A. Right to information
- The Administrator, when collecting personal data, is obliged to provide the Data Subject with all the following information:
- their identity and contact details and, where applicable, the identity and contact details of their representative,
- where applicable - contact details of the data protection officer,
- the purposes of the processing of personal data, and the legal basis for the processing,
- information about the recipients of personal data or categories of recipients, if any,
- where applicable - information on the intention to transfer Personal Data to a third country or an international organization,
- the period for which personal data will be stored, and if this is not possible, the criteria for determining this period,
- information whether the provision of personal data is a statutory or contractual requirement or a condition for the conclusion of a contract and whether the Data Subject is obliged to provide it and what are the possible consequences of not providing the data.
- If the Administrator plans to further process personal data for a purpose other than the purpose for which the personal data was collected, before such further processing, they are obliged to inform the Data Subject about this other purpose and provide them with any other relevant information.
B. The right to withdraw consent to the processing of personal data
- The Data Subject has the right to withdraw consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of the processing which was carried out on the basis of consent before its withdrawal.
C. Right to access personal data
- The Data Subject is entitled to obtain confirmation from the Administrator as to whether Personal Data concerning him or her are processed, and if so, they are entitled to access them and the following information:
- the purposes of the processing;
- the categories of personal data concerned;
- information about recipients or categories of recipients to whom personal data have been or will be disclosed, in particular about recipients in third countries or international organizations;
- if possible, the planned period of storage of personal data, and if this is not possible, the criteria for determining this period;
- information on the right to request the Administrator to rectify, delete or limit the processing of personal data and to object to such processing;
- information on the right to lodge a complaint with the supervisory authority;
- if the personal data have not been collected from the Data Subject - any available information as to their source;
- information on automated decision making, including profiling referred to in art. 22 sec. 1 and 4 of the GDPR, and - at least in these cases - relevant information about the rules for their taking, as well as the significance and envisaged consequences of such processing for the Data Subject.
- The Administrator is obliged to provide the Data Subject with a copy of the Personal Data. For any subsequent copies requested by the Data Subject, the Controller may charge a reasonable fee based on administrative costs. If the Data Subject requests a copy by electronic means and, unless otherwise indicated, the information is provided by electronic means.
D. The right to request rectification and deletion of personal data
- The Data Subject has the right to request the Administrator to immediately rectify incorrect personal data concerning them. Taking into account the purposes of processing, the Data Subject has the right to request that incomplete personal data be supplemented, including by providing an additional statement.
- The Data subject is entitled to request the Administrator to immediately delete their personal data, and the Administrator is obliged to delete personal data without undue delay, if one of the following circumstances occurs:
- personal data is no longer necessary for the purposes for which it has been collected or otherwise processed,
- the Data Subject has withdrawn consent on which the processing is based in accordance with art. 6 sec. 1 let. a) or Art. 9 sec. 2 let. a) of the GDPR and there is no other legal basis for processing,
- the Data Subject objects to the processing pursuant to Art. 21 par. 1 of the GDPR against the processing and there are no overriding legitimate grounds for the processing or the Data Subject objects to the processing pursuant to Art. 21 par. 2 of the GDPR against processing,
- the personal data has been processed unlawfully,
- personal data must be removed in order to comply with the legal obligation provided for in the Union law or the law of the Member State to which the Administrator is subject,
- the personal data has been collected in relation to the offering of information society services referred to in art. 8 sec. 1 of the GDPR.
- The rights of the Data Subject indicated in point 2 above do not apply to the extent that the processing is necessary to exercise the right to freedom of expression and information, to establish, assert or defend claims, to fulfill a legal obligation requiring processing under the EU law or law of the Member State to which the Administrator is subject, or to perform a task carried out in the public interest or as part of the exercise of public authority entrusted to the Administrator, due to reasons of public interest in the field of public health in accordance with art. 9 sec. 2 let. h) and i) of the GDPR and art. 9 sec. 3 of the GDPR for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 par. 1 of the GDPR, insofar as it is probable that this right will prevent or seriously hinder the achievement of the purposes of such processing.
- The Administrator is obliged to provide the Data Subject with information about the rectification or deletion of personal data, unless it proves impossible or will require a disproportionately significant effort.
E. The right to limit the processing of personal data
- The Data Subject has the right to request the Administrator to limit the processing of their personal data in the following cases:
- The accuracy of the personal data is contested by the Data Subject - for a period allowing the Administrator to verify their correctness,
- The processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead,
- The Administrator no longer needs personal data for the purposes of processing, but it is needed by the Data Subject to establish, assert or defend claims,
- The Data Subject has objected to the processing pursuant to Art. 21 par. 1 of the GDPR - until it is determined whether the legitimate grounds on the part of the Administrator override the grounds for objection of the Data Subject.
- The Administrator is obliged to provide the Data Subject with information on the restriction of the processing of personal data, unless this proves impossible or requires a disproportionate effort.
F. The right to transfer personal data
- The Data Subject is entitled to receive personal data concerning them provided to the Administrator in a structured, commonly used machine-readable format, and has the right to send this personal data to another Administrator without any obstacles on the part of the Administrator, if the processing takes place in an automated manner and a) based on the consent of the Data Subject or b) necessary for the execution of the contract.
- When exercising the right specified above, the Data Subject has the right to request that the personal data be sent by the Administrator directly to another Administrator, if technically possible. This right does not apply to processing that is necessary to perform a task carried out in the public interest or as part of the exercise of public authority entrusted to the Administrator. This right may not adversely affect the rights and freedoms of other entities.
G. Right to object and rights related to automated decision making in individual cases
- The Data Subject has the right to object at any time - for reasons related to their particular situation -- to the processing of their personal data based on art. 6 sec. 1 let. e) or f) of the GDPR, including profiling based on these provisions. The Administrator is no longer allowed to process this personal data, unless they demonstrate the existence of valid legitimate grounds for processing, overriding the interests, rights and freedoms of the Data Subject, or the grounds for establishing, investigating or defending claims.
- If personal data is processed by the Administrator for direct marketing purposes, the Data Subject has the right to object at any time to the processing of their personal data for the purposes of such marketing, including profiling, to the extent that the processing is related to such direct marketing.
- If the Data Subject objects to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.
- If personal data is processed for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 par. 1 of the GDPR, the Data Subject has the right to object - for reasons related to their particular situation - to the processing of their personal data, unless the processing is necessary to perform a task carried out in the public interest.
- The Data Subject has the right not to be subject to a decision which is based solely on automated processing, including profiling, and has legal effects on them or similarly significantly affects them, unless this decision is necessary for the conclusion or performance of a contract between the Data Subject and the Administrator; is allowed by the law of the European Union or the law of the Member State to which the Administrator is subject and which provides for appropriate measures to protect the rights, freedoms and legitimate interests of the Data Subject or is based on the express consent of the Data Subject.