Personal data

Personal data is any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Person affected

Person concerned is any identified or identifiable natural person whose personal data are processed by the controller.

Processing

Processing is any operation or set of operations, carried out with or without the aid of automated means, concerning personal data such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, cancellation or destruction.

Restriction of processing

Limitation of processing is the marking of stored personal data with the aim of limiting their future processing.

Profiling

Profiling is any type of automated processing of personal data consisting in the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the job performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or change of location of that natural person.

Pseudonymization

Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the need for additional information, provided that this additional information is kept separately and is subject to technical and organisational measures which ensure that the personal data is not attributed to an identified or identifiable natural person.

Controller or data controller

The responsible person or controller is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union law or by the law of the Member States, the controller or the specific criteria for his nomination may be provided for by Union law or by the law of the Member States.

Contract processor

Processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

Recipient

Recipient is a natural or legal person, authority, institution or other body to whom personal data is disclosed, whether or not it is a third party. However, public authorities which may receive personal data in the context of a specific investigation mandate under Union or national law shall not be considered as recipients.

Third party

Third party means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.

Consent

Consent is any freely given, informed and unequivocal expression of will by the data subject in a specific case, in the form of a declaration or other unequivocal affirmative act by which the data subject signifies his or her consent to the processing of personal data relating to him or her.