CEDIA 'S PERSONAL DATA PROTECTION RIGHTS
The data subject has the right to be informed, in accordance with the principles of fairness and transparency, by any means, about: the purposes of the processing, the legal basis for the processing, the type of processing, the retention period, the existence of a database containing their personal data, the origin of the data when it has not been obtained directly from the data subject, further processing, the identity and contact details of the data controller and the data processor, national or international transfers or communications, the consequences for the data subject of providing or refusing to provide their personal data, the effect of providing erroneous or inaccurate personal data, the possibility of withdrawing consent, the existence and manner in which their rights can be exercised, mechanisms to exercise their right to data portability, the means and manner of making complaints to the data controller and the Personal Data Protection Authority, and the existence of automated assessments and decisions, including profiling.
The data subject has the right to know and obtain, free of charge, from the data controller access to all his personal data and the information detailed in the preceding article, without needing to provide any justification.
The data subject has the right to obtain from the data controller the rectification and updating of their inaccurate or incomplete personal data. To this end, the data subject must provide supporting documentation, where applicable.
The data subject has the right to have their personal data erased by the data controller when:
- The treatment does not comply with the principles established in this Law;
- The treatment is not necessary or relevant for the fulfillment of the purpose;
- Personal data have fulfilled the purpose for which they were collected or processed;
- The retention period for personal data has expired;
- The treatment affects fundamental rights or individual freedoms;
- Revoke the consent given or indicate that it was not given for one or more specific purposes, without the need for any justification; or,
- There is a legal obligation
The data subject has the right to object to or refuse the processing of their personal data in the following cases:
- It does not affect the fundamental rights and freedoms of third parties, it is permitted by law, and it is not public information, information of public interest, or information whose processing is mandated by law.
- The processing of personal data for direct marketing purposes; the data subject shall have the right to object at any time to the processing of personal data concerning him or her, including profiling; in which case the personal data shall no longer be processed for such purposes
- When consent is not required for processing due to the existence of a legitimate interest, and is justified in a specific personal situation of the data subject, provided that a law does not provide otherwise.
The data subject may request that the data controller transfer their personal data to another data controller as soon as technically feasible, and the controller may not raise any objection to delay access, transfer, or reuse of the data by the data subject or another data controller. Once the data transfer is complete, the receiving controller will delete the data, unless the data subject requests its retention.
The data subject may request the suspension of data processing when any of the following conditions are met:
- When the data subject disputes the accuracy of the personal data.
- The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of its use.
- The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defense of legal claims.
- When the data subject has objected to health treatment in accordance with the Law, while it is being verified whether the legitimate grounds of the controller prevail over those of the data subject.
The data subject has the right not to be subject to a decision based solely or partly on assessments resulting from automated processes, including profiling, which produce legal effects concerning him or her or which infringe his or her fundamental rights and freedoms.
The request submitted by the Data Subject or their Legal Representative will be processed in accordance with the timeframes and requirements established in the Organic Law on the Protection of Personal Data (LOPDP). The data controller must issue a response within a maximum period of fifteen (15) days, starting from the business day following receipt of the request.
Within the first five (5) days, the data controller may request clarifications, additional documentation, or the correction of incomplete information. In such case, the Data Subject or Legal Representative will have ten (10) days to submit the required information.
If the clarification is not submitted within the indicated timeframe, the application may be archived, with a reasoned notification being issued. This archiving does not limit the applicant's right to submit a new application when deemed necessary.
To guarantee the authenticity and validity of the procedure, the form must be submitted in one of the following ways:
- Printed form signed by hand by the Holder or their Legal Representative, accompanied by a legible copy of the identity card or passport.
- Form completed digitally and signed with a valid electronic signature in Ecuador
Applications may be submitted exclusively through the channels enabled by the organization, such as:
- Institutional email address: protecciondedatos@cedia.org.eccedia., intended for handling inquiries and requests regarding the protection of personal
- Authorized service points or designated in-person channels for the formal receipt of documents.
The personal data provided in this form will be used solely to manage and resolve your request, in accordance with the principles of lawfulness, purpose limitation, proportionality, and confidentiality. This information will not be shared with third parties, except when expressly required by law or by a competent authority.
For additional information on the processing of personal data, purposes, current policies, or details about the Data Protection Officer or Manager, the Data Subject may consult the organization's official information channels.
