Who can exercise rights?
The rights of the data subjects continue to be very personal, so they can therefore be exercised by the owner of that data, who must provide proof of identity (an identity document will be requested).
However, rights can also be exercised via a legal representative, either due to incapacity or if the data subject is underage, making it impossible to exercise these rights in person.In this case, proof of these condition will be requested.
It can also done be via a voluntary representativewho has been specifically designated to exercise the right. In this case, the identity of the representative must be clearly accredited, by providing a copy of their National Identity Document and the granted representation power.
Pursuant to Art. 12 of the GDPR, where there is reasonable doubt as to the identity of the data subject or his or her representative, additional data may be requested.
How can I exercise my rights?
You may exercise your rights by communicating with the controller in charge of data processing. This communication must include the following:
- Sufficient identification of the applicant and, where applicable, his or her representative, as well as a document of representation, to enable the identity of the applicant to be verified before the entitlement is provided.
- The type of request being made.
- Address for notifications, data and requester’s signature.
- Accrediting documents for the drafted, where relevant.
- If the data subject requests any of their rights electronically, they will be responded to via the same means, unless the data subject specifically indicates otherwise.
To make it easier for you, we provide you with downloadable documents that you can fill in and send to us, which you can access below and which include instructions on how to complete them.
What are our obligations?
The controller must alwaysreply to the request that has been sent to them, regardless of whether the personal data of the data subject appears in their processing.
In the event that the application does not meet the specified requirements, the data controller shall request the correction of these, including, where appropriate, data that help to identify the applicant or his representative.
The data controller shall be responsible for proving the fulfilment of the duty to respondand must keep the proof of fulfilment of said duty.
The controller must reply within the time frame established by regulations, although when the workload allows it, an effort will be made to elaborate and provide the information in a shorter time. Remember that regulations establish that a reply must be issued within:
- 30 days
- Extension of up to two months in exceptionally complex situations are duly justified. The data subject must be informed if this is the case.
Below you can download the request models to exercise each right, and we provide a brief explanation of each one.
REQUEST RIGHT OF ACCESS
The data subject will have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed, and, where that is the case, access to to the personal data according to Article 15 of the GDPR.
REQUEST RIGHT TO RECTIFICATION
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her, and shall have the right to have incomplete personal data completed by means of providing a supplementary statement, according to Article 16 of the GDPR.
REQUEST RIGHT TO ERASURE
The data subject shall have the right to obtain from the controller the erasure of persona data concerning him or her without undue delay, according to Article 17 of the GDPR.
REQUEST RIGHT TO RESTRICT PROCESSING
The data subject shall have the right to obtain from the controller restriction of data processingin certain cases, according to Article 18 of the GDPR.
REQUEST RIGHT TO DATA PORTABILITY
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those to another controller without hindrance from the controller to which the personal data had been provided, according to Article 20 of the GDPR.
REQUEST RIGHT TO OBJECT
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which are object of data processing in certain circumstances, according to Article 21 of the GDPR.
REQUEST TO NOT BE OBJECT OF AUTOMATED DECISION-MAKING
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects significantly affecting him or her according to Article 22 of the GDPR.