Customers (hereinafter referred to as data subjects or Customers) have the right to request information about the processing of their personal data. They can also request corrections, deletions, or restrictions on processing (with the exception of mandatory data processing), exercise their right to data portability, and object to processing as indicated at the time of data collection or through the contact details provided by the data controller.

1. Right to Information: The data controller ensures that data subjects are provided with all the information required by Articles 13 and 14 of the GDPR, and Articles 15-22 regarding the processing of personal data. This information must be concise, transparent, easily accessible, and clearly written, especially when addressing children. The information can be provided in writing, electronically, or verbally upon verification of the data subject’s identity.
2. Right to Access: Data subjects have the right to receive confirmation from the data controller on whether their personal data is being processed. If processing is taking place, they are entitled to access their personal data and receive the following information:
   • The purposes of data processing.
   • Categories of personal data involved.
   • Recipients or categories of recipients, including third-country recipients and international organizations.
   • The planned period for which the data will be stored or the criteria used to determine this period.
   • The right to request correction, deletion, or restriction of processing, and the right to object to processing.
   • The right to file a complaint with a supervisory authority.
   • Information on the source of the data if it was not collected from the data subject.
   • The existence of automated decision-making, including profiling, and information about the logic involved and the significance of such processing.

A copy of the personal data must be provided to the data subject, with additional copies available for a reasonable fee. If the request is made electronically, the data should be provided in a commonly used electronic format, unless otherwise requested. The data controller must provide the information within one month of the request.

1. Right to Rectification: Data subjects can request the correction of inaccurate personal data without undue delay. They can also request the completion of incomplete personal data, including through a supplementary statement.
2. Right to Erasure (“Right to be Forgotten”): Data subjects can request the deletion of their personal data without undue delay under certain conditions, including:
   • The data is no longer needed for its original purpose.
   • The data subject withdraws consent and there is no other legal basis for processing.
   • The data subject objects to the processing and there are no overriding legitimate grounds.
   • The data has been processed unlawfully.
   • Deletion is required to comply with a legal obligation.
   • The data was collected in relation to the offer of information society services.

If the data has been made public, the data controller must take reasonable steps to inform other controllers to delete links or copies of the data.

This right does not apply if processing is necessary for:

1. • Exercising the right to freedom of expression and information.
   • Compliance with a legal obligation or performing a task in the public interest.
   • Reasons of public interest in public health.
   • Archiving purposes in the public interest, scientific or historical research, or statistical purposes.
   • Establishing, exercising, or defending legal claims.
2. Right to Restrict Processing: Data subjects can request the restriction of processing if:
   • They contest the accuracy of the data (for a period enabling verification).
   • The processing is unlawful and they oppose deletion.
   • The data controller no longer needs the data but the data subject requires it for legal claims.
   • They object to processing pending verification of legitimate grounds.

Restricted data can only be processed with the data subject’s consent, for legal claims, to protect others’ rights, or for important public interests.

1. Right to Data Portability: Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit this data to another controller without hindrance.
2. Right to Object: Data subjects can object to the processing of their personal data at any time, particularly if processing is based on public interest, exercise of official authority, or legitimate interests of the controller. If an objection is made, the data controller must cease processing unless compelling legitimate grounds are demonstrated.

For direct marketing purposes, data subjects can object at any time, and the data cannot be processed for these purposes if an objection is made.

1. Automated Decision-Making and Profiling: Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affects them. This right does not apply if the processing is necessary for a contract, authorized by law, or based on explicit consent, provided that appropriate measures are in place to safeguard the data subject’s rights.
2. Right of Withdrawal: Data subjects can withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.