GDPR Privacy notes

Dear colleague,
in the moment you registered at CROJFE web page as an author or a reviewer, personal data were collected, as condition for concluding the publishing process. We collected the following data: name and surname, e-mail, affiliation. These data were collected only for the purpose of publishing process and will be stored until the termination of the business collaboration between you and CROJFE, after which data will be archived together in form of an article archive without any further process. Please be informed on personal data protection rights.

Data subject rights
(i) Right of access: obtain confirmation as to whether or not personal data are being processed, and, where that is the case, access to the personal data and all connected information. The controller shall on request provide a copy of the personal data undergoing processing.

(ii) Right to rectification: obtain without undue delay the rectification of inaccurate personal data. Data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

(iii) Right to erasure (‘right to be forgotten’): obtain erasure of personal data without undue delay, especially where the data subject withdraws the consent, if among other, some of the following conditions are fulfilled: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed or there is no legal basis for their further processing.

(iv) Right to restriction of processing: obtain restriction of processing where one of the following applies:

• accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
• processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
• data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

(v) Right to information: the controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with previous clauses to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Controller is obliged to inform the data subject about those recipients if the data subject requests it.

(vi) Right to data portability: receive the personal data concerning him or her, which he or she has provided to the controller in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. Where technically feasible, the personal data shall be transmitted directly from one controller to another controller.

(vii) Right to object: object at any time on grounds relating to his or her particular situation to processing of personal data concerning him or her. This applies when the processing is based on public interest or exercise of official authority vested in the controller or based on legitimate interests of the controller, especially in case of direct marketing.

Procedure
(i) Data subject willing to excise his or her rights can submit a request on e-mail: web@crojfe.com.Where CROJFE is not data controller with respect to the submitted request, it shall notify the data subject on the person of the data controller. Where there are reasonable doubts concerning the identity of the natural person making the request, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

(ii) The controller shall provide information on action taken on a request to the data subject without undue delay and in any event within one month of receipt of the request. Information shall be provided by electronic means, unless otherwise requested by the data subject. If controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility on lodging a complaint with a supervisory authority and seeking a judicial remedy.

(iii) Data subject is entitled to lodge a complaint before a supervisory authority if he or she considers that the processing of personal data relating to him or her infringes the data protection regulation.