttons are required to use the social media buttons on our websites. Marketing cookies allow us to provide you with targeted information that is relevant for you at the present time.