LITTLE SCIENTISTS WORKSHOPS LTD (HE 458570) (hereinafter “We/Us/Our”) understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of Our customers and will only collect and use personal data in a lawful and transparent manner, as set out in Our Privacy Policy, available on https://littlescientists.com.cy/ (hereinafter “Our Website”);.

As a ‘data subject’ you (the parent(s) of the child, and the child(s), the names of which appear on the registration form submitted at the time of Your registration with Us) (hereinafter “You/Your”) have a number of rights under the law with respect to Our use of Your personal data. This policy explains those rights and how to exercise them.

1. Information About Us
2. LITTLE SCIENTISTS WORKSHOPS LTD, is a private limited liability company by shares, incorporated and existing under the laws of the Republic of Cyprus, registered with the Registrar of Companies of the Republic of Cyprus under number HE 458570, having its registered office at Iakovou Katsounotou 6, Nea Ekali, P.C. 3112 Limassol, Cyprus.
3. We are the legal and beneficial owner of the domain name of Our Website and We are the sole operator of Our Website.
4. Our email address is: info@littlescientists.com.cy.
5. Our telephone number is: 0035795155555.
6. Our postal address is: Iakovou Katsounotou 6, Nea Ekali, P.C. 3112 Limassol, Cyprus.

1. What Does This Policy Cover?

1. Under data protection law in the Republic of Cyprus, including key legislation such as the Regulation (EE) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), which applies as of 25 May 2018 (hereinafter the “GDPR”) and Law 125(I)/2018 of the Republic of Cyprus and any successor legislation or regulation (collectively, “the Data Protection Legislation”), individuals have important rights designed to protect them and their personal data.
2. This Policy sets out those rights, explains them in clear terms, and provides guidelines on how to exercise them.

1. What Is Personal Data?

1. Personal data is defined by the Data Protection Legislation as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
2. In simpler terms, personal data is any information about You that enables You to be identified. Personal data covers obvious information such as Your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers. The personal data that We use is set out in Our Privacy Policy.

1. What Are My Rights? (Summary)

1. The GDPR sets out Your key rights as a ‘data subject’ as follows:
   1. 1. 1. 1. 1. The right to be informed;
               2. The right of access;
               3. The right to rectification;
               4. The right to erasure;
               5. The right to restrict processing;
               6. The right to data portability;
               7. The right to object; and
               8. Rights in relation to automated decision-making and profiling.

1. The following sections of this Policy explain each right in more detail. If You have any questions about any of Your rights under the Data Protection Legislation, or require more detailed information, please contact Us or the Commissioner for Personal Data Protection of the Republic of Cyprus.

1. The Right to Be Informed

1. You have the right to be informed about Our collection and use of Your personal data. The information We provide must include details of the purpose or purposes for which Your data is used, how long We keep it, and who (if anyone) it may be shared with.
2. This important privacy information is provided in Our Privacy Policy. Additional information about Your rights is also provided here, in this Policy.
3. If We collect data directly from You, this privacy information will be provided at the time it is collected. We will ask You to read Our Privacy Policy and indicate that You have read and agreed with it when registering with Us.
4. If We collect data about You from a third party, this privacy information will be provided to You as soon as possible and in any event no later than 1 (one) month after We have obtained that data.

1. The Right of Access

1. This right, also known as ‘subject access’ gives You the right to obtain a copy of any personal data that We may hold about You as Well as other supporting information.
2. This right is designed to help You understand how and why We use Your data, and to check that We are using it lawfully.
3. You can exercise this right by making a ‘subject access request’. A subject access request can be made orally or in writing and although the more detail You can provide, the easier it will be for Us to respond quickly, there is no prescribed format for such requests.
4. We are required to respond to a subject access request within 1 (one) calendar month of receipt (or, where We request proof of identification or a fee (see below), within one calendar month of receipt of that). We may also need to ask You for further information to understand the scope and nature of Your request, and if We do so, the time limit for Our response will be paused until You provide the necessary clarification. In certain limited cases, such as where Your request is complex or You have made multiple requests, this period may be extended by up to 2 (two) months; however, You will be kept informed at all times.
5. Normally there is no fee payable for a subject access request. For ‘manifestly unfounded or excessive’ requests, however, We are permitted to charge a ‘reasonable fee’ that covers Our costs.

1. The Right to Rectification

1. Under the Data Protection Legislation, You have the right to have inaccurate personal data corrected, or incomplete personal data completed.
2. As a ‘data controller’ We are required to take all reasonable steps to ensure that personal data We hold is accurate and, where necessary, kept up-to-date. Your right to rectification is closely tied to this obligation.
3. You can exercise this right by contacting us and asking for Your data to be rectified if You believe it is incorrect, out-of-date, or incomplete. Requests for rectification can be made orally or in writing.
4. We are required to respond to a request for Your personal data to be rectified within 1 (one) calendar month of receipt. In certain limited cases, for example, where Your request is complex or You have made multiple requests, this period may be extended by up to 2 (two) months; however, You will be kept informed at all times.
5. Normally, there is no fee payable for having Your personal data rectified. For ‘manifestly unfounded or excessive’ requests, however, We are permitted to charge a ‘reasonable fee’ that covers Our costs. Alternatively, in some limited circumstances, We may be permitted to refuse Your request.

1. The Right to Erasure

1. This right is also known as the ‘right to be forgotten’ and gives You the right to have Your personal data deleted (or ‘otherwise disposed of’ if, for example, it is kept in paper records rather than electronically).
2. You can exercise this right by contacting Us and asking for Your data to be erased. Requests for erasure can be made orally or in writing.
3. We are required to respond to a request for Your personal data to be erased within 1 (one) calendar month of receipt. In certain limited cases, for example, where Your request is complex or You have made multiple requests, this period may be extended by up to 2 (two) months; however, You will be kept informed at all times.
4. Normally, there is no fee payable for having Your personal data erased. For ‘manifestly unfounded or excessive’ requests, however, We are permitted to charge a ‘reasonable fee’ that covers Our costs. Alternatively, in some limited circumstances, We may be permitted to refuse Your request.
5. Please note that the right to erasure is not an absolute right and there are certain circumstances set out in the Data Protection Legislation in which the right does not apply. For example, We may not have to erase Your personal data if We need it to comply with a legal obligation. If any of these circumstances apply, We will explain why Your personal data cannot be erased when responding to Your request for erasure.

1. The Right to Restrict Processing

1. You have the right to request the restriction or suppression of Your personal data. In practice, this is an alternative to having Your personal data erased. This means that You can limit the way in which We Use Your personal data, while still allowing Us to retain it.
2. Please note that the right to restrict processing is not an absolute right and only applies in certain circumstances as follows:
   1. 1. 1. 1. 1. You have contested the accuracy of Your personal data and We are verifying the accuracy of it;
               2. Your personal data has been processed unlawfully and You want Us to restrict processing rather than erasing Your personal data;
               3. We do not need the personal data any more, but You need Us to keep it in order to establish, exercise, or defend a legal claim; or
               4. You have exercised Your right to object (see Article 11, below), and We are considering whether Our legitimate grounds for processing Your personal data override Your right to object to Us using it.

1. When processing is restricted, We cannot do anything with Your personal data other than store it unless We have Your consent to do so or unless one of the following applies:

1. 1. 1. 1. 1. 1. We need to Use Your personal data in the establishment, exercise, or defence of legal claims;
               2. We need to Use Your personal data in order to protect the rights of another person; or
               3. Important public interest reasons justify using it.

1. You can exercise this right by contacting Us and asking for the processing of Your data to be restricted. Requests for the restriction of processing can be made orally or in writing.
2. We are required to respond to a request to restrict the processing of Your personal data within 1 (one) calendar month of receipt. In certain limited cases, for example, where Your request is complex or You have made multiple requests, this period may be extended by up to 2 (two) months; however, You will be kept informed at all times.
3. Normally, there is no fee payable for having the processing of Your personal data restricted. For ‘manifestly unfounded or excessive’ requests, however, We are permitted to charge a ‘reasonable fee’ that covers Our costs. Alternatively, in some limited circumstances, We may be permitted to refuse Your request.

1. The Right to Data Portability

1. Where We are processing Your personal data either with Your consent or for the performance of a contract between Us, and We are using automated means of processing (i.e. not using paper files), You have the right to obtain a copy of Your personal data in a commonly-Used format for Use with another organisation. You can also request that We send Your personal data directly to another organisation.
2. This right is designed to enable You to easily move, copy, or transfer Your personal data from one organisation’s IT system to another organisation’s IT system in a safe and secure way, without affecting its Usability.
3. Please note that this right only applies to personal data that You have provided to Us. This includes information that We may obtain from Your activities on Our Website and with Us. It does not include additional data that We may create based upon the data You have provided or to data that has been anonymised. In some cases, more personal data relating to You may be available under Your right of access (see Article 6, above).
4. You can exercise this right by contacting Us and asking either for a copy of Your personal data for Use with another organisation, or for Your personal data to be transferred to that organisation. Requests can be made orally or in writing.
5. We are required to respond to Your request within 1 (one) calendar month of receipt. In certain limited cases, for example, where Your request is complex or You have made multiple requests, this period may be extended by up to 2 (two) months; however, You will be kept informed at all times.
6. Normally, there is no fee payable for exercising Your right to data portability. For ‘manifestly unfounded or excessive’ requests, however, We are permitted to charge a ‘reasonable fee’ that covers Our costs. Alternatively, in some limited circumstances, We may be permitted to refuse Your request.

1. The Right to Object

1. Where We are processing Your personal data either on the basis of Our ‘legitimate interests’ or in the performance of a task carried out in the public interest, You have the right to object to Us processing Your personal data.
2. You also have the absolute right to object to Us using Your personal data for direct or other marketing purposes.
3. If You object to Us using Your personal data for direct or other marketing purposes, Your right to do so is absolute and We have no grounds on which to refuse.
4. If You object to Us using Your personal data either on the basis of Our ‘legitimate interests’ or in the performance of a task carried out in the public interest, please note that Your right to do so is not absolute. When making Your request to exercise this right, You must give specific reasons for Your objection based upon Your particular situation. We can continue using Your personal data if We can demonstrate ‘compelling legitimate grounds’ which override Your interests, rights, and freedoms; or if the processing is necessary for the establishment, exercise, or defence of legal claims. Additional limitations apply if Your personal data is being processed for research purposes.
5. You can exercise this right by contacting Us and stating Your objection to the processing of Your personal data for the relevant purpose or purposes, providing an explanation if required (see previous paragraph). Objections to processing can be made orally or in writing. You can also object to Our processing of Your child's photos/videos for direct or other marketing purposes by choosing “NO” at the respective field of the registration form You submit to Us.
6. We are required to respond to Your request within (1) one calendar month of receipt. In certain limited cases, for example, where Your request is complex or You have made multiple requests, this period may be extended by up to 2 (two) months; however, You will be kept informed at all times.
7. Normally, there is no fee payable for exercising Your right to object. For ‘manifestly unfounded or excessive’ requests, however, We are permitted to charge a ‘reasonable fee’ that covers Our costs. Alternatively, in some limited circumstances, We may be permitted to refuse Your request.

1. Automated Decision-Making (Including Profiling)

1. We do not carry out automated decision-making (i.e. making a decision using automated means only, without any human involvement) using Your personal data.

1. Exercising Your Rights

1. To exercise any of Your rights as a data subject, please contact Us via:

• Email: info@littlescientists.com.cy;
• Post: Iakovou Katsounotou 6, Nea Ekali, P.C. 3112 Limassol, Cyprus;
• Telephone: 0035795155555.

1. When contacting Us to exercise Your right of access, please Use the Subject Access Request Form available on Our Website:

• Your full name;
• Your address;
• Your telephone number;
• Your email address; and
• Details of the information being requested.

1. When contacting Us to exercise Your right to rectification, please provide:

• Your full name;
• Your address;
• Your telephone number;
• Your email address;
• Details of the information You wish to have rectified; and
• (Where relevant) any information that supports Your request or otherwise provides evidence of the need for rectification.

1. When contacting Us to exercise Your right of erasure, please provide:

• Your full name;
• Your address;
• Your telephone number;
• Your email address;
• Details of the information You wish to have erased; and
• (Where relevant) any information that supports Your request or otherwise justifies the need to have the data erased.

1. When contacting Us to exercise Your rights to restrict processing or to object to processing, please provide:

• Your full name;
• Your address;
• Your telephone number;
• Your email address;
• Details of the processing You wish to restrict or object to;
• Details of why You want the processing to be restricted or why You object to it; and
• (Where relevant) any information that supports Your request or otherwise provides evidence of the need for processing to be restricted or stopped.

1. When contacting Us to exercise Your right to data portability, please provide:

• Your full name;
• Your address;
• Your telephone number;
• Your email address;
• Details of the personal data You wish to Use with another service or organisation, also stating whether You require a copy of that data for Yourself or whether You would like Us to transfer it directly to the other service or organisation; and
• (Where relevant) any information that supports Your request.

1. Our Acknowledgement and Response

1. We will always respond quickly to Your request to exercise any of Your rights in relation to Your personal data. We will acknowledge receipt without undue delay and will provide a complete response to Your request as quickly as possible. Normally, as stated above, this will be within 1 (one) calendar month of receipt of Your request. If additional time is required, We will contact You within the first calendar month to explain why the delay is necessary.

1. Your Right to Complain

1. If You have any cause for complaint about Our Use of Your personal data, or about Our handling of Your request to exercise Your rights under this Policy, You have the right to lodge a complaint with the Commissioner for Personal Data Protection of the Republic of Cyprus.
2. We would welcome the opportunity to resolve Your concerns Ourselves, however, so please contact Us first using the details set out above in Article 13 hereinabove.

1. Changes to this Policy

1. We may change this Policy from time to time. This may be necessary, for example, if the law changes, or if We change Our business in a way that affects personal data protection.
2. If a change is material We will try to provide at least 30 (thirty) calendar days’ written notice prior to any new terms taking effect. What constitutes a material change will be determined at Our sole discretion. During this time, if You do not agree with the notified changed, You may terminate Our contract with a written notice of immediate effect to be provided to Us within Our notice period.
3. By continuing to use our Service after those changes become effective, You agree to be bound by the revised terms.