The data subject has the following rights:

1. The right to access personal data under the Art. 15 of the Regulation or § 21 of the Act

The data subject has the right to obtain a confirmation from the Controller as to whether personal data concerning the data subject are being processed. If the Controller processes such personal data, the data subject has the right to gain access to this personal data and information on:

• purposes of personal data processing,
• the category of personal data processed,
• identification of the recipient or category of recipient to whom the personal data have been or are to be provided, in particular the consignee in the third country or international organization (if possible),
• the retention period of personal data and, if this is not possible, information on the criteria for its determination,
• the right to request from the Controller correction of personal data concerning the data subject, their deletion or restriction of their processing and, if personal data are not processed with the consent of the data subject or within the legal obligation of the Controller, information on the right to object to personal data processing,
• the right to submit a complaint to the supervisory body, which is the Office for Personal Data Protection of the Slovak Republic, or to submit a proposal to initiate proceedings on personal data protection pursuant to the Act,
• sources of personal data, if personal data have not been obtained from the data subject,
• the existence of automated individual decision-making, including profiling and the procedure used, as well as the importance and expected consequences of such processing of personal data for the data subject,
• adequate safeguards regarding the transfer of personal data to a third country or international organization.

The Controller shall provide the data subject with a copy of the personal data processed about them. The Controller may charge a reasonable fee corresponding to the administrative costs for the repeated provision of personal data requested by the data subject.

If the data subject has submitted the request by electronic means, the information shall be provided in a commonly used electronic form, unless the data subject has requested another method.

2. The right to rectification under Art. 16 of the Regulation or § 22 of the Act

The data subject has the right to have the Controller correct incorrect personal data concerning them without undue delay. With regard to the purpose of processing personal data, the data subject has the right to supplement incomplete personal data.

3. The right to erasure (right to forget) under Art. 17 of the Regulation or § 23 of the Act

The data subject has the right to have the Controller delete personal data concerning them without undue delay if one of the following reasons is fulfilled:

• personal data are no longer needed for the purposes for which they were obtained or otherwise processed,
• the data subject withdraws their consent (see below) on the basis of which the processing takes place and there is no other legal basis for processing;
• the data subject objects to processing that is carried out on a legal basis in the public interest or a legitimate interest (see below), the interests mentioned not outweighing the interests, rights and freedoms of the data subject;
• personal data have been processed illegally,
• personal data must be deleted in order to meet the legal obligation under the law of the European Union or the law of the Slovak Republic,
• personal data have been collected in connection with the offer of services of the intelligence service under Article 8 (1) 1 of the Regulation or § 15 par. 1 of the Act.

This right does not apply if the processing of personal data is necessary for the exercise of the right to freedom of expression and information, to meet a legal obligation, or to meet a task performed in the public interest or in the exercise of public power entrusted to the Controller, for reasons of public interest in public health, for the purposes of archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes, or for proving, asserting or defending legal claims.

4. The right to restrict processing under Art. 18 of the Regulation or § 24 of the Act

The data subject has the right to have the Controller restrict the processing of personal data in one of the following cases:

• the data subject challenges the accuracy of the personal data during a period allowing the accuracy of the personal data to be verified,
• the processing is illegal and the data subject objects to the deletion of personal data and instead calls for restrictions on their use;
• the Controller no longer needs personal data for processing purposes, but the data subject needs them to prove, assert or defend legal claims,
• the data subject has objected to the processing that is carried out on a legal basis of public interest or legitimate interest (see below), until it is verified that the legitimate reasons on the part of the Controller outweigh the legitimate reasons of the data subject.

If the processing of personal data is restricted, the Controller may only store or process such personal data for the purpose of proving, asserting or defending legal claims, for the protection of rights of other persons or for reasons of important public interest. Other processing may be carried out only with the consent of the data subject.

Should the restriction on the processing of personal data occur, the Controller shall inform the data subject in advance.

5. The right to data portability under Art. 20 of the Regulation or § 26 of the Act

In exercising their right to data transfer, the data subject has the right to obtain (in a structured, commonly used and machine-readable format) and transfer personal data directly from one controller to another, as far as technically possible.

The right to the transfer of personal data may be exercised provided that the processing:

• establishes a consent or contract on a legal basis, and
• performed by automated means.

6. The right to object under Art. 21 of the Regulation or § 27 of the Act

In the event that the legal basis for the processing of personal data is meeting of a task carried out in the public interest pursuant to Art. 6 par. 1 subpar. e) of the Regulation or § 13 par. 1 subpar. e) of the Act, or a legitimate interest pursuant to Art. 6 par. 1 subpar. f) of the Regulation or § 13 par. 1 subpar. f) of the Act, the data subject also has the right to object to the processing of personal data concerning them, including objections to profiling.

In the event of such an objection, the Controller may not further process personal data unless he proves:

• the necessary legitimate reasons for the processing which outweigh the interests, rights and freedoms of the data subject, or
• reasons for proving, asserting or defending legal claims.

7. Automated individual decision-making, including profiling under Art. 22 of the Regulation or § 28 of the Act

The data subject has the right not to be subject to a decision which is based exclusively on automated processing, including profiling, and which has legal effects concerning or similarly affecting them.

This right shall not apply if the decision is:

• necessary for the conclusion or performance of the contract between the data subject and the Controller,
• permitted by the law of the European Union or the Slovak Republic, or
• based on the explicit consent of the data subject.

8. The right to withdraw consent under Art. 7 of the Regulation or § 14 of the Act

Where the processing of personal data is based on the consent of the data subject, the data subject shall have the right to withdraw that consent at any time.

Consent can be revoked in the same way as the consent was given. At the same time, the data subject may withdraw the consent in the following ways:

• by e-mail sent to the address dpo@egroup.sk,
• by sending a written request to the address of the Controller's registered office stating the text "GDPR – withdrawal of consent" on the envelope.

Withdrawal of consent does not affect the lawfulness of the processing of personal data based on the consent given before its withdrawal.