The applicable data protection law grants users as data subject to the controller comprehensive data subject rights (information and intervention rights):

Right to confirmation, Art. 15 para. 1 sentence 1 GDPR

The data subject has the right to ask the controller for a confirmation of the processing of the personal data concerned.

Right to information, Art. 15 para. 1 sentence 2 GDPR

If the personal data of the data subject are processed, they have the right to inform about this personal data and to the following information:

1. the processing purposes;

2. the categories of personal data being processed;

3. the recipients or categories of recipients to whom the personal data have been disclosed or are still being disclosed, in particular to recipients in third countries or to international organizations;

4. if possible, the planned duration for which the personal data are stored or, if this is not possible, the

5. criteria for determining that duration;

6. the existence of a right to rectification or erasure of the personal data concerning them, or to the

7. restriction of processing by the controller or a right to object to such processing;

8. the existence of a right of appeal to a supervisory authority;

9. if the personal data are not collected from the data subject, all available information on the source of the

10. data;

11. the existence of automated decision-making including profiling as referred to in art. 22 para. 1 and 4 GDPR and, at least in these cases, meaningful information about the logic involved, and the scope and intended impact of such processing on the data subject.

Right to correction and completion, Art. 16 GDPR

The data subject has the right to demand from the person responsible without delay the correction of incorrect personal data concerning him.

In consideration of the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary statement.

Right to cancellation (right to be forgotten), Art. 17 GDPR

The data subject has the right to require the person responsible to delete personal data concerning him or her without delay, and the person responsible is obliged to delete personal data immediately, if one of the following reasons applies:

1. The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.

2. The data subject withdraws the consent on which the processing referred to in Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR was based and lacks any other legal basis for the processing.

3. The data subject shall object to the processing in accordance with Art. 21 para. 1 GDPR and there are no legitimate grounds for processing, or the data subject shall submit, in accordance with Art. 21 para. 2 GDPR.

4. Objection to the processing.

5. The personal data were processed unlawfully.

6. The erasure of personal data is necessary to fulfill a legal obligation under Union or national law to which the controller is subject.

7. The personal data were collected in relation to information society services offered in accordance with Art. 8 para. 1 GDPR.

However, the above does not apply if the processing is done for legal purposes.

Right to restriction of processing, Art. 18 GDPR

The data subject has the right to require the controller to restrict the processing if one of the following conditions is met:

1. the accuracy of the personal data is disputed by the data subject for a period allowing the controller to verify the accuracy of the personal data;

2. the processing is unlawful and the data subject refuses to delete the personal data and instead requests the restriction of the use of the personal data;

3. the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them to assert, exercise or defend legal claims; or

4. the person concerned has lodged an objection to the processing referred to in Art. 21 para. 1 GDPR, pending determination of whether the legitimate grounds of the controller prevail over those of the data subject.

Therefore, if the processing has been restricted, these personal data may only be stored with the consent of the data subject or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for important public interest Union or a Member State.

An affected person who has restricted processing will be notified by the controller before the restriction is lifted.

Right to Data Transferability, Art. 20 GDPR

The data subject has the right to receive personal data relating to him or her provided to a controller in a structured, common and machine – readable format and has the right to transfer that information to another person, without interference from the controller to whom personal data provided if:

1. the processing is based on a consent in accordance with Art. 6 para. 1 lit. a GDPR or Art.9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR; and

2. the processing is done using automated procedures.

In exercising their right to data portability, the data subject has the right to obtain the personal data to be transferred directly from one controller to another responsible party where technically feasible.

Right to objection, Art. 21 GDPR

The data subject has the right at any time, for reasons arising from his / her special situation, against the processing of personal data relating to him / her which, pursuant to Art. 6 para. 1 lit. e and f GDPR, to object; this also applies to profiling based on these provisions. The controller no longer processes the personal data unless he can demonstrate compelling legitimate grounds for processing that outweigh the interests, rights and freedoms of the data subject, or the processing is for the purpose of enforcing, pursuing or defending legal claims.

Right to revoke the consent granted, Art. 7 para. 3 GDPR

The data subject has the right to withdraw their consent at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation. The data subject will be informed before the consent is given. The revocation of consent must be as simple as the granting of consent.

Right to appeal, Art. 77 para. 1 GDPR

Without prejudice to any other administrative or judicial remedy, any data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of the habitual residence, place of work or place of alleged infringement, if the data subject considers that the processing concerns him / her personal data breaches this regulation.