The processing of personal data is carried out by the Administrator. The Administrator has determined the scope, purpose and period of processing of personal data in individual agendas in accordance with the legal basis for processing. Processing is carried out in its premises and registered office by individual authorized employees of the Administrator, or by the processor. Processing takes place using computer technology, or also manually in the case of personal data in paper form, in compliance with all security principles for the management and processing of personal data. For this purpose, the Administrator has adopted technical and organizational measures to ensure the protection of personal data, in particular measures to prevent unauthorized or accidental access to personal data, their alteration, destruction or loss, unauthorized transfers, their unauthorized processing, as well as other misuse of personal data. All entities to which personal data may be made available respect the right of data subjects to privacy and are obliged to proceed in accordance with applicable legal regulations relating to the protection of personal data. When processing personal data by the Administrator, automated decision-making within the meaning of Article 22 of the GDPR does not occur.

Rights of data subjects
In accordance with the GDPR, the data subject has the rights listed below. If these are rights against the Administrator, the data subject is entitled to exercise them at the contact addresses specified in Article 1 of these Principles.

1. Right to access personal data
According to Art. 15 GDPR, the data subject has the right to access personal data, which includes the right to obtain from the Controller information as to whether or not personal data concerning him or her are being processed, and if so, the right to obtain access to such personal data and information on:

a) the purposes of the processing

b) the categories of personal data concerned

c) the recipients to whom the personal data have been or will be disclosed

d) the planned duration of the processing

e) the existence of the right to request from the Controller the rectification or erasure of personal data concerning the data subject or the restriction of their processing or to object to such processing

f) the right to lodge a complaint with a supervisory authority

g) any available information on the source of the personal data, unless they are obtained from the data subject

h) the fact that automated decision-making, including profiling, is taking place

i) appropriate safeguards when transferring data outside the EU

In the event that the rights and freedoms of other persons are not adversely affected, the data subject also has the right to request a copy of the processed personal data. In the event of a repeated request, the Controller is entitled to charge a reasonable fee for a copy of the personal data.

2. Right to rectification of inaccurate data
According to Article 16 of the GDPR, the data subject has the right to rectification of inaccurate or incomplete personal data processed by the Controller about him/her. The data subject is obliged to notify changes to his/her personal data and to provide evidence that such a change has occurred. At the same time, he/she is obliged to provide the Controller with cooperation if it is found that the personal data processed about him/her are inaccurate.

3. Right to erasure
According to Article 17 of the GDPR, the data subject has the right to erasure of personal data concerning him/her, except in cases where the Controller demonstrates one of the legal grounds for processing such personal data.

4. Right to restriction of processing
According to Article 18 of the GDPR, the data subject has the right to restriction of processing, pending resolution of the complaint or objection, if he/she disputes the accuracy of the personal data, the reasons for their processing or if he/she objects to their processing. If processing has been restricted, the personal data in question, with the exception of their storage, may only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or one of its Member States.

5. Notification obligation of the Controller
In the event of rectification, erasure or restriction of processing of personal data, the Controller is obliged under Article 19 of the GDPR to inform the individual recipients of the personal data of this fact, except where this proves impossible or involves disproportionate effort. Upon request from the data subject, the Controller shall provide the data subject with information about these recipients.

6. Right to data portability
Article. 20 GDPR establishes the right of the data subject to the portability of data concerning him or her, which he or she has provided to the Controller in a structured, commonly used and machine-readable format, and the right to request the Controller to transmit such data to another controller, where the processing of personal data is based on the conclusion and performance of a contract or on the consent of the data subject and the processing is carried out by automated means. If the exercise of this right is likely to adversely affect the rights and freedoms of third parties, such a request cannot be complied with.

7. Right to object to the processing of personal data
According to Article 21 GDPR, the data subject has the right to object to the processing of his or her personal data on the grounds of the legitimate interests of the Controller. Where the Controller does not demonstrate compelling legitimate grounds for the processing which override the interests or rights of the data subject,