V. Use of cookies

1. Scope of data collection

Our site uses the types of cookies specified below. Cookies are small text files that sites visited by the user send to the user device, in which they are stored in order to be retransmitted to the same sites on the user next visit.

Technical cookies

These are cookies that are strictly necessary to enable:

• navigation and enjoyment of the website (“navigation or session cookies”);
• navigation according to a set of selected criteria (e.g., preferred language, etc. – “functionality cookies”) in order to improve the offered service.

LinkedIn:

Our site uses LinkedIn cookies and pixels to take advantage of LinkedIn services with the goal of improving the visitor experience on our site and obtaining useful data to analyze visitors use of our site and provide customized and targeted content. Should the users visit our site while being registered on their LinkedIn account, the latter company may associate the users data with their LinkedIn profile. Since LinkedIn does this processing, please refer to their privacy policy: https://www.linkedin.com/legal/privacy-policy.

Hotjar:

We use Hotjar’s services to improve our site and visitor experience with the goal of providing visitors with personalized content. Hotjar uses cookies to track visitors use of our site and provide us with aggregate analysis in this regard. As Hotjar performs such processing, reference is made to its privacy policy (https://www.hotjar.com/legal/policies/privacy/) and in particular to its statement of compliance with respect to the GDPR (https://www.hotjar.com/legal/compliance/gdpr-commitment/)

It is specified, however, that the data is anonymized before it is sent to Google, as the site is configured to implement IP anonymization before sending the data to Google.

2. Data processing legal basis

The legal basis for the processing of data collected via cookies, pixels or similar means is the consent given by the user in accordance with Article 6(1)(a) of the GDPR, as well as, where applicable, Article 6(1)(f).

3. Data processing purpose

The processing of personal data resulting from the use of cookies, pixels or similar means is intended to enable the operation of our website (technical cookies) as well as to improve our website in order to enhance the user browsing experience (Google Analytics cookies, LinkedIn cookies and pixels, Hotjar cookies).

4. Data storage duration

The data will be deleted as soon as it is no longer necessary to achieve the purposes for which it was collected. This normally occurs when the conversation ends. The conversation ends when it can be inferred from the circumstances that the relevant facts have been finally clarified.

5. Opposition options

The users have the option at any time to set their browser to automatically refuse to receive cookies by activating the appropriate option. Please refer to the relevant browser Help for instructions on how to make this setting. Please note, however, that failure to use technical cookies may result in difficulties interacting with this site.

1. Social media

Our site does not collect data related to the social media used by the user; however, should the user visits our site being at that time connected to their personal social media profiles, those social media (Facebook, Twitter, LinkedIn, Flickr…) may associate our site with the user personal profile. Accordingly, we encourage the user to consult the privacy policies of such social media or disconnect from them before accessing our site if they wish to avoid associations between our site and their social media.

VII. Data subjects rights

If the user personal data is processed, the users are considered data subjects under the GDPR and have the following rights vis-à-vis the data controller:

1. Right of access

The user can request confirmation from Rapitrad that personal data concerning them is being processed by the data controller.

Where such processing exists, the users may request information from the data controller regarding the following:

• The purposes for which personal data are processed;
• The categories of personal data being processed;
• The recipients or categories of recipients to whom the user personal data have been disclosed or are still being disclosed;
• The expected duration of storage of the user personal data or, if no concrete information is available in this regard, the criteria for determining the duration of storage;
• The existence of a right to rectification or erasure of the user personal data, a right to restrict processing by the data controller or a right to object to such processing;
• The existence of a right to lodge a complaint with a supervisory authority;
• All available information about the source of the data, where personal data has not been collected from the data subject;
• The existence of an automated decision-making process, including profiling as referred to in Article 22(1) and (4) of the GDPR and, at least in such cases, meaningful information about the logic used, as well as the importance and expected consequences of such processing for the data subject;
• Whether your personal data are transferred to a third country or to an international organization and what adequate safeguards are provided under Article 46 of the GDPR.

In case of data processing for scientific, historical or statistical research purposes, the right of access may be restricted to the extent that these risks making it impossible or seriously jeopardizing the achievement of these research or statistical purposes and such restriction is necessary for the achievement of these purposes.

2. Right of rectification

The user has the right of rectification and/or integration vis-à-vis Rapitrad in the event that processed personal data concerning the user is incorrect or incomplete. Rapitrad will carry out such rectification without delay, as soon as technically possible.

3. Right to limitation of processing

If one of the following occurs, the users may request the restriction of the processing of their personal data:

• if the user disputes the accuracy of their personal data, for the period necessary for the controller to verify the accuracy of such personal data, the processing of the data is restricted;
• the processing is unlawful and the users object to the deletion of their personal data and instead request that its use be restricted;
• although the data controller no longer needs it for the purposes of the processing, the personal data is necessary for the users to establish, exercise or defend a legal claim; or
• if the users have objected to the processing pursuant to Article 21(1) of the GDPR, pending verification as to whether the data controller legitimate grounds prevail over the user ones.

Where the processing of the users personal data has been restricted, such data may be used, with the exception of their storage, only with the users consent or for the establishment, exercise or defense of a legal claim or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State.

If the limitation of the processing occurs under any of the above assumptions, Rapitrad will inform the users prior to the revocation of such limitation.

4. Right to erasure

The users may request Rapitrad to delete their personal data immediately if any of the following reasons exist:

• The personal data about the users is no longer necessary for the purposes for which it was collected or otherwise processed.
• The users have withdrawn their consent on which the processing was based under Article 6(1)(a) or Article 9(2)(a) of the GDPR and there is no other legal basis to support the processing.
• The users object to the processing under Article 21(1) of the GDPR and there is no overriding legitimate ground for processing, or the users object to the processing under Article 21(2) of the GDPR.
• The users personal data has been processed unlawfully.
• The users personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the data controller is subject.
• Personal data relating to the users have been collected in connection with the provision of information society services referred to in Article 8(1) of the GDPR (children consent).

5. Right to be forgotten

If Rapitrad has disclosed personal data about the users and is obliged under the provisions of Section 4 of the listed assumptions to provide for its deletion, Rapitrad will take reasonable measures, taking into account available technology and the costs of implementation, to inform the data controllers of the subsequent processing of the data that the users have requested the deletion of all links to their personal data.

6. Exceptions to the right of erasure

The right to erasure does not exist if the processing is necessary:

• For the exercise of the right to freedom of expression and information.
• For the performance of a legal obligation requiring the processing provided for by Union or Member State law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
• For reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR.
• For purposes of archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1) of the GDPR, insofar as the right referred to in paragraph (a) is likely to render impossible or seriously undermine the attainment of the objectives of such processing. Or

7. Right to be informed

If the users have exercised their right to rectification, erasure or restriction of processing with respect to Rapitrad, we will communicate such rectification, erasure of data or restriction of processing to all entities to whom the users personal data have been disclosed, unless this proves impossible or is associated with disproportionate effort. Upon request, we will notify the recipient list to the users.

8. Right to data portability

The users have the right to receive their personal data provided to Rapitrad in a structured, commonly used and machine-readable format and to transmit it to another data controller, provided that

• The processing is based on consent within the meaning of Article 6(1)(a) of the GDPR, or Article 9(2)(a) of the GDPR, or on a contract within the meaning of Article 6(1)(b) of the GDPR; and
• The processing is carried out by automated means.

The users also have the right to request the transmission of their personal data directly from Rapitrad to another data controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be compromised by such an operation.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in connection with the exercise of official authority vested in the data controller.

9. Right to object

The users have the right at any time to object to the processing of their personal data that takes place pursuant to Article 6 paragraph 1 (e) or (f) of the GDPR; this also applies to profiling based on these legal provisions.

Following such objection Rapitrad will no longer process the personal data of the user unless there are compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

If the user personal data are processed for direct marketing purposes, the users shall have the right to object at any time to the processing of their personal data for such purposes; this also applies to profiling to the extent that it is associated with such direct marketing activity.

If the user objects to the processing for direct marketing purposes, the user personal data will no longer be processed for such purposes.

More detailed description of the possibilities to object.

If the user personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, the user shall also have the right to object to such processing.

The user right to object may be limited to the extent that doing so risks making it impossible or seriously jeopardizing the fulfillment of such research or statistical purposes and such limitation is necessary for the fulfillment of such purposes.

10. Right to withdraw the data protection consent

The users have the right to withdraw their data protection consent at any time. The withdrawal of such consent does not affect the legality of the processing carried out on the basis of consent up to the time of withdrawal.

11. Automated decision-making on an individual basis including profiling

The user has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the user or similarly significantly affects the user personally. This does not apply if the decision:

(1) is necessary for the conclusion or performance of a contract between the user and a data controller;

(2) is authorized by the law of the Union or the Member State to which the data controller is subject, which also specifies appropriate measures to protect the user rights, freedoms and legitimate interests; or

(3) is based on the user explicit consent.

In relation to the cases referred to in (1) and (3), Rapitrad implements appropriate measures to protect the user rights (IP anonymization prior to the use of Google Analytics), freedoms and legitimate interests, at least the right to obtain human intervention by the data controller, to express their opinion and to challenge the decision.

Where such decisions are based on the use of special categories of personal data within the meaning of Article 9(1) of the GDPR, the exceptions listed above apply only if Article 9(2)(a) or (g) of the GDPR applies and reasonable steps have been taken to protect the user rights and freedoms as well as their legitimate interests.

12. Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, the users have the right to lodge a complaint with the supervisory authority, in particular in the Member State where the user normally reside, where they work or where the alleged breach occurred, if the users believe that the processing of their personal data violates the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

Further information and explanations of the rights mentioned are available on the European Commission “Citizens’ Rights” website.