As a data subject, you have the following rights in connection with the processing of your personal data:
4.1 The right to receive information
(1) The data subject has the right to request confirmation from the responsible person whether the personal data concerning him are being processed; if so, they have the right to receive a statement about such personal data and the following information:
a) processing purposes;
b) categories of personal data that are being processed;
c) recipients or categories of recipients to whom personal data has been disclosed or is still being disclosed, especially those from third countries or international organizations;
d) if possible, the planned period of storage of personal data or otherwise — the criteria for determining this period;
e) the right to correct or delete your personal data, or to restrict their processing by the responsible person or to object to such processing;
f) the right to file a complaint with a supervisory authority;
g) if personal data is not collected from the data subject itself, then all available information about the origin of the data;
h) availability of automated decision-making, incl. regarding data profiling, in accordance with Art. 22, Chapter 1 and Chapter 4 of the DS–GVO (General Data Protection Regulation), and – at least in these cases - reliable information about the logic involved, as well as the scale and the expected consequences of such processing for the data subject.
(2) If personal data is transferred to a third country or an international organization, the data subject has the right to be informed of the relevant guarantees in accordance with Article 46 of the DS-GVO (General Data Protection Regulation) related to the transfer.
4.2 The right to rectification
The data subject has the right to immediately demand from the responsible person the rectification of any incorrect personal data related to the data subject. Taking into account the purpose of processing, the data subject has the right to request additional completion of incomplete personal data, including by means of an additional application.
4.3 The right to erasure / right to be forgotten
(1) The data subject has the right to require the responsible person to immediately erase personal data related to the data subject, and the responsible person is obliged to immediately erase personal data if there are the following reasons:
a) personal data is no longer required for the purposes for which they were collected or otherwise processed.
b) the data subject withdraws the consent on the basis of which the processing was carried out in accordance with Article 6, Chapter 1, paragraph a) or Article 9, Chapter 2, paragraph a) DS-GVO (General Data Protection Regulation), and there are no other legal grounds for such processing.
c) the data subject objects to processing in accordance with Article 21, Chapter 1 of the DS-GVO (General Data Protection Regulation), and there are no more valid legal grounds for processing, or the data subject objects to processing in accordance with Article 21, Chapter 2 of the DS-GVO.
d) personal data has been processed illegally
e) the erasure of personal data is necessary to fulfill legal obligations in accordance with the legislation of the Union or the EU Member States to which the data protection officer is subordinate.
f) personal data was collected within the framework of services offered by the information society, in accordance with Article 8, Chapter 1 of the DS-GVO (General Data Protection Regulation).
(2) If the responsible person has made personal data public and is obliged to erase them in accordance with Chapter 1, he shall take appropriate measures, taking into account the available technologies and the cost of implementation, including technical measures, to inform the data processing persons who process personal data about the data subject's requirement to erase all personal data and all links to these personal data or their copies or replications of such personal data.
(3) Chapters 1 and 2 are not applicable if data processing is required
a) to exercise the right to freedom of speech and information;
b) to fulfill a legal obligation requiring the processing of data in accordance with the legislation of the Union or the EU Member States to which the responsible person is subordinate, or to perform a task in the public interest, or if the processing takes place within the exercise of authority vested in the responsible person;
c) based on the public interest in the field of public health in accordance with Article 9, Chapter 2 of paragraph h) and paragraph i), as well as Article 9, Chapter 3 of DS-GVO (General Data Protection Regulation);
d) for the purposes of archiving in the public interest, scientific or historical research or for statistical purposes in accordance with Article 89, Chapter 1, if the right referred to in Chapter 1 allegedly makes it impossible or seriously affects the achievement of the purposes of this processing, or
e) in order to comply with, execute or defend legal requirements.
4.4 The right to restrict processing
(1) The data subject has the right to require the responsible person to restrict processing if one of the following conditions is met:
a) the accuracy of personal data is disputed by the subject of personal data, while during such a period of time that allows the responsible person to verify the accuracy of personal data,
b) the processing is illegal, and the subject of personal data refuses to delete personal data, and instead requires restrictions on the use of personal data;
c) the responsible person no longer needs personal data for processing purposes, but the data subject needs them to assert, exercise or protect their legal rights, or
d) the data subject has put forward a request to suspend data processing in accordance with Article 21, Chapter 1 of the DS-GVO (General Data Protection Regulation) for a period until it is established whether the legitimate grounds for objections of the responsible person have priority over the legitimate grounds of the data subject.
(2) If the processing of personal data is restricted in accordance with Chapter 1, then these personal data, regardless of their preservation, can be processed only with the consent of the data subject or for compliance, implementation or protection of legal claims, or to protect the rights of another natural or legal person, or for reasons related to important public interests Union or EU Member State.
4.5 The right to data portability
(1) The data subject has the right to receive personal data related to him, which he has provided to the responsible person, in a structured, generally accepted and machine-readable format, and has the right to transfer this data to another responsible person without the intervention of the person to whom this data was provided earlier, provided that
a) processing is based on consent in accordance with Article 6, Chapter 1, paragraph a) or Article 9, Chapter 2, paragraph a) DS-GVO (General Data Protection Regulation) or is based on a contract in accordance with Article 6, Chapter 1, paragraph b) DS-GVO and
b) processing is carried out using automated processes.
(2) When exercising their right to data portability in accordance with Chapter 1, the data subject has the right to request the transfer of personal data directly from one responsible person to another responsible person, to the technically feasible extent.
The right under Chapter 1 must not infringe on the rights and freedoms of others.
This right does not apply to processing necessary for the performance of tasks for the purposes of public interest, or if the processing takes place within the framework of the exercise of authority entrusted to the responsible person;
4.6 The right to object to processing:
The data subject has the right at any time to object to the processing of personal data relating to them, occurring in accordance with Article 6, Chapter 1, paragraph e) or f) of the DS-GVO (General Data Protection Regulation), for reasons arising from his specific situation; this also applies to profiling data based on these provisions. In such a case, the responsible person stops processing personal data, except in cases when he can present valid legal grounds for processing that prevail over the interests, rights and freedoms of the data subject, or when the processing serves to comply with, fulfill or protect legitimate requirements.
Due to the use of information society services and regardless of Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.
4.7 The right to withdraw consent to data processing:
The data subject has the right to withdraw their consent to the processing of personal data carried out in accordance with the legislative provision on data protection at any time. The consent withdrawal does not affect the legality of processing performed on the basis of consent prior to its revocation.
4.8 The right to lodge a complaint with a supervisory authority
Any data subject has the right to lodge a complaint with a supervisory authority without prejudice to any other administrative-legal or judicial remedies, in particular in the EU Member State at his place of residence, place of work or place of alleged violation, if the data subject believes that the processing of personal data concerning him violates this Provision.