PROTECTION OF PERSONAL DATA
The University of Primorska, as the controller, protects personal data and complies with applicable European and Slovenian regulations and international standards. The legal grounds are published on the University’s website.
What are personal data?
Personal data means any information relating to an identified or identifiable natural person, such as a name, a home address, a location (a phone may transmit its location), an online identifier (IP address), an email address, a phone number, etc.
What constitutes processing of personal data and when can personal data be processed?
Processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Personal data may only be processed if so required by law or if the relevant written consent is given.
Right of access of the data subject
The data subject has the right to obtain confirmation as to whether personal data concerning him or her are being processed and, in that case, access to the following information from the personal data record:
- the purpose of the processing,
- the categories of personal data,
- the recipients or categories of recipient to whom the personal data have been or will be disclosed,
- the retention period of the personal data,
- the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data or to object to processing,
- the right to lodge a complaint with a supervisory authority,
- where the personal data are not collected from the data subject, any available information as to their source,
- other data in accordance with the General Data Protection Regulation.
Right to rectification
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (”right to be forgotten”)
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay in the following cases:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
- the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing,
- the data subject objects to the processing (see Right to object),
- the personal data have been unlawfully processed,
- the personal data have to be erased for compliance with a legal obligation in Union and Republic of Slovenia law.
Erasure shall not be carried out if the processing of personal data is necessary:
- for exercising the right of freedom of expression and information,
- for compliance with a legal obligation which requires processing by law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
- for reasons of public interest in the area of public health,
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes,
- for the establishment, exercise or defence of legal claims.
Right to restriction of processing
The data subject shall have the right to obtain from the controller restriction of processing where:
- the accuracy of the data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,
- the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.
If the data subject has requested the restriction for the reasons stated, then the data may only be stored and all other types of processing may only be carried out:
- with the data subject’s consent,
- for the establishment, exercise or defence of legal claims,
- for the protection of the rights of another natural or legal person, or
- for reasons of important public interest of the Union or of the Republic of Slovenia.
The data subject shall be informed before the restriction of the processing of personal data is lifted (i.e. ceases to apply).
Notification obligation regarding rectification or erasure of personal data or restriction of processing
The controller shall communicate any rectification, erasure or restriction of processing to each recipient to whom the personal data have been disclosed, unless:
- this proves impossible, or
- involves disproportionate effort.
Right to data portability
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance where:
- the processing is based on consent or on a contract, and
- the processing is carried out by automated means.
The right to data portability shall only be admissible where technically feasible. The exercise of this right shall be without prejudice to the right to erasure.
The right to data portability shall not apply to processing necessary:
- for the performance of a task carried out in the public interest, or
- in the exercise of official authority vested in the controller.
Right to object
The University of Primorska does not process personal data for direct marketing purposes and there is no reason why a data subject should exercise his or her right to object at any time to processing of personal data concerning him or her for marketing purposes.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if he or she considers that the processing of personal data relating to him or her infringes the General Data Protection Regulation.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the General Data Protection Regulation.
As a data subject, you have the right to lodge a complaint with the Information Commissioner. The Information Commissioner shall inform you on the progress and the outcome of the complaint.
In accordance with the Personal Data Protection Act and Article 30 of the General Data Protection Regulation, the University of Primorska, as the controller of personal data, shall keep records of personal data processing activities, which specify the purpose of the processing, a description of the categories of data subjects, the categories of personal data and the retention period of the personal data.
Data Protection Officer at the University of Primorska
Data Protection Officer: Assoc. Prof. Miha Dvojmoč
Contact:
- Address: University of Primorska, Data Protection Officer – DPO, Titov trg 4, 6000 Koper, Slovenia
- Email: dpo@upr.si
You can send us your requests concerning your rights in relation to the processing of personal data or your complaints about the managing of personal data using the contact details provided.
