YOUR RIGHTS AS DATA SUBJECT

With regard to the data processing described in this Declaration, you may, as a data subject, under the conditions laid down by the GDPR, exercise the rights provided for in Articles 15 to 21 of the GDPR, in particular:

Right of access – Article 15 of the GDPR: the right to obtain confirmation of whether your personal data are processed and, if so, the right to access your personal data – including copies – and to receive, inter alia, the following information:

• the purposes of the processing;
• categories of personal data processed;
• recipients or categories of recipients to whom they have been or will be disclosed
• data storage period or the criteria used
• the rights of the data subject (the right to rectify, delete personal data, processing restrictions and the right to object to processing);
• right to lodge a complaint with the supervisory authority
• the right to receive information about the source of personal data if it has not been collected from the data subject;
• information on automated decision-making, including profiling as well as relevant information on the principles of decision-making and the expected consequences of such decision-making for the data subject.

Right to rectification – article 16 GDPR: right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;

Right to erasure (right to be forgotten) – article 17 GDPR: right to obtain, without undue delay, the erasure of personal data concerning you, when:

• personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• you have withdrawn consent and where there is no other legal ground for the processing;
• you have successfully objected to the processing of the personal data;
• the data have been unlawfully processed,
• the data have to be erased for compliance with a legal obligation;
• the personal data have been collected in relation to the offer of information society services referred to in article 8, comma 1 of the GDPR.
  The right to erasure shall not apply in so far as the processing of data is necessary to fulfil a legal obligation requiring processing under law, to perform a task carried out in the public interest or in the exercise of the public authority entrusted to the Data Controller, or to establish, pursue or defend claims.

Right to restriction of processing – article 18 GDPR: right to obtain restriction of the processing, when:

• the accuracy of the personal data is contested by the data subject;
• the processing is illegal and the data subject objects to the deletion of personal data, demanding in return that their use be restricted;
• the data subject needs data to establish, pursue or defend claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

Right to data portability – article 20 GDPR: right to receive the personal data concerning you, which you have provided to the Data Controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance, if the processing is based on consent and is carried out by automated means. In addition, the right to have your personal data transmitted directly by the Data Controller to the other controller, where technically feasible.

Right to object – article 21 GDPR: right to object to the processing of personal data concerning you, unless there are legitimate grounds for the Data Controller to continue the processing;

The right to withdraw consent – the right to withdraw consent at any time. The withdrawal of consent does not affect the processing of data carried out before its withdrawal.

The above rights may be exercised in relation to the Data Controller using the contacts provided in point 1 above. The Data Controller shall examine your request and shall inform you, without undue delay and in all cases within no more than one month of its receipt, concerning the action taken with regard to your request.
The exercise of your rights as data subject is free of charge in accordance with article 12 of the GDPR. However, in the event of requests which are manifestly unfounded or excessive, in particular because of their repetitive character, the Data Controller may charge you a reasonable fee taking into account the administrative costs of dealing with your request, or refuse to act on the request.
Please also note that the Data Controller may request further information necessary to confirm the identity of the data subject.
In addition, you have the right to lodge a complaint with the President of the Office for Personal Data Protection – ul. Stawki 2, 00-193 Warsaw.

Last update 26.11.2020