1. Right to access

You have the right to obtain communication of the data undergoing processing and to obtain rectification from the Controller, who shall provide you with access facilitating the following information:

• The purposes of processing.
• The categories of data being processed.
• The period or criteria for their conservation.

2. Right to rectification

You shall have the right to correct or delete incorrect data concerning them by means of providing a supplementary statement.

3. Right to erasure

You will have the right to have your data deleted, when:

• The personal data have been unlawfully processed.
• The data subject withdraws consent on which the processing is based.
• The personal data are no longer necessary in relation to the purposes for which they were collected.
• The data subject has objected to the processing and there are no overriding legitimate grounds for the processing.
• The personal data have to be erased for compliance with a legal obligation to which the controller is subject.

You will not have the right to have your data deleted, when the processing is necessary:

• For exercising the right of freedom of expression and information.
• For compliance with a legal obligation to which the controller is subject.
• For the establishment, exercise or defence of legal claims.
• For purposes in the public interest based on current legislation for reasons of pubic health, scientific or historical research purposes or statistical purposes.

4. Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format, when the processing has been carried out by automated means, and is based on:

• The consent of the data subject for specific purposes.
• The execution of a contract or pre-contract with the data subject.

The right to data portability shall not apply when:

• The transmission is not technically feasible.
• It could have a negative effect on the rights and freedoms of third parties.
• The processing is in the public interest based on current legislation.

5. Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

• Direct marketing.
• Profiling.
• The purpose of the processing or assignment is to satisfy a legitimate interest of the data controller, as long as they do not override the interests or fundamental rights and liberties of the data subject, especially if the data subject is a minor.
• Historical, statistical or scientific research purposes, except if the processing is necessary for reasons of public interest.

Although the data subject may oppose their data, the controller may continue to process them as long as the legitimate interest of the controller does not override the interests or rights and freedoms of the data subject in a legal procedure, which justifies it.

The controller must inform the data subject of their right to oppose the processing of their data clearly and separately from any other information at the moment of the first notification.

6. Right to object

The right to object to the processing of your data, or have it stopped when your consent is no longer necessary for the processing, as a result of a legitimate and grounded reason, referring to your specific personal situation which justifies it, unless otherwise provided by law.

7. Automated individual decision-making, including profiling

You will have the right to not be the subject of profiling, the purpose of which is to adopt individual decisions based on the automated processing of data and intended for evaluating, analysing and predicting the following personal aspects:

• Professional performance.
• Financial situation.
• Health.
• Personal preferences or interests.
• Accuracy.
• Behaviour.
• Location or movements of the data subject.

When profiling is based solely on automated processing:

• You will have the right to be informed if the decision that could be taken could have legal consequences that could have a significant effect.
• The data controller will have the right to obtain human intervention, on expressing their point of view and objecting to the decision, if the processing has been authorised by:
  1. The data subject has given explicit consent.
  2. A contract has been entered into between the controller and the data subject.

The right not to be the subject of profiling will not apply to when the decision that may be taken as a result of it is authorized by:

• The data subject has given explicit consent.
• A contract exists between the controller and the data subject.
• The processing is based on current legislation.