If you have any questions or encounter any issues while using our services, you may contact the data controller via the methods listed on our website (phone, email, social media, etc.).

The Data Controller will delete the data received via email, messages, telephone, Facebook, etc., along with the name and email address of the interested party and any other personal data voluntarily provided, no later than two years after the data was provided.

We will provide information regarding data processing activities not listed in this notice at the time the data is collected.

In response to an exceptional request from a government authority, or in response to a request from another body authorized by law, the Service Provider is obligated to provide information, disclose or transfer data, and make documents available.

In such cases, the Service Provider shall disclose personal data to the requesting party—provided that the party has specified the exact purpose and scope of the data—only to the extent strictly necessary to fulfill the purpose of the request.

Rights of Data Subjects

Right of Access

You have the right to obtain confirmation from the data controller as to whether your personal data is being processed, and if such processing is taking place, you have the right to access your personal data and the information listed in the Regulation.

Right to rectification

You have the right to obtain from the data controller, upon request and without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to request that incomplete personal data be completed, including by means of providing a supplementary statement.

The Right to Erasure

You have the right to request that the data controller erase your personal data without undue delay, and the data controller is obligated to erase your personal data without undue delay under certain conditions.

The right to be forgotten

If the data controller has made the personal data public and is required to erase it, it shall, taking into account available technology and the cost of implementation, take reasonable steps—including technical measures—to inform data controllers processing the data that you have requested the deletion of links to, or copies or replicas of, the personal data in question.

The Right to Restriction of Processing

You have the right to request that the data controller restrict the processing of your personal data if any of the following conditions are met:

You contest the accuracy of the personal data; in this case, the restriction applies for a period enabling the data controller to verify the accuracy of the personal data;
the processing is unlawful, and you oppose the erasure of the data and instead request the restriction of its use;
the data controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims;
you have objected to the processing; in this case, the restriction applies for as long as it has not been determined whether the controller’s legitimate grounds override your legitimate grounds.

The Right to Data Portability

You have the right to receive the personal data concerning you, which you have provided to a data controller, in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another data controller without hindrance from the data controller to whom you have provided the personal data (…)

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data by (…), including profiling based on those provisions.

Objection in the case of direct marketing

If the processing of personal data is carried out for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for such purposes, including profiling, insofar as it is related to direct marketing. If you object to the processing of your personal data for direct marketing purposes, your personal data may no longer be processed for that purpose.

Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you.

The preceding paragraph does not apply if the decision:

is necessary for the conclusion or performance of a contract between you and the data controller;
is authorized by Union or Member State law to which the data controller is subject, which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
is based on your explicit consent.

Time limit for action

The data controller shall inform you of the measures taken in response to the above requests without undue delay, but in any event within 1 month of receipt of the request.

If necessary, this may be extended by 2 months. The data controller shall inform you of the extension of the deadline within 1 month of receiving the request, stating the reasons for the delay.

If the data controller does not take action in response to your request, it will inform you without delay, but no later than one month from the receipt of the request, of the reasons for the failure to act, as well as of your right to file a complaint with a supervisory authority and to seek judicial remedy.

Security of Data Processing

The data controller and the data processor shall take appropriate technical and organizational measures, taking into account the state of the art, the costs of implementation, as well as the nature, scope, context, and purposes of the processing, and the risk of varying likelihood and severity to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk, including, where appropriate:

the pseudonymization and encryption of personal data;

ensuring the ongoing confidentiality, integrity, availability, and resilience of the systems and services used to process personal data;

the ability to restore access to personal data and the availability of the data in a timely manner in the event of a physical or technical incident;

a procedure for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures taken to ensure the security of processing.

Notifying the data subject of a data breach

If the data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall notify the data subject of the data breach without undue delay.

The information provided to the data subject must clearly and comprehensibly describe the nature of the data breach and include the name and contact details of the data protection officer or other contact person providing further information; it must describe the likely consequences of the data breach; the measures taken or planned by the data controller to address the data breach, including, where appropriate, measures to mitigate any adverse consequences resulting from the data breach, must be described.

The data subject need not be informed if any of the following conditions are met:

the controller has implemented appropriate technical and organizational security measures, and those measures were applied to the data affected by the personal data breach, in particular measures—such as encryption—that render the data unintelligible to any person who is not authorized to access it;
the controller has taken further measures following the data breach to ensure that the high risk to the rights and freedoms of data subjects is unlikely to materialize in the future;
providing the information would require a disproportionate effort. In such cases, data subjects must be informed through publicly disclosed information, or similar measures must be taken to ensure that data subjects are informed in an equally effective manner.

If the data controller has not yet notified the data subject of the personal data breach, the supervisory authority may, after assessing whether the personal data breach is likely to result in a high risk, order that the data subject be notified.

Reporting a data breach to the authority

The data controller shall notify the competent supervisory authority of the data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of the data breach, to the supervisory authority competent pursuant to Article 55, unless the data breach is unlikely to pose a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours, the reasons for the delay must also be provided.