Data Subject is entitled to obtain confirmation from the Controller as to whether any personal data concerning Data Subject is processed by the Controller.

This includes the right to access such personal data, to obtain a copy of it free of charge (except for repetitive or excessive requests), unless otherwise provided for under applicable data protection laws. This includes also the information to be provided with a description of main features of the processing implemented in relation to Data Subject’s personal data, including:

(i) Purposes of such processing,
(ii) Categories of personal data concerned,
(iii) Recipients or categories of recipients of personal data,
(iv) The envisaged retention period or, if not possible, the criteria used to determine it,
(v) Existence of the Data Subject’s right to request rectification or erasure of personal data, as well as the right to object to or request restriction of processing,
(vi) The right to lodge a complaint with the competent authorities,
(vii) Information relating to any third-party source of personal data if the data were not collected from the Data Subject,
(viii) Information of the appropriate safeguards if personal data is transferred outside Data Subject’s country, relating to such transfer.


Data Subject has the right to obtain from the Controller without undue delay the rectification of inaccurate, incomplete or outdated personal data concerning Data Subject.


Data Subject has the right to erasure of its personal data by the Controller in one of the following cases:

a) if it is processed unlawfully;
b) so requested by the Data Subject;
c) incomplete or inaccurate and it cannot be lawfully rectified, provided that erasure is not disallowed by statutory provision;
d) the purpose of processing no longer exists or the legal time limit for storage has expired;
e) so instructed by court order or by the National Authority for Data Protection and Freedom of information (NAIH) or other competent supervisory authority and with the court.

Personal data shall be blocked instead of erased if so requested by the Data Subject, or if there are reasonable grounds to believe that erasure could affect the legitimate interests of the Data Subject. Blocked data shall be processed only for the purpose which prevented their erasure.


The Data Subject has the right to object, to the processing of his/her personal data.

a) if processing or disclosure is carried out solely for the purpose of discharging the Controller’s legal obligation or for enforcing the rights and legitimate interests of the Controller, the recipient or a third party, unless processing is mandatory;
b) if personal data is used or disclosed for the purposes of direct marketing, public opinion polling or scientific research; and
c) in all other cases prescribed by law.

If the Data Subject disagrees with the decision taken by the Controller or if the Controller fails to meet the deadline specified in the law the Data Subject shall have the right to bring action in the court within thirty days of the date of delivery of the decision or from the last day of the time limit.


Where the processing of Data Subject’s personal data is based on consent, it has the right to withdraw such consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.


Data Subject has the right to lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) with respect to the processing of his/her personal data.