Rights of data subjects

Data subjects are all those whose personal data are recorded or processed by ROTO. This procedure describes the ROTO approach to the rights of data subjects. Initially, data subjects will be informed about the “processing of personal data” in a “general notice”, such as employees being informed about salary administration in their employment contract and a cookie notice for website visitors. This disclosure requirement does not apply if the registration is self-evident and necessary from a business point of view in order to conduct business properly, for example between suppliers and buyers. 

ROTO will respect the rights of data subjects in accordance with the provisions of the GDPR, and data subjects will always have the right to object, appeal or file a complaint. General information about the processing of these data can also be found in the Privacy Statement, and Privacy Policy and Regulations, on our website.

Role of Data Protection Officer (DPO)

The DPO ensures that data subjects can avail themselves of their legal rights and is responsible for handling requests pursuant to these rights. A request to exercise one or more of the above rights must be submitted in writing to c.bruin@rotogroep.nl or by post to Roto B.V., Molenstraat 28, 1911 DA Uitgeest. 

Right to information, investigation and decision by the DPO - supplying information to a data subject

Data subjects whose personal data are processed or recorded have the right to information (Articles 13 & 14 of the GDPR) and may also authorise other persons to exercise the aforementioned rights on their behalf, with a request from minors who have not yet reached the age of 16 being made by their legal representative. After it has been established that the applicant is a legitimate data subject and it is clear which right or rights the data subject wishes to exercise, the DPO will process the request. If a data subject cannot provide adequate identification, the request will be denied. 

The data subject may request data free of charge no more than twice a year unless the request is manifestly unfounded or excessively burdensome (as in the case of repeat requests). 

On the basis of the data subject’s request, the DPO will conduct an investigation and will inform the data subject in writing of the decision taken within four weeks of the request. The decision will state the reasons on which it is based, be formulated in a concise, clear and understandable manner, and state the option of lodging an objection or appeal, or of submitting a complaint, to the Dutch Data Protection Authority. 

Unless this is impossible or unless it requires a disproportionate amount of effort, third-party recipients/users of the personal data will be informed about the possible consequences of the investigation such as a rectification or deletion of personal data or a restriction on the further retention or processing of certain data.

Rights of data subjects

The General Data Protection Regulation (GDPR - Chapter 2) sets out the rights of the data subjects whose data (including privacy-sensitive data) may be recorded. In addition to the right to information (Articles 13 and 14 of the GDPR), data subjects also have the following rights: 

The right of access (Article 15 GDPR)

Each data subject has the right to access their own data and to request the data stored or processed by ROTO. Here, the following information will be provided to the extent the data are processed and this information is available: 

1. the purposes of the processing; 
2. the categories in question of personal data; 
3. whether data are passed on to third parties and, if so, to whom; whether there are transfers to other countries or international organisations and, if so, to whom; 
4. the expected retention periods for the data; 
5. the rights of the data subject in relation to the data in question; 
6. the right of the data subject to submit a complaint to the Dutch Data Protection Authority; 
7. whether data about the data subject have been obtained from sources other than the data subject and, if so, which sources; 
8. whether there has been automated decision-making

Rectification, erasure and restriction of processing (Articles 16, 17 and 18 GDPR)

Every data subject may submit a request with regard to personal data relating to the subject for rectification, erasure or restriction of the processing of the data: 

1. rectification: to correct inaccurate or incomplete personal data that have been processed;
2. erasure: to “forget” personal data (erase data) if: 
   • the personal data are no longer necessary for the purpose for which the data were collected and there is no other reason to retain this personal data; 
   • the purpose for processing the personal data is based on the data subject’s consent and the data subject withdraws that consent; 
   • the data subject objects to the processing and there are no compelling grounds for the further retention or processing of the data; 
   • the personal data have been unlawfully retained or processed. 
3. the request for erasure will be denied if the personal data are necessary for specific purposes such as the exercise of statutory obligations (compliance with European or Dutch law) or legal proceedings; here, the retention periods must be observed, such as those for the purposes of the Archive Act and/or scientific or historical research; only the data necessary for the purpose will be retained in this respect; 
4. restriction of processing: data subjects may ask for the processing of their data to be restricted if the accuracy of the data is at issue (as long as necessary to verify accuracy) or the personal data are no longer needed for the original purpose; the processing may therefore be unlawful and the data subject may ask for the data to be blocked or moved during the investigation so that it is inaccessible to employees, during which time the data may not be deleted. 

Data portability (Article 20 GDPR)

A data subject may ask for data to be forwarded to another party, usually another controller/data controller. The DPO will check whether the data are being processed automatically (i.e. not in paper files) and whether there is a legal basis for this third party to process the data concerned on the basis of an agreement or the consent of the data subject. Personal data are then provided in a structured and machine-readable form and the receiving party accepts only those data which are necessary and relevant for the intended purpose. This will be the case even if ROTO itself is the receiving party. 

Right to object (Article 21 GDPR)

The data subject may object at any time to the processing if the processing of data is not necessary for the performance of a task within the scope of the legitimate interests of the controller. This may therefore be an objection to processing for the purposes of direct marketing and/or to the processing of data for scientific or historical research or for statistical purposes based on the specific situation of the data subject.

Right to object to automated processing/profiling (Article 22 GDPR)

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the automated processing is necessary for the performance of a contract, is authorised by a legal provision or if the data subject has given his or her explicit consent.

Objection and appeal

Data subjects who disagree with the decision of the DPO relating to one or more of the aforementioned rights inform the DPO and then the management of ROTO about their objections. Data subjects also have the right to submit a complaint to the Dutch Data Protection Authority.