The right of the Operator to require access to the personal data of the data subject in accordance with Article 15:
The data subject is entitled to receive confirmation from the Operator as to whether the personal data concerning him or her is being processed and, if so, to access such personal data and to receive the following information:
- Purpose of processing;
- Category of the personal data concerned;
- The recipient or category of recipients, to whom the personal data has been or will be provided, in particular the recipients in the third countries or international organisations;
- if it is possible, the assumed duration of data retention, or if it is not possible, the criteria for its determination;
- Existence of the right to require the Operator to correct the personal data of the data subject, or to delete or limit their processing, or to oppose the right to such processing;
- the right to appeal to the Board of Supervisors;
- if the personal data were not acquired by the data subject, any accessible information regarding their source;
- The existence of an automated decision, including the profiling of Article 22 para. (1) and (4) and, in such cases, at least useful information on the procedure followed, as well as the meaning and likely effects of such processing on the data subject.
If the personal data is transferred to third countries or to an international organisation, the data subject is entitled to be adequately informed about the transfer under Article 46 of the Directive.
The Operator shall provide a copy of the personal data being processed. For any additional copies requested by the data subject, the Operator may charge a reasonable fee equal to the administration costs. If the data subject has submitted the application electronically, the information will be provided in the usual electronic form, unless otherwise requested by the data subject. The right to receive a copy shall not impair the rights and freedoms of third parties.
The right to rectify personal data under Article 16:
The data subject is entitled to have the Operator rectify any inaccurate data concerning him/her without undue delay. With regard to the purpose of the processing, the data subject is entitled to supplement the incomplete personal data by means of a supplementary statement.
The right to erasure (the right 'to be forgotten') under Article 17:
The data subject is also entitled to have the Operator erase any personal data concerning him/her, and the Operator is obligated to erase the personal data without undue delay, where one of the following grounds is fulfilled:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- the data subject withdraws the consent, on the basis of which the processing takes place, acc. to Article 6 para. 1 a) or acc. Article 9 para. 2 a) of the Regulation, and provided that there is no other legal basis for processing;
- the data subject objects to the processing under Article 21 para. 1 of the Regulation and there are no prevailing legitimate reasons for such processing or the data subject objects to the processing under Article 21 para. 2 of the Regulation;
- the personal data was processed unlawfully;
- the personal data must be erased in order to comply with a legal obligation laid down in Union or Member State law applicable to the Operator;
- the personal data was collected in connection with the offer of information society services pursuant to Article 8 para. 1 of the Regulation;
If the Operator has published the personal data and if it is obligated to delete the personal data, with regard to the accessible technology and costs incurred for implementing the measures, it takes appropriate measures, including technical ones, to inform the Operator processing the personal data, that the data subject requires the erasure of all references to that personal data, their copies or counter-pleadings.
The right to erasure is not claimed if the processing is required for the following purposes:
- for exercising the right to freedom of expression and information;
- for the fulfilment of the statutory obligation of the processing under the Union or the Member State law applicable to the Operator, or for the performance of the public-interest task or in order to exercise of the public authority delegated to the Operator;
- for reasons of public interest in the public health field in accordance with Article 9 para. (2) (h) and (i), as well as Article 9 para. (3) of the Regulation;
- for archiving in the public interest, for scientific or historical research or for statistical purposes under Article 89 para. (1) of the Regulation, to the extent that it is apparent that the above right impedes or grossly hinders the achievement of such processing, or
- for the presentation, assertion or defence of legal claims.
The right to restriction of processing under Article 18:
The data subject is entitled to have the Operator restrict the processing of his/her personal data, if one of the following cases applies:
- the data subject contested the accuracy of the personal data, for a period enabling the Operator to verify the accuracy of the personal data;
- the processing of the data subject's personal data is unlawful, but the data subject opposes the erasure of this data and requests the restriction of its use instead;
- the Operator no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims;
- the data subject has objected to the processing of his/her personal data pursuant to Article 21 para. (1) of the GDPR pending the verification whether the legitimate reasons of the Operator override the legitimate reasons raised by the data subject.
If processing has been restricted in accordance with the aforementioned limitation, such personal data will be provided, with the exception of detention, only upon consent of the data subject or for the purpose of representing, asserting or defending the rights, or for the protection of the rights of another natural person or entity, or for reasons of important public interest of the Union or of the Member State.
The data subject who has obtained the restriction of processing in accordance with the aforementioned facts is informed by the Operator before the processing restriction is deleted.
The right to data portability under Article 20:
The authorised person is entitled to obtain personal data, which relates to him or her and which he or she has provided to the Operator, in a structured, commonly used and machine-readable format, and is entitled to transfer this data to another Operator without any hindrance from the Operator to whom the data was provided if: a) the processing is based on the consent referred to in Article 6 para. (1) (a) or Article 9 para. (2) (a) of the Regulation or on the contract referred to in Article 6 para. (1) (b) ) of the Regulation, and b) if the processing is carried out by automated means.
The data subject is entitled to have personal data transferred directly from one Operator to another, whenever technically feasible, in exercising his/her right of portability.
Article 17 of the Regulation shall not be affected by exercising the right. That right does not relate to the processing necessary to fulfil the task, which was carried out in the public interest or in exercising of the public authority delegated to the Operator. The right to data portability must not adversely affect the rights and freedoms of third parties.
The right to object to the processing, including objection to the profiling (where applicable) in accordance with Article 21:
The data subject is entitled, at all times, to object to the processing of his/her personal data, which is carried out pursuant to Article 6 para. (1) (e) or (f) of the Regulation, for reasons relating to his/her specific situation, including objection to profiling based on the aforementioned provisions.
The Operator may not process the personal data further, unless it proves the urgent and justified reasons for the processing, which override the interests, rights and freedoms of the data subject, or the reasons for the expulsion, assertion or defence of the legal claims. If personal data is processed for direct marketing purposes, the data subject is entitled, at all times, to object to the processing of his/her personal data for the purpose of such marketing, including the profiling to the extent that it relates to this direct marketing. If the data subject opposes processing for direct marketing, the personal data may not be processed for such purposes.
In the context of the exercising of information society services and without regard to Directive 2002/58/EC, the data subject may claim his/her right through automated means by applying technical specifications. Where personal data is processed for scientific, historical or statistical purposes under Article 89 para. (1) of the Regulation, the data subject is entitled to object to the processing of personal data, for the reasons that relate to his/her specific situation, with the exception of cases where the processing is necessary for fulfilling urgent tasks for public interest reasons.
The right to lodge a complaint with the supervisory authority:
The data subject is entitled to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic.
The right to revoke consent with processing:
In the event that the legal basis for the processing of the personal data is the consent of the data subject, the latter is entitled to revoke his/her consent at any time without affecting the legality of the processing based on the consent granted prior to the revocation.
The right to withdraw consent at any time, even before the expiry of the period for which such consent has been granted, may be claimed by the data subject in the following way:
- via email to the address: email@example.com
- by calling +421352901130, or
- by sending the written request to the address of the registered office of the Operator stating the text "GDPR - odvolanie súhlasu / revocation of consent" on the envelope.