9.1 Our responsibility for your rights
9.1.1 In capacity of data controller, we are responsible for ensuring that your personal data is processed in compliance with the law and that you can exercise your rights. You may contact us at any time if you wish to exercise your rights. You will find the contact details at the end of this Privacy Notice.
9.1.2 We have an obligation to respond to your requests to exercise your rights without undue delay and in any event within one month of receiving your request. If your request is complex or if we have received many requests, we have the right to extend this deadline by two more months. If we are unable to take the action you request within one month, we will inform you of the reason for the delay and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
9.1.3 You will not be charged for any information, communication, or measures that we implement. However, if your request is manifestly unfounded or excessive, we may charge an administrative fee for providing the information or taking the action requested or refuse to act on your request altogether.
9.2 Your rights to access, rectification, erasure, and restriction
9.2.1 MSBase Members can independently access and rectify their personal data at any time by logging in to the private-access Membership area of the MSBase Registry Website by using their personal credentials.
9.2.2 You have the right to request:
9.2.2.1 Access to your personal data. This means that you have the right to request access to personal data that we hold about you. You also have the right to be provided, at no cost to yourself, with a copy of the personal data that we are processing. We have the right
to charge a reasonable administration fee if you request further copies. If you make a request in electronic form, e.g. via email, we will provide you with the information in a commonly used electronic format.
9.2.2.2 Rectification of your personal data. At your request or on our own initiative, we will correct, anonymise, delete, or complete data that we know to be inaccurate, incomplete, or misleading. You also have the right to complete any incomplete personal data if something relevant is missing.
9.2.2.3 Erasure of your personal data. You have the right to request that we delete your personal data if there is no compelling reason for us to continue processing the data. Personal data should therefore be erased if:
a) they are no longer needed for the purpose for which we collected them,
b) we process your data based on consent provided by you and you withdraw your consent,
c) you object to us processing your data after a legitimate interest assessment and we have no compelling interest that overrides your interests and rights,
d) we have processed the personal data unlawfully, or
e) we have a legal obligation to erase the personal data. However, there may be legal requirements or other compelling reasons that prevent us from immediately erasing your personal data. We will then stop processing your personal data for purposes other than compliance with the law or where there are no
compelling legitimate grounds for doing so.
9.2.2.4 Right to restrict processing. This means that we temporarily restrict the processing of your data. You have the right to request restriction when:
a) you consider your data to be inaccurate and you have requested rectification as defined in paragraph 9.2.2.2, while we establish the accuracy of the data,
b) the processing is unlawful, and you do not want the data to be erased,
c) as the personal data controller, we no longer need the personal data for our processing purposes, but you need them to be able to establish, exercise or defend a legal claim, or
d) you have objected to processing as defined in paragraph 9.3.1, while waiting for us to consider whether our legitimate interests override yours.
9.2.3 We will take all reasonable measures possible to notify everyone who has received personal data as stated in Section 7 above if we have rectified, erased or restricted access to your personal data after you have requested us to do so. If you request information on recipients of your personal data, we will inform you about the recipients.
9.3 Your right to object to processing
9.3.1 You have the right to object to the processing of your personal data if our processing is based upon legitimate interests or public task. If you object to such processing, we will only continue to process your data if we have compelling reasons for doing so that override your interests.
9.4 Your right to data portability
You have the right to data portability. This means the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that these data are transferred to another personal data controller. The right to data portability only applies when the processing is being carried out by automated means and our lawful basis for processing your data is your consent or for the performance of a contract between you and us.
9.5 Your right to object
You have the right to lodge a complaint with your local Data Protection Authority if you are not satisfied with our processing of your personal data.