The interested party can, at any time, exercise the rights recognised by the GDPR (the “Rights of the interested party”), and in particular:
Art. 15 – Right of access of the interested party: the interested party has the right to access their data and related Processes. This right is substantiated by the possibility of obtaining confirmation of whether or not a Personal Data Processing is being performed, or the possibility of requesting and receiving a copy of the data being processed;
Art. 16 – Right of rectification: the interested party has the right to have inaccurate personal data concerning him rectified by the Data Controller without undue delay. Taking into account the purposes of processing, the data subject will have the right to have incomplete personal data made complete, including by means of providing a supplementary statement.
Art. 17 – Right to deletion (“right to be forgotten”): the Data Subject has the right to ask the Da-ta Controller to delete Personal Data about him/her, and in some cases, where there is an end, to have it deleted without unjustified delay when the purpose of the Treatment has expired, or when consent has been revoked, opposition has been made to it being processed or where the processing of their personal data is not otherwise compliant with the GDPR;
Art. 18 – Right to limit processing: the interested party has the right to limit the processing of his/her personal data where there are inaccuracies or disputes, or as an alternative measure to having it deleted;
Art. 20 – Right to data portability: the interested party, with the exception of situations in which the data are archived by means of non-automated processing (e.g. in paper format), has the right to receive personal data in a structured format, that is commonly used and can be read using an automatic device, when the data refers to him/her, where reference is made to data supplied directly by the interested party, with express consent or on a contractual basis, and to request that these data be transmitted to another data controller, if technically feasible;
– Art. 21 – Right to object: the interested party has the right to object, at any time, for reasons related to his/her particular situation, the processing of personal data about him/her.
If the interested party wishes to exercise one of the rights listed above, he/she must address the request directly to the Data Controller at the addresses indicated above, apart from the right to lodge a complaint, which should be sent to the Guarantor Authority or by filing an appeal before the competent Court Authority.
The period for replying to the Interested party by the Owner is, for all of the rights (including the right of access) and also in case of denial, 1 month, which can be extended by up to 3 months in particularly complex cases.
In any event, by applying art. 12 GDPR.