The GDPR provides for enhanced rights and MSC Cruises is committed to giving you the appropriate control of your own personal data.
In particular, you have the following rights in connection to your personal data:

a. The right to access your personal data and obtain specific information about how we process it, in accordance with Article 15 GDPR; please be aware that you can only exercise this right in relation to your own data or to the data of a minor or another vulnerable person, where you have provided such data as a holder of parental authority or legal responsibility. MSC Cruises reserves the right to ask for proof of identity, as well as to refuse to provide the personal data if the identity or relevant connection to the data subject cannot be proven.

b. The right to rectify your personal data, in accordance with Article 16 GDPR, including by means of providing a supplementary statement.

c. The right to obtain the erasure of personal data concerning you, in accordance with Article 17 GDPR, unless the data are necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing by Union or Member State law to which MSC Cruises is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9.2 as well as Article 9.3 GDPR; or for the establishment, exercise or defence of legal claims.

d. The right to obtain the restriction of the processing of your personal data. In accordance with Article 18 GDPR, this right may be exercised in the following cases:
• Temporary restriction, where you are contesting the accuracy of the personal data; in this case, we will restrict the processing of your data for a period enabling us to verify the accuracy of your data and we will provide feedback to you as to the lifting of the restriction;
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• MSC Cruises S.A. no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
• Where you have objected to processing pursuant to Article 21.1 GDPR, the processing is restricted pending the verification whether our legitimate grounds override your rights as data subject.

e. The right to data portability. In accordance with Article 20 GDPR, you may exercise this right in those cases where the processing is based on your consent or on your contractual relationship with MSC Cruises S.A. or one of the companies of our group, and the processing is carried out by automated means.

f. The right to object, at any time, to the processing of the personal data concerning you. In accordance with Article 21 GDPR, you may exercise this right where the processing is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in us, or where the processing is based on our legitimate interests.

g. The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which similarly significantly affects you. In accordance with Article 22 GDPR, you may exercise this right unless the processing is necessary for entering into, or performance of, a contract between you and MSC Cruises S.A. or one of the companies of our group; or is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or if the processing is based on the your explicit consent.

h. The right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to him or her infringes this Regulation, in accordance with Article 77

Please find the list of all European Data Protection Supervisory Authorities at the following link: http://ec.europa.eu/justice/article- 29/structure/data-protection-authorities/index_en.htm

To exercise your data subject rights, please write an email to privacyhelpdesk@msccruises.com. Requests may also be sent in writing to MSC Cruises S.A., Avenue Eugène-Pittard 16, Geneva, Switzerland; in that case, please specify “For the Attention of the Data Protection Officer” on the envelope.