Data Subject’s Rights

Subject to applicable law, you may have a number of rights regarding the processing of your personal data carried out by the Proraso Australia. In the General Data Protection Regulation (the “GDPR”), these rights are set out in Chapter III   (Rights of the data subject).  

The rights of the data subject translate into a number of obligations on organizations in relation to the processing of your personal data. Some of the rights also mean that you may actively file a request regarding your personal data. You can request to exercise the following rights at any time on this portal:

• The Right to Access: You have the right to request access to, or copies of, your personal data, together with information regarding the nature, processing and disclosure of that data (see GDPR article 15).
• The Right to Rectification (Correction): You have the right to request that any inaccuracies in your personal data are corrected and/or that incomplete data is completed when applicable (see GDPR article 16).
• The Right to Erasure (‘Right to be Forgotten’): You have the right to request that your personal data is erased (see GDPR article 17). The right is not absolute and only applies in certain circumstances.
• The Right to Restriction of Processing: You have the right to request restriction of processing of your personal data in certain circumstances (see GDPR article 18). This means that you can limit the way we use your data. This is an alternative to requesting the erasure of your data.
• The Right to Data Portability: You have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format. It also gives you the right to request that we transmit this data directly to another controller. The right only applies when the processing is based on your consent or for the performance of a contract, and the current processing of your data is carried out by automated means (see GDPR article 20).
• The Right to Object: You have the right to object to certain processing (including e.g. processing based on legitimate interest and processing for direct marketing purposes) (see GDPR article 21). Where you object to such processing, we must stop processing that data unless we have legitimate grounds to continue processing your data. This exemption does not apply where we process personal data for direct marketing purposes; if we receive an objection from you we must always stop processing data for these purposes.
• The Right to Object to Automated Decision-Making and Profiling: You have the right not to be subject to a decision taken without human intervention, including those based on profiling, that have a legal or similarly significant effect on you. This could for example be processing which uses algorithms to make decisions which significantly affect you (see GDPR article 22).

Where we process your personal data on the basis of your consent, you have the right to withdraw that consent (noting that such withdrawal does not affect the lawfulness of any processing performed prior to the date on which we receive notice of such withdrawal, and does not prevent the processing of your personal data in reliance upon any other available legal bases). You can use the option “I have a question or would like to file a complaint” in the DSR Form to withdraw your consent.

Submitting a request

The easiest way to exercise any of your rights is to enter your request in the Data Subject’s Right’s (“DSR”) Form on this portal. The DSR Form is designed in the following three steps:

1. Mandatory questions regarding:
   1. Which right(s) you request to exercise, or if you have a question or complaint.
   2. Your relationship with Proraso Australia, to help us ask you as few and as relevant detailed questions as possible in the following steps.
   3. Your name and contact information, to help us confirm your identity and contact you after receiving your request.
2. Questions based on which right(s) and relationship you selected in Step 1, to further help us identify you as soon as we receive your request.
3. More detailed questions regarding the right(s) you request to exercise, to directly help us understand your request in detail.

After submitting a request

The personal data you enter on this portal will be processed in accordance with our Privacy Notice for the purpose of handling and responding to as well as complying with your request. Only a small number of authorized personnel within Proraso Australia will have access your request(s) and any personal data which is accessed or otherwise processed to manage your request after you’ve submitted it.

After receiving your request, we will within a few days provide you with a Request ID (using the contact information you’ve provided). If you have any follow-up questions or wish to clarify, modify or cancel your request, please provide us with your Request ID.

As required under the GDPR, we will process your request as soon as possible and, where required under the GDPR, within one month; or within one to three months in the event of high levels of complexity and/or a large number of requests (see GDPR article 12). Please note that this time frame does not apply to general questions.

When we have processed and finalized your request (e.g. answered your question or provided you with the information you have requested), we will provide you with a closure notification (including any attachments when applicable) using the contact details you have provided us with. 30 days after providing you with the closure notification, your request will be permanently closed and any personal data in the request will be erased or anonymized (including any attachments when applicable) unless we have a valid reason to keep that data.

Further information 

For further information regarding the GDPR and the Data Subject’s Rights, please visit:

• The European Union’s official website for Data Protection and the GDPR:
  https://europa.eu/dataprotection
• The websites and contact details of all national Data Protection Authorities (DPA’s):
  http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
• The full official version of the GDPR in all 23 officially available languages:
  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679