Rights of Data Subjects

The data subjects have rights by law and as specified in this regulation. Data subjects may seek to exercise their rights as specified below. Applications will be referred to the person responsible for the rights of data subjects, as specified in section 3.4. above.

• The right to access - a data subject is entitled, upon request, to receive an answer whether the University holds personal data about him or her, and to the extent that such personal data exists, he or she is entitled to receive a copy of that data. The data subject is entitled to receive details regarding the source of the personal data about him or her, the legal basis which served for collecting the data and processing it, the purposes of the collection and processing of the data, and the planned duration of saving the data, who holds the data, and what are his or her rights in relation to the data. This right will not apply in relation to personal data which the University is prohibited from transferring to the data subject in accordance with the provisions of any law.  

• The right to rectify personal data - to the extent that the personal data held by the University is not precise, the data subject is entitled to request its rectification, subject to other instructions that are likely to apply to the data.

• The right to deletion of personal data - a data subject is entitled to request deletion of the personal data regarding him or her held by the University, if one of the following terms applies:
   
  • When there is no longer need for the data for the purposes for which they were collected;
  • When the processing is done on the basis of the data subject’s consent, and he or she retracts this consent;
  • When the personal data has been attained or processed in an illegal manner or contrary to this regulation;
  • When the law requires deletion of the data.

The University will delete the personal data, unless it has a legitimate interest, or legal, ethical, social, or professional obligation not to do so, or reason in executing its regular functions in the course of its regular work.

• The right to limit use of the personal data - a data subject is entitled to request that the University limit the use of personal data about him or her, in the following instances:
   
  • If the data subject has requested rectification of the data, and as long as this request is under consideration by the University;
  • If processing the personal data is contrary to the instructions of the law or this regulation;
  • If the purpose for which the personal data was collected has been fulfilled, yet there is a legitimate purpose for the data to be retained by the University.

• The right to object to use of personal data - if the processing of the personal data was not done on the basis of informed consent, but rather on another legal basis, the data subject is entitled to request that the University ceases collecting and processing the personal data about him or her. Such a request will be considered by the DPO, in light of the instructions of the law, and with attention to the legitimate interests of the University.

• Data portability - a data subject is entitled to receive a copy of the personal data about him or her in a known format, and is entitled to request its transfer to another entity. The request, as stated, will be examined by the University in light of the instructions of the law, and according to the technological possibilities. This right will not apply in cases in which the processing of the personal data is required for the purpose of protecting public interest. The exercise of this right does not prevent the University from continuing to use the personal data about the data subject in cases in which it is permissible in accordance with the instructions of any law, and in order to actualize a legitimate interest (a valid purpose) of the University, or a legal, ethical, social, or public obligation.

• The right to retract consent - to the extent that processing the personal data is based on informed consent, the data subject is entitled to retract this consent at any time. The right to retract will apply from the time of receiving the notice at the University, and without diminishing from the legality of processing the personal data already conducted prior to receiving the notice of retraction of consent.

• The right to object to the creation of a behavioral profile - a data subject is entitled to object to processing the personal data for creating a behavioral profile of him or her by means of the processing of personal data, except in one of the following cases:
   
  • Based on the specific circumstances related to the case, when the basis for collecting personal data is the public interest or another legitimate interest of the University;
  • In cases in which the service provided is an online service;
  • When the purpose of creating the profile is scientific research, historic research, or for purposes of statistics, based on the specific circumstances related to the case, and this is in cases in which processing of the personal data is essential to executing the task at the base of which lies the public interest.

• The right to object to automatic decision-making procedures - when processing personal data has legal implications or other significant implications for the data subject, the data subject is entitled to object to the products of personal data processing automatically conducted about him.

• Submitting a complaint - a data subject is entitled to submit a complaint to the DPO regarding use of information about him and its processing.