THE RIGHTS APPLICABLE TO THE DATA SUBJECT

One of the main purposes of introducing the GDPR was to strengthen your right to privacy protection and to strengthen the right to shape the methods of processing personal data already made available to the Administrator. This goal was achieved by indicating the rights of a natural person in the regulations, which we hope to describe below in a clear way.

The right to access data – you have the right to request access to your personal data, including:

• whether we process your personal data,
• what scope of data we have,
• for what or for what purposes we process the data we have,
• to which recipients we may disclose your personal data,
• about the processing time, if it is possible to determine or about the planned period of storage of this data,
• about your rights,
• about the source of data acquisition in a situation where it has not been collected from you.

You also have the right to obtain a copy of your personal data.

On the basis of the submitted request, we will provide you with all information free of charge (subject to the inconvenient and regular request for further copies of the data, then we may charge a reasonable fee) and without undue delay, at the latest within one month of receiving the request. Due to the complex nature of the request or the number of requests, the deadline may be extended by another two months, but we will inform you about such extension within one month of receiving the request.

The right to rectify data – in a situation where the personal data we have is inconsistent or incorrect, you have the right to request rectification.

• Incorrect data is data that does not correspond to the actual state of affairs, i.e. false data. The accuracy of the data is assessed from the perspective of the data subject.
• Incomplete data is data that is valid but incomplete.

The right to delete data (the right to be forgotten) – you have the right to request deletion of data if one of the following circumstances occurs:

• personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
• an effective objection to the processing has been made,
• the personal data has been processed unlawfully,
• personal data must be removed in order to comply with a legal obligation,
• you have withdrawn your consent to the processing of personal data, and the personal data was processed on the basis of your consent and there is no other legal basis for their further processing.

It is worth remembering that you will not be able to exercise the right to delete data, if:

• the personal data is necessary to defend against or to pursue claims,
• the processing is based on the provisions of applicable law,
• the processing results from a concluded contract.

The right to limit data processing – you have the right to request the restriction of data processing in the following cases:

• if the correctness of personal data is questioned – for a period allowing for the verification of the correctness of such data;
• the processing is unlawful and the data subject objects to the deletion of personal data, requesting instead to limit their use;
• personal data is no longer necessary for us, but you need it to establish, investigate or defend against claims;
• in the event of an objection by you – until it is determined whether the legitimate grounds on our side override the grounds of the objection.

The right to data portability – you have the right to receive your personal data in a structured, commonly used and machine-readable format and you have the right to send this personal data to another administrator if:

• processing takes place on the basis of expressed consent or on the basis of a concluded contract, and at the same time the processing is carried out in an automated manner.

Please note that:

• the right to data portability may not adversely (negatively) affect the rights and freedoms of other persons, and
• responding to a request for data transfer, we are not responsible for the processing of this data neither by the data subject nor by the administrator to whom the data is transferred.

The right to object to data processing – You have the right to object at any time – for reasons related to your particular situation – to the processing of personal data, if the legal basis for processing is a task carried out in the legitimate public interest.

As a result of the objection, we will cease the processing of personal data, unless we demonstrate the existence of valid legally justified grounds for processing that override your interests, rights and freedoms, or grounds for establishing, investigating, pursuing or defending against claims.

If your personal data is processed for direct marketing purposes, you may object to such processing at any time, including profiling, without the need to demonstrate reasons related to your particular situation. Only objection to direct marketing, including profiling, is absolutely effective.

Automated decision making, including profiling – the data subject has the right not to be subject to a decision which:

• is based solely on automated processing, including profiling,
• produces legal effects on that person or affects that person in a significant way.

Making decisions based solely on automated data processing is permissible if the decision meets at least one of the three conditions:

• it is necessary for the conclusion or performance of a contract between you and us,
• it is permitted by law,
• it is based on the expressed consent.

Note: Decisions that are made with the participation of a person (i.e., where a human has a direct influence on the decision) are not subject to the above prohibition.

The right to lodge a complaint with a supervisory authority – you have the right to lodge a complaint with the President of the Personal Data Protection Office, if you believe that we are processing personal data in violation of the provisions. All necessary information can be found at www.uodo.gov.pl

The above-mentioned rights can be brought to the Data Protection Officer, through the following forms of communication:

• using the provided form at the link: https://ideas-ncbr.pl/ochrona-danych-osobowych/formularz-skladania-wnioskow-do-administratora-danych-osobowych/
• by sending an e-mail to the following address: iod@ideas-ncbr.pl or
• by writing to us to the following address: IDEAS NCBR Sp. z o.o. 00-695 Warsaw, ul. Nowogrodzka 47

Please be advised that we will carefully verify your requests, demands or objections in accordance with the applicable provisions on the protection of personal data. At the same time, we would like to inform you that the above-mentioned rights are not absolute, as the provisions allow them to be disregarded in certain situations that we have tried to outline here.