If your personal data is being processed, you are considered a data subject under the GDPR. This grants you the following rights in relation to the data controller:

Right of Access

You have the right to request confirmation from the controller as to whether we are processing your personal data. If we are, you can request access to this personal data free of charge at any time, along with the following information:

a)    the purposes of the processing;

b)    the categories of personal data being processed;

c)     the recipients or categories of recipients to whom your personal data has been or will be disclosed;

d)    the planned storage period for your personal data or, if specific details cannot be provided, the criteria used to determine this period;

e)    your right to request the rectification or erasure of your personal data, your right to restrict its processing by the controller, or your right to object to such processing;

f)     your right to lodge a complaint with a supervisory authority;

g)    any available information regarding the source of the data, if it was not collected directly from you;

h)    the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR, and—at least in these cases—meaningful information about the logic involved, as well as the significance and envisioned consequences of such processing for you.

You also have the right to know whether your personal data is transferred to a third country or an international organization. In this case, you can request to be informed of the appropriate safeguards in place under Article 46 of the GDPR regarding the transfer.

Right to Rectification

You have the right to have any inaccurate or incomplete personal data concerning you corrected or completed by the controller without delay.

Right to Restriction of Processing

You can request that the controller restrict the processing of your personal data under the following conditions:

a)    if you contest the accuracy of your personal data, for a period enabling the controller to verify its accuracy;

b)    if the processing is unlawful and you oppose the erasure of the personal data, requesting instead that its use be restricted;

c)     if the controller no longer needs the personal data for processing, but you require it to establish, exercise, or defend legal claims; or

d)    if you have objected to the processing pursuant to Article 21(1) of the GDPR, pending verification of whether the controller’s legitimate grounds override yours.

Where processing has been restricted, such data—apart from storage—may only be processed with your consent, to establish, exercise, or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the EU or a Member State. If processing has been restricted under these conditions, the controller will inform you before the restriction is lifted.

Right to Erasure

You can request the controller to delete your personal data without delay if one of the following reasons applies:

a)    Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.

b)    You withdraw the consent on which the processing was based under Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.

c)     You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing for direct marketing purposes pursuant to Article 21(2) of the GDPR.

d)    Your personal data has been processed unlawfully.

e)    Your personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject.

f)     Your personal data was collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

If the controller has made your personal data public and is required to erase it under Article 17(1) of the GDPR, they will take reasonable steps—including technical measures, considering available technology and implementation costs—to inform other controllers processing the data that you have requested the deletion of any links to, or copies or replications of, that personal data.

The right to erasure does not apply if the processing is necessary:

a)    for exercising the right of freedom of expression and information;

b)    for compliance with a legal obligation under Union or Member State law to which the controller is subject, or for performing a task carried out in the public interest or in the exercise of official authority vested in the controller;

c)     for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;

d)    for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) of the GDPR, insofar as the right referred to in section (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

e)    for the establishment, exercise, or defense of legal claims.

Right to Notification

If you have exercised your right to rectification, erasure, or restriction of processing, the controller is required to communicate this to each recipient to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about who these recipients are.

Right to Data Portability

You have the right to receive the personal data you provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the data was originally provided, provided that:

a)    the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR; and

b)    the processing is carried out by automated means.

In exercising this right, you can also request that your personal data be transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

To exercise your right to data portability, you can contact the data controller at any time.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.

The controller will stop processing your personal data unless they can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing is necessary to establish, exercise, or defend legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

In the context of the use of information society services—and notwithstanding Directive 2002/58/EC—you may exercise your right to object by automated means using technical specifications.

To exercise your right to object, you can contact the data controller directly.

Right to Withdraw Consent

You have the right to withdraw your consent to data processing at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out before the withdrawal. You can contact the controller to exercise this right.

Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

a)    is necessary for entering into, or performing, a contract between you and the controller;

b)    is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights, freedoms, and legitimate interests; or

c)     is based on your explicit consent.

However, these decisions must not be based on special categories of personal data referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and suitable measures to safeguard your rights, freedoms, and legitimate interests are in place.

In the cases referred to in points (1) and (3), the controller will implement suitable measures to safeguard your rights, freedoms, and legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

If you wish to exercise your rights regarding automated decision-making, you can contact the data controller at any time.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR. The supervisory authority with which the complaint has been lodged will keep you updated on the progress and outcome of your complaint, including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.