The buyer has the following rights under GDPR:
(i) right to rectification, (ii) right to erasure, (iii) right to data portability, (iv) right to object, (v) withdrawal of consent, (vi) right of access to information.

Right to Rectification
The buyer has the right to request that the operator rectify any incorrect personal data concerning them and complete any incomplete personal data without undue delay.

Right to Erasure
The buyer has the right to request that the operator erase personal data concerning them without undue delay. The operator is obliged to erase this data without undue delay if any of the following reasons apply:

• The data is no longer necessary for the purpose for which it was collected or processed,
• The data subject withdraws consent for processing personal data for at least one specific purpose, or if the consent is invalid due to legal restrictions,
• The data subject objects to the processing of personal data, and there are no overriding legitimate grounds for processing, or the objection relates to direct marketing, including profiling,
• The personal data has been processed unlawfully,
• The erasure is necessary to comply with legal obligations under this law, a specific regulation, or an international agreement binding on Slovakia,
• The personal data was collected in connection with the offering of information society services to children under the age of 16.

If the operator has made personal data public and is obliged to erase it, they must also take appropriate security measures, including technical measures, to inform other operators processing the personal data about the request to erase links to the data and its copies or replications.

Right to Data Portability
The buyer has the right to receive personal data concerning them that they have provided to the operator in a structured, commonly used, and machine-readable format, and the right to transmit this data to another operator (controller), where technically feasible, if:

• The personal data is processed based on the data subject’s consent, a contract, and the consent is invalid if its provision excludes specific regulations,
• The processing is carried out by automated means.

Right to Object
The buyer has the right to object to the processing of personal data concerning them for the purposes of direct marketing, including profiling, in relation to direct marketing. The operator is obliged to explicitly inform the data subject of their rights no later than during the first communication, and this information must be provided clearly and separately from other information. The buyer can exercise this right using automated means with technical specifications.

Withdrawal of Consent
The buyer has the right to withdraw their consent to the processing of personal data concerning them at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal; the buyer must be informed about this fact before giving consent. The buyer can withdraw consent in the same way it was provided.

Right to Access to Information
The buyer has the right to obtain confirmation from the operator as to whether their personal data is being processed. If the operator processes personal data concerning the buyer, the buyer has the right to access this data and information about:

• The purposes of the processing,
• The categories of personal data being processed (in our case, this concerns standard personal data; the operator does not process special categories of data),
• The identity of the recipient or categories of recipients to whom the data has been or will be disclosed, especially if they are in a third country or an international organization, if possible,
• The data retention period; if not possible, information about the criteria used to determine it,
• The right to request rectification, erasure, or restriction of processing, or the right to object to the processing of personal data,
• The right to lodge a complaint,
• The source of the personal data if not obtained from the buyer,
• The existence of automated individual decision-making, including profiling, and in such cases, the operator must provide information about the procedure used, as well as the significance and expected consequences of such processing for the buyer.

The operator must provide the information within 30 days of receiving the request. This period may be extended by an additional 60 days, and the buyer will be informed about the delay.

For repeated requests for personal data, the operator may charge a reasonable fee corresponding to the administrative costs. The operator must provide the personal data in the manner requested or according to the buyer’s preference.

The operator reserves the right to verify the buyer’s identity and determine whether they are the correct individual requesting the data. Verification may involve additional information such as security questions. Verification is important for providing information about the personal data being processed and for the protection of personal data.

Right to Lodge a Complaint
The buyer has the right to lodge a complaint as per § 100 of the Law if they are directly affected regarding their rights. The complaint must contain the following: who is lodging the complaint, against whom the complaint is directed, the subject of the complaint, the rights violated during the processing of personal data, and evidence.

A sample complaint will be published on the website of the Office for Personal Data Protection, Hraničná 12, 820 02, Bratislava. The Office will assess the complaint within 30 days, decide within 90 days, or extend the deadline if necessary.