Data protection rights

Information for the exercise of data protection rights

Gibraltar data protection law grants a series of rights to all individuals. Staffy Gibraltar, to facilitate their exercise, informs you of their content, procedure and time limits.

Common to all rights:

• Their exercise is free of charge, save for manifestly unfounded or excessive requests.
• Requests are answered within one month, extendable by a further two months depending on the complexity and number of requests.
• You may exercise the rights directly or through a legal or voluntary representative.
• The processor may deal with your request on behalf of the controller, if so agreed.
• Where the processing is directed at minors, the digital consent age applicable in Gibraltar will apply [●].

How do I exercise the rights? By written request to the controller, Staffy Gibraltar, by any means admitted in law, indicating: identification (a valid document); where applicable, evidence of representation; the right exercised and the specifics of the request; an address for notices, the date and signature; and, where appropriate, supporting documents.

Content of the rights

Access. To know whether we process your data and, where applicable, to obtain a copy of it, the purposes, the recipients (including third countries), the retention period, the existence of the other rights, the origin of the data when not obtained from you, the existence of automated decisions and, in international transfers, the applicable safeguards. If you request more than one copy, a reasonable fee based on administrative costs may apply.

Rectification. To obtain the correction of inaccurate or incomplete data, indicating the data to be rectified and, where appropriate, providing supporting documentation. It will be carried out without delay and, at most, within one month.

Erasure (right to be forgotten). To request the deletion of your data when it is no longer necessary, when you withdraw consent and there is no other legal basis, when you object, when the processing is unlawful or when it must be deleted by legal obligation. This right has limits (freedom of expression and information, compliance with legal obligations, public interest, public health, archiving/research/statistical purposes, or the establishment and defence of claims).

Objection. To object to processing based on legitimate interest or on a task carried out in the public interest (including profiling), save for compelling grounds that override it or for the defence of claims; and to processing for direct marketing purposes, in which case we will stop processing your data for that purpose.

Restriction of processing. To request the suspension of the processing (while the contested accuracy or the merits of an objection are verified) or the retention of the data (when the processing is unlawful and you oppose erasure, or when it is no longer necessary but you need it for claims).

Portability. Where the processing is based on consent or on a contract and is carried out by automated means, to receive your data — or request its transmission to another controller — in a structured, commonly used, machine-readable and interoperable format.

Automated individual decisions. Not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or significantly affects you, save for the exceptions provided for; where applicable, you may request human intervention, express your point of view and challenge the decision.

Complaint. You may lodge a complaint with the Gibraltar Regulatory Authority (GRA) if you consider that your rights have not been properly addressed.

Web forms