GDPR Information
Your Rights Under the General Data Protection Regulation
Overview
The General Data Protection Regulation (GDPR) is a European Union regulation that protects the personal data and privacy of EU citizens. At OTIR, we are committed to respecting and protecting your data rights, regardless of where you are located.
Your GDPR Rights
1. Right to Access (Article 15)
You have the right to request access to your personal data. This includes the right to know what data we process, why we process it, and who we share it with.
How to exercise: Email us at [email protected] with the subject "GDPR Access Request".
2. Right to Rectification (Article 16)
You have the right to request correction of inaccurate or incomplete personal data. You can also update most of your information directly through your profile settings.
How to exercise: Log into your account and update your profile, or email us at [email protected] with the subject "GDPR Rectification Request".
3. Right to Erasure / "Right to be Forgotten" (Article 17)
You have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent.
How to exercise: Email us at [email protected] with the subject "Data Removal Request". Please note that we may need to retain certain information for legal or legitimate business purposes.
4. Right to Restriction of Processing (Article 18)
You have the right to request that we restrict the processing of your personal data under certain circumstances, such as when you contest the accuracy of the data or object to the processing.
How to exercise: Email us at [email protected] with the subject "GDPR Restriction Request".
5. Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
How to exercise: Email us at [email protected] with the subject "GDPR Data Portability Request".
6. Right to Object (Article 21)
You have the right to object to the processing of your personal data for certain purposes, including direct marketing, scientific research, or processing based on legitimate interests.
How to exercise: Email us at [email protected] with the subject "GDPR Objection Request".
7. Right to Withdraw Consent (Article 7)
Where we process your data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
How to exercise: You can withdraw cookie consent by clearing your browser cookies or emailing us at [email protected].
8. Right to Lodge a Complaint (Article 77)
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates GDPR regulations.
How to exercise: You can file a complaint with your local data protection authority. For EU residents, you can find your supervisory authority here.
Legal Basis for Processing
We process your personal data under the following legal bases:
- Consent: When you explicitly consent to data processing (e.g., accepting cookies)
- Contract Performance: When processing is necessary to provide our services to you (e.g., creating an account, managing assessments)
- Legitimate Interests: When we have a legitimate interest in processing your data (e.g., improving our services, security measures)
- Legal Obligation: When we must process data to comply with legal requirements
Data We Collect and Process
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Account Data: Retained while your account is active
- Assessment Data: Retained while your account is active and for a reasonable period after deletion
- Sponsorship Data: Retained for the duration of the sponsorship relationship
- Analytics Data: Google Analytics retains data for 26 months by default
- Backup Data: May be retained for up to 90 days in secure backups
Third-Party Data Sharing
We share data with the following third-party services:
- Google Analytics: For website usage analysis and improvement. Google Analytics may transfer data to the United States. You can opt-out using the Google Analytics Opt-out Browser Add-on.
- Hosting Providers: For secure data storage and website hosting.
We do not sell or rent your personal data to third parties. All third-party service providers are required to protect your data in accordance with GDPR standards.
International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA), including in the United States. We ensure that appropriate safeguards are in place for such transfers, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions by the European Commission
- Service providers' compliance with GDPR principles
Response Time
We will respond to your GDPR rights requests within one month of receiving your request. In complex cases, this period may be extended by two additional months, and we will inform you of such extension.
Contact Information
For any questions about your GDPR rights or to exercise any of your rights, please contact us:
Email: [email protected]
Data Removal Requests: Use subject line "Data Removal Request"
General GDPR Inquiries: Use subject line "GDPR Rights Request"
Additional Resources
- Privacy Policy - Detailed information about our data practices
- Official GDPR Website - Learn more about GDPR
- EU Data Protection Authorities - Contact information for supervisory authorities