What are the rights of the Data Subject
under the General Data Protection Regulation (“GDPR”)

Right of Access

The user, as data owner, has the right to obtain from the controller confirmation as to which of his data are or are not subject to processing, as well as the right to access these and the following information:

• Purposes of the processing
• Categories of the personal data
• Recipients to whom the data have been or will be disclosed
• Time limits laid down for the retention of data, or the criteria for setting these time limits (when possible)
• Right to request rectification, erasure, restriction, or objection to processing
• Right to complain to the supervisory authority
• Existence of autonomous decisions, including the profiles’ definition
• Since the data was not collected from the subject, information available as to its origin
• Guarantees regarding the data transfer to third countries or international organisations

Right of Rectification

The data subject shall have the right to have inaccurate personal data corrected without undue delay, as well as the right to request that his incomplete personal data be completed.

Right to erasure

The data subject has the right to request the erasure of his personal data without undue delay, when:

• The data are no longer required for the purpose for which they were collected or processed
• Withdraw the consent on which the processing is based, there being no other legal basis
• If he objects to the processing in accordance with the Regulation

Right to restriction of processing

The data subject has the right to obtain from the controller the restriction of processing, applying, among others, one of the following situations:

• Having contested the accuracy of the data for the period necessary to verify their accuracy

• If the controller no longer needs the data for the purposes of processing, but they are required by the data subject for the purposes of declaration, exercise or defence of a right in legal proceedings
• When there is objection to processing, until it is established that the legitimate reasons of the controller take precedence over those of the subject

Right to data portability

If processing is based on consent, the data subject has the right to receive the data that has been communicated in a digital format for current use and automatic reading, or to request direct transmission of the data to another entity that becomes the new controller.

The provisions of the GDPR concerning the right to erasure apply without prejudice to this right.

Right to object and automated decisions

The data subject may object to the processing of data in the specific cases laid down in the General Data Protection Regulation where he or she demonstrates that his or her particular situation should relate to the performance of a task carried out in the public interest, public authority or legitimate interest, including profiling on the basis of the provisions relating thereto.

The data subject shall also have the right to object to the processing of his or her data covering the definition of profiles for direct marketing purposes, and personal data shall no longer be processed for that purpose.

The data subject shall have the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, which produces an effect in his legal sphere or significantly affects him, except where it is necessary for the performance of a contract, is based on his explicit consent or is authorised by Community or national law.

Right to lodge a complaint

The data subject shall have the right to lodge a complaint with the supervisory authority in the Member State of his habitual residence, place of work or the place where the alleged infringement has taken place, considering that the processing of personal data relating to him is in breach of the General Data Protection Regulation.

The data subject shall have the right to take legal action against legally binding decisions by the supervisory authorities which concern him.

The data subject is also entitled to legal action if he considers that the rights under the General Data Protection Regulations have been violated.

https://edpb.europa.eu/about-edpb/board/members_en

Right to withdraw your consent

If the data is processed based on your consent, you may withdraw it at any time, although this right shall not affect the lawfulness of processing carried out previously on the basis of that consent.

If you wish to exercise any of your rights, please contact us by email at privacy@valadascoriel.com, or by letter to: Rua Tierno Galvan, nr. 10, Tower 3, 16th floor, 1099-008 Lisbon.