Privacy Policy | UNEW Academy

1. Responsibility

Responsible for processing personal data is UNEW Beauty Couture AG, Sinserstrasse 8, 6330 Cham, Switzerland. This Privacy Policy applies to websites, forms, bookings, trainings, treatments, newsletters, communication, online offers, social media and physical offers.

2. Data protection contact

For questions or data subject requests, contact info@unew.ch.

3. Categories of data

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

4. Purposes

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

5. Legal bases

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

6. Websites, server logs and hosting

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

7. Contact and communication

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

8. CRM, customer management and Shopify

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

9. Trainings, treatments and Academy services

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

10. Newsletter and email marketing

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

11. Cookies and consent

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

12. Google Analytics and web analysis

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

13. Meta, TikTok, YouTube and online marketing

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

14. Social media profiles and plugins

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

15. YouTube videos

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

16. TikTok

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

17. Payment processing

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

18. Credit checks and collection

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

19. Reviews, comments and testimonials

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

20. Video surveillance in the institute

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

21. Disclosure to third parties

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

22. International transfers

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

23. Retention period

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

24. Data security

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

25. Rights of data subjects

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.

26. Changes to this Privacy Policy

UNEW processes personal data in accordance with Swiss data protection law and, where applicable, the GDPR. Depending on the interaction, this may include master data, contact data, contract and payment data, communication data, technical data, marketing preferences, image/video data from video surveillance and voluntarily provided information relevant to treatments or trainings. Processing is carried out for website operation, inquiries, bookings, trainings, treatments, payment, credit checks, support, newsletters, analytics, marketing, security, legal duties and enforcement of rights. Service providers such as hosting, IT, Shopify/CRM, payment, newsletter, Google Analytics, Meta, TikTok, YouTube, social media, logistics, advisors, collection agencies, insurers and authorities may receive data where required. Non-essential cookies and tracking technologies are activated only with consent where legally required. Video surveillance may be used in the institute for safety and abuse prevention; it is marked on site, limited to necessary areas and evaluated only when required. Data may be processed in Switzerland, the EEA or other countries with appropriate safeguards or legal exceptions. Data subjects may exercise statutory rights including access, rectification, erasure, restriction, objection and withdrawal of consent.