GDPR

Withdraw consent to processing at any time, as easily as it was given, without affecting the lawfulness of processing carried out before the withdrawal.

Confirm whether your personal data is processed and obtain access to it, including a copy of the data undergoing processing; the controller must reply within one month of receipt, extendable by two further months where necessary.

Obtain the purposes of the processing, the categories of personal data, the recipients or categories of recipient, the envisaged retention period and any available information on the source; the controller must reply within one month, extendable by two further months.

Have inaccurate personal data corrected and incomplete data completed without undue delay; the controller must reply within one month of receipt, extendable by two further months where necessary.

Have personal data erased without undue delay when, for example, it is no longer needed, consent is withdrawn or an objection succeeds, subject to the exceptions in Article 17(3); the controller must reply within one month, extendable by two further months.

Have processing limited, in general to storage, while accuracy is contested, if processing is unlawful and you oppose erasure, if you need data the controller no longer needs for legal claims, or while an objection is assessed; the controller must reply within one month, extendable by two further months.

Receive the personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is automated and based on consent or contract; the controller must reply within one month, extendable by two further months.

Object, on grounds relating to your situation, to processing based on public interest or legitimate interests, including profiling, unless the controller shows overriding compelling legitimate grounds or needs the data for legal claims; the controller must reply within one month, extendable by two further months.

Object at any time to processing for direct marketing, including related profiling, after which the data may no longer be used for that purpose; the controller must reply within one month, extendable by two further months.

Not be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects, except where Article 22(2) allows it with safeguards such as human intervention; the controller must reply within one month, extendable by two further months.