Details about your rights as an affected person

Right of Access (Art. 15 GDPR)

You may request confirmation that personal data relating to you are being processed. If such processing is occurring, you may demand the following information from the controller:

The purposes of the processing of the personal data;
The categories of personal data that are processed;
The recipients or the categories of personal data to whom the personal data have been or will be disclosed;
The planned retention period of the personal data relating to you, or, when it is impossible to make any definite statements on this, the criteria used to determine the retention period;
The existence of a right to rectification or erasure of personal data relating to you, a right to restriction of processing by the controller or a right to objection to this processing;
The existence of a right to file a complaint with a supervisory authority;
Where personal data are not collected from the subject of the data, any available information as to their source;

Right to rectification (Art. 16 GDPR)
You have the right to obtain from the controller the rectification of inaccurate or incomplete personal data relating to you. The controller must carry out the rectification without undue delay.

Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)

a) Duty to delete

You have the right to demand from the controller the erasure of personal data relating to you without undue delay and the controller has the obligation to erase personal data without undue delay if one of the following grounds applies:

The personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed.
You withdraw your consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2) GDPR and there is no other legal ground for the processing.
You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.
The personal data relating to you have been unlawfully processed.
The personal data relating to you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
The personal data relating to you have been collected in relation to the offer of information society services referred to in Article 8(1).GDPR.

b) Information to third parties

If the controller has disclosed personal data relating to you and he is obliged, pursuant to Art. 17 GDPR to delete these data, then he will take the appropriate measures, also of a technical nature, while taking into account the available technology and implementation costs, to inform the data controllers who process the personal data about the fact that you, as data subject, have demanded from him the deletion of all the links to such personal data or copies or reproductions of such personal data.

c) Exceptions

The right to erasure does not exist when the processing is necessary:

To exercise the right to freedom of expression and information;
In order to comply with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or in order to carry out a task in the public interest or a task involving the exercise of a public power which has been transferred to the controller;
For reasons of public interest in the area of health in accordance with points (h) and (i) of Art. 9(2) as well as Art. 9(3) GDPR;
For archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) GDPR, if the right referred to in point (a) is likely to render impossible or seriously prejudice the attainment of the objectives of such processing, or
To assert, exercise or defend legal claims.

Right to restriction of processing (Art. 18 GDPR)
You have the right to require from the controller the restriction of processing under the following conditions:

When you contest the accuracy of the personal data relating to you for a period during which the controller can verify the accuracy of the personal data;
The processing is unlawful and you oppose the erasure of the personal data and you demand the restriction of their use instead;
The controller no longer needs the personal data for the purposes of the processing, but you need them to assert, exercise or defend legal claims;
When you have objected to processing pursuant to Article 21(1) and it is not yet clear whether the legitimate grounds of the controller override yours.

When the processing of personal data relating to you has been restricted, such personal data will only be processed, with the exception of storage, with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of compelling public interest of the Union or of a Member State.

If processing is restricted pursuant to the above conditions, you will be informed by the controller before the restriction of processing is lifted.

Right to correction (Art. 19 GDPR)
If you have claimed your right to rectification, erasure or restriction of the processing against the controller, the controller is obliged to inform all recipients to whom personal data relating to you have been disclosed of this rectification or erasure of the data without limitation of the processing, except where this remains impossible or involves unreasonable effort or costs.

You have the right to be informed by the controller about those recipients.

Right to data portability (Art. 20 GDPR)
You have the right to receive the personal data related to you which you have provided to a controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, on the condition that

The processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or on a contract pursuant to point (b) of Article 6(1) GDPR; and
The processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data relating to you transmitted directly from one controller to another, where technically feasible. The rights and freedoms of others may not be taken into account here.

The right to data portability does not apply to the processing of personal data which is necessary for the performance of a task, which is in the public interest or which is carried out in the exercise of public authority vested in the controller.

Right to objection (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data relating to you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
The controller will no longer process the personal data relating to you unless he can demonstrate urgent grounds for the processing which override your interests, rights and freedoms or to assert, exercise or defend legal claims.
If personal data relating to you are processed to perform direct advertising, you have the right to always object to the processing of the personal data relating to you for such advertising, including profiling, provided that this is connected with such direct advertising.
If you object to processing for direct marketing purposes, the personal data relating to you will no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Right to revoke the data subject consent statement (Art. 7(3) GDPR)
You have the right to withdraw your consent at any time. The withdrawal of consent will not affect the legitimacy of processing based on consent before its withdrawal.

Automated individual decision-making, including profiling (Art. 22 GDPR)
You have the right not to be subject to a decision based solely on automated processing, including profiling, which affects you legally or similarly significantly harms you. This does not apply if the decision:

Is necessary for entering into, or fulfilment of, a contract between you and the data controller;
Is permitted on the basis of legal provisions of the Union or one of the Member States to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms as well as your legitimate interests; or
Is made with your explicit consent.

However, these decisions may not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and appropriate measures to safeguard your rights and freedoms and legitimate interests are in place.

With regard to the cases referred to in (1) and (3), the controller will implement appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, at least the right to obtain human intervention on the part of the controller, in order to express your own point of view and to contest the decision.

Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, place of work or place of the alleged infringement if you believe that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Details about your rights as data subject