Data Subject Rights Procedure

1. Purpose and scope

NOVARIC® supports individuals in understanding and controlling how their personal information is used. This procedure explains how to request information, obtain access, correct records, seek erasure or restriction, request portability, object to processing and raise concerns about automated decisions. It covers candidates, workers, employees, learners, clients, suppliers and other individuals whose personal information is processed.

Rights depend on the applicable law and the circumstances. The GDPR provisions described here apply to processing within its scope. Albanian processing is assessed under Law No. 124/2024 and applicable national requirements. This procedure does not reduce any right available under applicable law.

2. Responsible entity and processing roles

The NOVARIC® entity responsible for an activity must be identified in its privacy notice and relevant service or employment documentation. Recruitment, education, employment and website activities must be assessed separately. A common brand, shared system or cross-border referral does not automatically mean that entities are joint controllers.

Where entities jointly determine purposes and essential means, their responsibilities must be documented as required by applicable law, including an Article 26 arrangement where GDPR applies. Where NOVARIC® acts as a processor, it assists the controller under the applicable contract and law. Internal routing must not create unnecessary obstacles for individuals.

3. Making a request

You can make a request through the published contact channels of the NOVARIC® entity handling your activity. You may also raise it with the staff member assisting you, who must route it appropriately. No special form, legal terminology, complaint withdrawal or explanation of your motivation is required.

It helps to identify the activity, relevant dates and the outcome you seek, but assistance must remain available if you cannot provide these details. A representative may act for you, subject to proportionate checks of their authority and identity. Requests may be made in an accessible format; reasonable assistance is provided according to the circumstances.

4. Identity and secure delivery

NOVARIC® uses information already available where it provides sufficient assurance of identity. An identity-document copy is not required routinely. Where there are reasonable doubts about identity, additional information may be requested only to the extent necessary to resolve those doubts.

Verification takes account of the sensitivity of the information, the communication channel and the risk of disclosure to the wrong person. Extra checks must not be imposed solely because of nationality or regional origin. Verification information is protected and retained only for a justified purpose. Responses containing personal information are delivered using a suitably secure method agreed or explained to you.

5. Timing and progress

For requests governed by GDPR Articles 15–22, NOVARIC® responds without undue delay and normally within one calendar month of receipt. The period may be extended by up to two further months where necessary because of complexity or the number of requests. You must be informed within the initial month and given the reasons.

A request for clarification or identity information does not automatically restart the deadline. Any effect on timing must follow the applicable law and a documented assessment. NOVARIC® records receipt and tracks progress while resolving questions promptly. National deadlines are assessed separately where relevant.

6. Fees and refusal safeguards

Rights requests are normally handled without charge. Under GDPR Article 12(5), a reasonable fee reflecting administrative costs or a refusal may be permissible where a request is manifestly unfounded or excessive. NOVARIC® must demonstrate the basis for that decision; repeated requests are not automatically abusive.

Under Article 15(3), a reasonable administrative-cost fee may apply to further copies requested. These narrow exceptions do not authorise a blanket access fee. If a request is refused or limited, NOVARIC® explains the specific reasons and the available complaint and judicial-remedy rights within the applicable timeframe.

7. Transparent information

You are entitled to the information required by applicable law about processing, including the responsible controller, purposes and lawful basis, recipients, relevant transfers, retention, rights and complaint arrangements. Where required, information also explains the source of data and relevant automated decision-making.

Privacy information is provided at the times required by law, including the applicable rules for information collected directly and indirectly. Notices must be clear and accessible. A privacy notice is not a substitute for answering an individual access request.

8. Access to personal information

Where GDPR Article 15 applies, you may obtain confirmation whether your personal information is processed, access to that information and a copy, together with the required information about its use. Searches must consider relevant recruitment records, communications, assessments, systems and service-provider records within the controller’s responsibility.

Access covers personal information about you, including relevant opinions and inferred information, rather than only the documents you originally supplied. It does not automatically entitle you to every complete business document, but extracts or whole documents may be necessary to provide an intelligible and faithful copy. Context must not be removed where needed to understand the information. Transfer safeguards information is supplied where Article 15(2) applies.

9. Other people’s rights and proportionate redaction

Access is balanced against the rights and freedoms of others under applicable law. NOVARIC® assesses the actual information and risk, and considers partial disclosure, redaction or other measures before withholding information. A confidentiality label is not by itself a sufficient reason to refuse access.

Referee identities, staff names, mixed correspondence and third-party information are not automatically disclosed or automatically withheld. The decision is case-specific and must preserve access to your information as far as possible. Any legally permitted restriction must be supported by its applicable basis and scope.

10. Rectification

You may ask NOVARIC® to correct inaccurate personal information and complete incomplete information, taking account of the processing purpose. The review distinguishes factual inaccuracies from accurately recorded opinions or historical events. You may provide relevant evidence or a supplementary statement.

Where accuracy is contested, restriction is considered while the information is checked. Corrections must be applied to relevant operational copies and communicated to recipients where required. A corrected record must not continue to affect decisions through an outdated cache or system replica.

11. Erasure

You may request erasure where the applicable legal conditions are met, including where information is no longer necessary, processing is unlawful, or consent is withdrawn without another lawful basis. Erasure is assessed by category rather than treating every item in a dossier identically.

Certain information may need to remain for an applicable legal duty or other lawful exception, including legal claims. NOVARIC® explains any retained scope and its basis, and removes unnecessary information. Live-system deletion, protected backup expiry and provider action must be described accurately. The Data Retention & Erasure Policy governs the supporting disposal process and prevention of inappropriate reappearance after restoration.

12. Restriction of processing

Where GDPR Article 18 applies, you may seek restriction in the specified circumstances, including contested accuracy during verification, unlawful processing where you oppose erasure, your need for information for legal claims when it is no longer needed by the controller, or pending verification of an objection.

Restricted information is marked and technically protected against ordinary use. Apart from storage, processing is permitted only as allowed by the applicable provision. You are informed before restriction is lifted where required. A hidden interface record without effective controls does not establish restriction.

13. Data portability

Where GDPR Article 20 applies, portability concerns personal information you have provided where processing is based on consent or contract and is carried out by automated means. You may receive eligible information in a structured, commonly used and machine-readable format, and request direct transfer to another controller where technically feasible.

Portability has defined scope and must respect others’ rights. It does not cover every internally generated assessment or every record processed on another legal basis. NOVARIC® explains the eligible scope and any limitation. A portability request does not itself require deletion of the source record.

14. Objection and direct marketing

You may object on grounds relating to your particular situation to processing governed by GDPR Article 21(1), including applicable public-interest or legitimate-interest processing. NOVARIC® assesses whether compelling legitimate grounds override your interests, rights and freedoms, or whether processing is necessary for legal claims.

Where information is processed for direct marketing, you may object at any time, including to related profiling. Marketing processing covered by that objection must stop. A limited suppression record may be retained where necessary to respect the objection; it must not be used to continue marketing.

15. Withdrawing consent

Where processing relies on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before withdrawal. NOVARIC® identifies which activity relied on consent and stops that processing unless a genuinely applicable alternative basis permits or requires continued processing.

Withdrawal from an optional talent pool or marketing activity must not be treated as withdrawal from unrelated services. NOVARIC® must not switch legal basis merely to defeat a withdrawal or impose an unrelated penalty for exercising this right.

16. Automated decisions and profiling

Where GDPR Article 22 applies, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to its defined exceptions and safeguards. Permitted processing must meet the relevant conditions, including additional requirements for special-category information.

Where required, safeguards include meaningful human intervention, the opportunity to express your view and to contest the decision. A person merely confirming a model’s output is not meaningful review. Relevant information about the logic involved, significance and envisaged consequences must be intelligible. The presence of an AI tool does not mean every decision falls within Article 22; actual decision-making must be assessed.

17. Recipients, providers and cross-border processing

Where GDPR Article 19 applies, rectification, erasure or restriction is communicated to recipients unless impossible or involving disproportionate effort. On request, you are informed about those recipients. Processors must assist according to applicable arrangements; their involvement must not remove the controller’s accountability.

NOVARIC® distinguishes internal copies, processors, independent controllers and joint-controller activities. It explains relevant actions and limits without promising that every independent recipient has deleted all records. Transfers and provider copies are included in the assessment.

18. Complaints and escalation

You can challenge a response or raise concerns through the entity’s published channels. An internal complaint is not a prerequisite for approaching a supervisory authority or pursuing a judicial remedy. You do not have to withdraw a regulatory complaint, sign a gagging clause or abandon a service dispute to exercise your rights.

Competent authorities may include Malta’s Information and Data Protection Commissioner and Albania’s Information and Data Protection Commissioner, depending on the processing and applicable law. Competence is assessed for the activity; notification or complaint routing to both jurisdictions is not automatic.

19. Accountability and review

NOVARIC® must maintain evidence of receipt, assessment, searches, decisions and actions without unnecessarily retaining a duplicate personal dossier. Access to rights-case records is restricted and their retention is justified separately.

The procedure is reviewed following changes to law, services or systems and through a documented review cycle. Policy ownership, any DPO designation, actual adoption and implementation must be evidenced separately. The review draft remains a draft until an authorised decision assigns its effective date and release status.

How to contact us