Personal data controller: The Data Controller shall determine the purpose(s) for which and the manner in which any Personal Data is, or is to be, processed as per the General Data Protection Regulation (Directive 95/46/EC). The named Data Controller is Waterford Institute of Technology with its registered office at Main Campus, Cork Road, Waterford, Ireland.

Contact with the Data Controller and those responsible for data protection compliance of the project is possible in the following way:

  1. Post address: Waterford Institute of Technology, Main Campus, Cork Road, X91 K0EK Waterford, Ireland
  2. Email address: info@sstemm.eu

Data Protection Coordinator: WIT’s Data Protection Coordinator can be contacted by email: dataprotection@wit.ie

The purposes of processing and the legal basis of processing:

  1. The data controller processes User’s personal data only to ensure that Users may use the Application. Data will be held for a period of 6 years per GDPR compliance or data will be deleted upon completion of studies, whichever is shorter.
  2. The data controller processes the User’s personal data on the basis of consent given by the Users and in accordance with the applicable law.

The legal basis of processing of the User’s personal data as governed by Articles 6 and 9 per the General Data Protection Regulation (Directive 95/46/EC):

  1. Processing of the User’s personal data is needed for the operation of the Application – in the scope of the following data: personal reflections, stress signature scores
  2. the User’s consent to processing of its personal data – personal data are processed only on the basis of previously granted consent to the extent and purpose specified in the content of such consent.

Period of storage of personal data. The User’s personal data is stored on European data services for the period necessary to achieve the purposes set out in point 3 above. Data will be held for a period of 6 years per GDPR compliance or data will be deleted upon completion of studies, whichever is shorter.

Data recipients. The data controller will use a secure third party GDPR- compliant cloud hosting service (Amazon AWS). Data is stored in an encryption database. Only registered users can view their data. No third parties will be viewing the information stored.

User’s rights related to the processing of personal data and making automated decisions

The User has the following rights as the data subject:

  1. the right to access to personal data,
  2. the right to withdraw consent to personal data processing
  3. the right to request the rectification of personal data,
  4. the right to request the erasure of personal data (right to be forgotten),
  5. the right to request the restriction of the processing of personal data,
  6. the right to object to the processing of personal data due to specific situations,
  7. the right to personal data portability, i.e. the right to receive personal data in a structured, commonly used, machine-readable IT format. The User can send this data to another data controller or request that the Operator send such data to another data controller. However, the data controller will only do this if such transfer is technically possible.
  8. The right to portability personal data applies only to those data that are processed on the basis of a performance of a contract with the User or on the basis of the User’s consent. To exercise the above rights, please contact the data controller (contact details are stipulated in points 1 and 2 above). In a situation where the processing of personal data is based on the consent of the data subject, the provision of personal data by the User to the data controller is voluntary.

Providing personal data by the User is obligatory when the legal basis for processing of personal data is a legal provision or an agreement concluded between the parties.

  1. The right to withdraw consent. In so far as the User’s personal data is processed on the basis of the User’s consent – the User has the right to withdraw its consent to processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of the processing that was carried out on the basis of the consent given before such withdrawal. Consent may be withdrawn by sending a statement of withdrawal of consent to the post address or email address of the data controller.

Right to lodge a complaint with authority.If the User becomes aware of unlawful processing of personal data, the User also have the right to lodge a complaint with the supervisory authority dealing with personal data protection ie. The Irish Data Protection Commission (www.dataprotection.ie).