4. How to exercise your rights or contact our DPO
4.1 Contacting our Data Protection Officer
If you wish to exercise any of the rights described below, or if you have any questions about this Privacy Policy or how Thoughtworks processes your personal data, please contact our Data Protection Officer:
Erin Francis Nicholson
Data Protection Officer
Email: privacyofficer@thoughtworks.com
4.2 Your rights
Depending on your location and the applicable data protection laws, you may have certain rights in relation to your personal data. These rights may include:
Right of access
You have the right to request confirmation as to whether we process your personal data and, where we do, to obtain access to that data together with information about the processing, including the purposes of processing, the categories of personal data involved, the entities with whom your personal data has been shared (or the categories of such entities), the applicable retention periods, and the safeguards applied to international data transfers, where applicable.
Right to rectification
You have the right to request that we correct inaccurate personal data or complete incomplete personal data relating to you.
Right to erasure and to withdraw your consent
You may request that we erase your personal data where permitted by applicable law, including where the personal data is no longer necessary for the purposes for which it was collected, where you withdraw your consent (where processing is based on consent), where you successfully object to the processing, or where the processing is otherwise unlawful.
Please note that this right is not absolute. We may retain personal data where necessary to comply with legal obligations, establish, exercise or defend legal claims, or for other lawful purposes permitted by applicable law.
Right to know the consequences of withholding consent
You also have the right to be informed about the possibility of refusing to provide your consent where consent is the legal basis for processing, as well as the consequences of such refusal.
Right to restriction of processing
You have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data, where the processing is unlawful but you oppose its erasure, or where you require the data for the establishment, exercise, or defense of legal claims. You may also request the anonymization, blocking, or deletion of personal data that is unnecessary, excessive, or processed in violation of applicable data protection laws.
Right to data portability
Where processing is based on your consent or on the performance of a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and, where technically feasible, to have that data transmitted directly to another controller.
Right to object
Where we process your personal data based on our legitimate interests, you have the right to object to such processing on grounds relating to your particular situation. We will stop processing your personal data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise, or defense of legal claims.
You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
Rights relating to automated decision-making
You have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning you or similarly significantly affects you, except where such processing is permitted by applicable law.
Where applicable, you also have the right to request human intervention, express your point of view, and contest the decision.
Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a competent supervisory authority, in particular in the country of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes applicable data protection laws.
If you are unsure which supervisory authority is competent, please see this directory.
Right to grievance redressal
Where recognized by applicable local law, you have the right to raise concerns or grievances regarding the processing of your personal data. We will acknowledge your complaint and work to resolve it within the statutory timeline under applicable local data protection laws.
Right to nominate
Where recognized by applicable local law, you may nominate an individual to exercise your privacy rights on your behalf in the event of your death or legal incapacity.
Right to limit transfer
Thoughtworks does not sell your data to third parties, nor does it “share” (as defined by the California Consumer Privacy Act) your data with third parties.