4. Rights of the person concerned:

4.1. Rights of persons concerned

According to the provisions of the GDPR and the Info Act, natural persons may request the Data Controller to provide information about the processing of their personal data; access to and rectification of their personal data; deletion or restriction of their personal data; and they may express their objection to the processing of their personal data and exercise their right to data portability.

Right to Information and Access

Upon the request of the data subject, the Data Controller shall provide information during the data processing period about the data processed by it, their source, the purpose, legal basis, and duration of the data processing, the name and address of the data processor, and its activities related to data processing, the circumstances of any data protection incident, its effects, and the measures taken to mitigate it, as well as who and for what purpose could access the personal data. If the data subject’s data has been transferred, the data subject may receive an extract from the data transfer register related to them. The Data Controller shall provide the information without unreasonable delay, in an understandable form, within the shortest possible time from the submission of the request, but no later than 30 (thirty) days. The provision of information is free of charge if the requester has not yet submitted a request for information to the Data Controller for the same scope of data in the current year. The Data Controller may refuse to provide information if the data subject does not request information about their own data, if the person requesting information cannot credibly prove that they are the person concerned by the data processing, if the law excludes the provision of information, or if the Data Controller receives the data from another data controller under legal or international treaty provisions that restrict the data subject’s right to information. The Data Controller is only entitled to provide information to the data subject and persons authorized by them in a fully proven private document. In the case of refusal to provide information, the Data Controller shall inform the requester of the legal basis for the refusal. In the event of refusal, the Data Controller shall inform the data subject about the possibility of judicial remedy and the right to appeal to the National Authority for Data Protection and Freedom of Information. The Data Controller shall notify the National Authority for Data Protection and Freedom of Information annually by January 31 of the following year of the rejected requests.

Right to rectification

The data subject may request the rectification of their personal data, meaning they have the right to request the Data Controller to rectify any inaccurate personal data concerning them without undue delay, and also request the Data Controller to complete their personal data if it is incomplete. If the correct personal data is available to the Data Controller, the Data Controller shall rectify the personal data without delay. The Data Controller shall examine the rectification request without undue delay, within the shortest possible time from its submission, but no later than 30 (thirty) days, and inform the requesting person in writing of its decision and the available legal remedies.

Right to erasure, restriction

The data subject has the right to request the Data Controller to delete personal data concerning them without undue delay, and the Data Controller is obliged to delete the personal data concerning the data subject without undue delay if one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the data subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
• the data subject objects to the processing, and there are no overriding legitimate grounds for the processing;
• the personal data has been unlawfully processed;
• the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject;

Right to restriction of processing

The data subject has the right to request the data controller to restrict processing if one of the following applies:

• the data subject contests the accuracy of the personal data, in which case the restriction applies for a period enabling the data controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the data controller no longer needs the personal data for the purpose of processing, but the data subject requires them for the establishment, exercise, or defense of legal claims; or
• the data subject has objected to processing; in this case, the restriction applies for the period during which it is verified whether the legitimate grounds of the data controller override those of the data subject.

Right to Object

The data subject may object to the processing of their personal data. The Company shall examine the objection without delay, within the shortest possible time from the submission of the request, but no later than 30 (thirty) days, decide on its merits, and inform the requester of its decision in writing.

The data subject may object to the processing of their personal data in the following cases,

• if the processing or transfer of personal data is necessary solely for the fulfillment of the legal obligations of the data controller or for the enforcement of the legitimate interest of the data controller, data recipient, or a third party, except in cases of mandatory data processing;
• if the personal data is used or transferred for direct marketing, public opinion polling, or scientific research purposes; and
• in other cases specified by law.

If the data subject’s objection is justified, the Data Controller shall cease the data processing, including further data collection and transmission, and shall delete or restrict the data, as well as inform all those to whom the personal data affected by the objection was previously transmitted and who are required to take action to enforce the right to object. If the Office disagrees with the data subject’s objection, or if the Office fails to review and decide on the objection within the deadline, the data subject may appeal to the court within 30 days from the notification of the decision or from the last day of the deadline.

Rights of Data Subjects Regarding Automated Decision-Making and Profiling

The Data Subject has the right to request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except if the decision:

1. is necessary for the conclusion or performance of a contract between the Data Subject and the Data Controller;
2. is authorized by Union or Member State law applicable to the Data Controller, which also lays down suitable measures to safeguard the Data Subject’s rights, freedoms, and legitimate interests; or
3. is based on the Data Subject’s explicit consent.

In the cases mentioned in points 1 and 3, the Data Controller is obliged to take appropriate measures to protect the Data Subject’s rights, freedoms, and legitimate interests, including at least the right of the Data Subject to request human intervention on the part of the Data Controller, to express their point of view, and to contest the decision.

Notification Related to Rectification, Deletion, or Restriction of Data Processing

The Data Controller shall inform each recipient to whom the personal data has been disclosed of any rectification, deletion, or restriction of processing, except where this proves impossible or involves disproportionate effort. At the request of the Data Subject, the Data Controller shall inform the Data Subject about those recipients.

Notification of the Data Subject about a Data Protection Incident

If the data protection incident is likely to result in a high risk to the rights and freedoms of natural persons, the Data Controller shall inform the Data Subject of the data protection incident without undue delay. The notification shall clearly and comprehensibly describe the nature of the data protection incident, provide the name and contact details of the data protection officer or other contact point where more information can be obtained, describe the likely consequences of the data protection incident, and describe the measures taken or proposed by the data controller to address the data protection incident, including, where applicable, measures to mitigate any adverse effects of the data protection incident.

The Data Subject does not need to be informed if any of the following conditions are met:

1. the Data Controller has implemented appropriate technical and organizational protection measures, and these measures were applied to the data affected by the data protection incident, in particular, measures such as encryption, which make the data unintelligible to unauthorized persons.
2. the Data Controller has taken additional measures following the data protection incident that ensure that the high risk to the rights and freedoms of the Data Subject is no longer likely to materialize;
3. the notification would require disproportionate effort.

In such cases, the Data Subjects must be informed by publicly disclosed information or by taking similar measures that ensure similarly effective information to the Data Subjects. If the Data Controller has not yet informed the Data Subject about the data protection incident, the supervisory authority, after considering whether the data protection incident is likely to result in a high risk, may order the Data Subject to be informed, or may determine that a condition exists that makes notification unnecessary.