As a data subject, you have the following rights in connection with the processing of your personal data:
4.1 The right to receive information
(1) The data subject has the right to request confirmation from the Operator whether personal data relating to him is being processed; in this case, the data subject has the right to receive information about this personal data and to receive the following information:
a) processing purposes;
b) categories of personal data that will be processed;
c) recipients or categories of recipients to whom personal information has been or is still being disclosed, in particular recipients in third countries or in international organizations;
d) if possible, the planned period during which personal data will be stored, or, if this is not possible, the criteria for determining this period;
e) the right to correct or erase personal data concerning you, or to restrict the processing by the controller, or the right to object to such processing;
f) the right to file a complaint with the supervisory authority;
g) if personal data is not collected from the data subject, all available information about the origin of the data;
h) the availability of an automated decision–making process, including profiling, in accordance with art. 22 (1) and (1). 4 GDPR and – at least in these cases - meaningful information about the logic involved, as well as the extent and expected consequences of such processing for the data subject.
(2) If personal data is transferred to a third country or an international organization, the data subject has the right to receive information about the relevant guarantees provided for in article 46 of the General Data Protection Regulation (GDPR) in connection with the transfer.
4.2 The right to rectification
The data subject has the right to immediately demand from the Responsible Person the rectification of inaccurate personal data concerning him. Taking into account the purposes of processing, the data subject has the right to request the completion of incomplete personal data, including means of an additional application.
4.3 The right to erasure
(1) The data subject has the right to request the Controller to erase personal data related thereof, and the Controller is obliged to erase the personal data immediately if one of the following reasons applies:
a) Personal data is no longer needed for the purposes for which they were collected or otherwise processed.
b) The data subject withdraws their consent, which is subject to processing in accordance with Article 6, paragraph 1 point (a) or article 9 para. 2 point (a) of the GDPR, and there is no other legal basis for processing.
c) The interested person objects to the processing, and there are no priority legal grounds for processing, or the data subject submits an application in accordance with Article 21, paragraph. 2 of the GDPR.
d) Personal data has been processed illegally.
e) The erasure of personal data is necessary to fulfill a legal obligation in accordance with the legislation of the Union or the legislation of the Member States to which the controller is subordinate.
f) Personal data was obtained in connection with the services offered by the Information Society in accordance with Article 8. A criminal case has been initiated against GDPR under Article 1.
(2) If the administrator has made personal data public and if the administrator is obliged to erase them in accordance with paragraph 1, reasonable measures, including technical measures, will be taken, considering available technologies and implementation costs, to notify the data controllers processing personal data that the data subject may be deleted and that the data subject has requested the erasure of all references to this personal data, as well as copies of this personal data.
(3) Paragraphs 1 and 2 do not apply to the extent that processing is required
a) to exercise the right to freedom of expression and information;
b) to fulfill a legal obligation requiring processing in accordance with the legislation of the Union or the Member States to which the controller is subordinate, or to perform a task that meets public interest or is carried out within the exercise of state power entrusted to the controller;
c) for reasons of public interest in the field of public health in accordance with Article 9, paragraph. 2 points (h) and (i), as well as Article 9, paragraph 3 of the GDPR;
(d) For archival, scientific or historical research purposes of public interest or for statistical purposes in accordance with article 89 (1), to the extent that the law referred to in paragraph 1 allegedly makes it impossible or seriously impedes the achievement of the purposes of such processing, or
e) for presentation, fulfillment or defense of legal claims.
4.4 The right to restrict processing
(1) The data subject has the right to request the controller to restrict processing if one of the following conditions is provided:
a) the accuracy of personal data is disputed by the data subject during the period that allows the controller to verify the accuracy of personal data,
b) the processing is illegal and the data subject refuses to erase the personal data and instead requires restrictions on the use of personal data;
c) the data controller no longer needs personal data for processing purposes, but the data subject needs them to present, implement or defend legal claims, or
d) the data subject objects to processing in accordance with Article 21, paragraph 1 of the GDPR and it has not yet been determined whether the legitimate reasons of the responsible person outweigh the justified reasons of the interested person.
(2) If processing has been restricted in accordance with paragraph 1, these personal data, with the exception of their storage, may be stored only with the consent of the data subject or for the presentation, fulfillment or protection of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interests of the Union or the Member State.
4.5 The right to data portability
(1) The data subject has the right to receive relevant personal data, provided by the subject to the controller in a structured, generally accepted and machine-readable format, and the subject has the right to transfer this data to another controller without hindrance from the controller to whom the personal data has been disclosed, provided that
a) processing is based on consent in accordance with Article 6, paragraph 1 point (a) or article 9 para. 2 point (a) of the GDPR or on contractual basis in accordance with Article 6, paragraph 1 point (b) of the GDPR, and
b) processing is carried out using automated procedures.
(2) When fulfilling their right to data portability in accordance with paragraph 1, the data subject has the right to request that personal data be transferred directly from one controller to another controller, to the technically possible extent.
The right provided for in paragraph 1 of this article must not infringe on the rights and freedoms of others.
This right does not apply to processing necessary for the performance of a task that meets the public interest or is carried out within the framework of the exercise of state power, which has been transferred to a responsible person.
4.6 The right to object
The data subject has the right, for reasons arising from their specific situation, to refuse at any time the processing of relevant personal data, which may be prohibited in accordance with Article 6, paragraph 1 points (e) or (f) of the GDPR, and has the right to object; this also applies to profiling based on these provisions. The Controller will no longer process personal data unless they can demonstrate convincing legal grounds for processing that outweigh the interests, rights and freedoms of the data subject, or the processing is not intended to present, implement or defend legal claims.
In connection with the use of Information Society services, regardless of Directive 2002/58/EC, the Data Subject can exercise their right to object using automated procedures that use technical specifications.
4.7 The right to withdraw consent
The data subject has the right to withdraw their consent to data protection at any time. Withdrawal of consent does not affect the legality of processing carried out on the basis of consent until the moment of withdrawal.
4.8 The right to file a complaint with the supervisory authority
Without prejudice to any other administrative or judicial remedies, every interested person has the right to file a complaint with a supervisory authority, in particular in an EU Member State at the place of residence, place of work or place of alleged violation, if the interested person believes that the processing of related personal data violates these Rules.