Fact sheet

Register new users

Name (*)

Company Header (*)

Phone (*)

E-mail (*)

Data sheet grade (e.g. MPN 35). (*)

Consents pursuant to and by the effects of articles 7 and 8 of EU Regulation 2016/679 of the European Parliament and Council, by signing this form, to the processing of personal data and web services from MPI srl according to the methods and within the limitations as per the following information.Consents pursuant to and by the effects of articles 7 and 8 of EU Regulation 2016/679 of the European Parliament and Council, by signing this form, to the processing of personal data, web services and to receiving newsletter from MPI srl, according to the methods and within the limitations as per the following information.

Dear Customer,
Mr. Erminio Belotti of the company M.P.I. MAGNETI PERMANENTI INDUSTRIALI S.r.l. with registered office in Via G.B. Vico, 25/B – 20007 Cornaredo, (MI), VAT 07684030153, in his capacity as Controller of the personal data processing, would like to inform you that EU Regulation 2016/679 of the European Parliament and Council (“General Regulation on Data Protection), establishes regulations on the protection of natural persons as regards processing of personal data, as well as regulations concerning the free circulation of said data.
The regulation protects the rights and fundamental freedoms of natural persons, specifically the right to personal data protection.
The data controller (natural or legal person who establishes the aims and methods for personal data processing) implements appropriate measures to provide the data subject with all information concerning the processing.
According to the indicated regulations, said processing shall be inspired by principles of fairness, lawfulness and transparency and protection of your confidentiality and your rights.
Pursuant to article 12 of EU Regulation 2016/679, in case of collection from the data subject of data concerning them, the Data Controller provides the following information to the data subject, when the personal data are obtained:
1. Object of the Processing
The Data Controller handles the personal data, identification of a natural person (data subject) such as name, surname, ID number, company name, address, telephone, email, bank and payment details etc. you have provided upon entering into contracts for the Data Controller’s services.
2. Data Controller and Representative of the Controller
The Data Controller is: Mr. Erminio Belotti.
c/o M.P.I. MAGNETI PERMANENTI INDUSTRIALI S.r.l. with registered office in Via G.B. Vico, 25/B – 20007 Cornaredo, (MI), VAT 07684030153, Tel +39 02 93566034 / Fax +39 02 93561592, privacy@mpi.it
The Representative of the Data Controller (where applicable) is: Not appointed.
The updated list of the Data Processors (where applicable) and persons in charge of processing is kept at the registered office of the Data Controller.
3. Person Responsible for Data Protection (where applicable)
The Person Responsible for data protection is: Not appointed.
4. Aims of data processing
The data provided by you shall be processed without your express Consent for the following aims:
3A) execution of pre-contractual measures
4A) legal obligation the data controller is subject to
7A) pursuit of the lawful interest of the Data Controller or third parties.
The data provided by you shall be processed with your specific written Consent for the following aims (where applicable):
1B) Marketing activities (NA)
2B) Activation and management of the service to send newsletter
3B) Activation and management of the services through the company’s website
The data processing is lawful because:
1C) the data subject has expressed their consent to processing their personal data (services from the company’s website)
3C) the processing is required to fulfil a legal obligation the Controller of processing is subject to
6C) the processing is required for the pursuit of the lawful interest of the Controller of the processing or of third parties, provided that they do not undermine the data subject’s interests or rights and fundamental freedoms that require personal data protection, in particular if the data subject is a minor. (services from the company’s website)
5. Lawful interests of the data controller (where applicable only if the lawfulness conditions of the processing under point 3 are type 6C)
The processing of data is based on the following lawful interests: any right to legal defence.
6. Methods of data processing
The personal data are processed by means of the operations set out in art. 4 par. 2) and more precisely: the collection, recording, organisation, layout, storage, adaptation or modification, extraction, referencing, use, disclosure by sending, disseminating or any other form of disclosure, comparison or interconnection, limitation, deletion or destruction;
the data are processed by using appropriate instruments and procedures to assure safety and confidentiality.
The personal data shall be processed with the following methods:
■ paper manual
■ computerised manual (without automated decision process)
□ computerised with automated decision process including profiling: in that case it is required to indicate the logic used and the expected consequences of said processing for the data subject. ____________________________
□ other: Filming
7. Data disclosure
With no need for express consent (pursuant to art. 6 lett. b) and c)), the Data Controller may disclose your data for the purposes referred to above to Supervisory Bodies, Judicial Authorities, to insurance companies, as well as to entities to whom disclosure is mandatory by law for the accomplishment of said purposes. Said entities shall process the data in their capacity as independent data controllers.
□ the data shall not be disclosed to any category of recipients, nor will they be subject to any manner of disclosure
□ the data shall not be disclosed to other recipients, nor will they be subject to any manner of disclosure
■ the data may be/shall be disclosed to the following categories of recipients: external managers who take part in company processes solely to fulfil specific legal obligations and in compliance with contractual obligations, public and private bodies for social security, welfare and insurance purposes
□ the data may be/shall be disclosed to the following recipients
8. Disclosure of the data to a third party country or international organisation
■ The personal data shall not be sent to a third party country or international organisation.
□ The personal data shall be sent to a third party country or international organisation;
□ The third party country/international organisation is________________;
Furthermore, please note that:
□ There is a decision of adequacy of the Commission;
□ There is no decision of adequacy of the Commission.
9. Nature of the provision of data and consequences of the refusal to answer
The Data Controller is obliged to inform the data subject if the disclosure of the personal data is a legal or contractual obligation or a necessary requirement for entering into a contract, and whether the data subject is obliged to provide their personal data as well as the possible consequences of failure to provide said data;
The provision of the data is:
■ mandatory (Point 4, letter A)
■ optional (Point 4, letter B) (services from the company’s website)
In the case where the data provision for the indicated purposes is mandatory, the reason of the obligation is due to execution of precontract measures.
In the case where the data provision for the indicated purposes is mandatory, any refusal to provide said data:
□ has no consequence,
□ might entail failed execution of the contract,
□ might entail partial execution of the contract,
□ failed continuation of the contract,
■ failure to provide the services;
□ other.
In the case where the data provision for the indicated purposes is not mandatory, any refusal to provide said data:
□ has no consequence,
□ failed continuation of the contract,
■ failure to provide the services (services from the company’s website)
□ other.
10. Data Storage
The Data Controller shall process the personal data for the time strictly required to fulfil the above purposes.
■ The processed personal data shall be stored for the activation period of the service and for a maximum time of 5 years from its discontinuation.
11. Rights of the data subject
The data subject may exercise their rights with the data controller at any time.
Art. 13 letter b) of EU Regulation 2016/679, states that when the personal data are obtained, the data controller provides the data subject with the existence of the following rights required to assure correct and transparent processing of the personal data:
- access to the data (Art. 15)
- rectification of data processing (art. 16)
- cancellation of the data (Art. 17)
- limitation of data processing (Art. 18)
- objection to data processing (Art. 21)
- portability of the data (Art. 20).
In addition to the rights under article 13, the EU Regulation set forth additional rights that may be exercised by the data subject:
- revocation of consent (Art. 7)
- complain with an oversight authority (Art. 77).
The articles that specifically deal with the individual rights of the Data Subject are attached.
12. Right to revocation of consent (Art. 7)
Art. 7 paragraph 3, states that the data subject has the right to revoke their consent at any time in the following cases:
- where the processing is based on consent given to processing of one’s data for one or more specific purposes (article 6, paragraph 1, letter a),
- where the processing concerns the particular categories of personal data (personal data that reveal race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data regarding health or sexual life or sexual orientation) and is based on consent given to processing of one’s data for one or more specific purposes (article 9, paragraph 2, letter a).
Revocation of consent does not prejudice the lawfulness of the processing based on consent given before the revocation.
The data subject is informed on that prior to giving their consent. The consent is revoked with the same ease with which it is granted.
13. Right to complain with an oversight authority (Art. 77)
Art. 77 states that the data subject, should they believe that the processing concerning them infringes this regulation, has the right to complain with an oversight authority, specifically in the member State where they normally reside or work or where the alleged infringement took place. Without prejudice to bringing any other administrative or judicial proceedings.
The Data Controller informs the data subject of the option of complaining with an oversight authority and to bring judicial proceedings.
The oversight authority the complaint has been filed with, informs the complainant of the status or outcome of the complaint, including the option of bringing judicial proceedings pursuant to article 78.
The data subject also has the right to bring actual judicial proceedings, should the oversight authority fail to handle the complaint or fail to inform them within three months of the status or outcome of the complaint filed. Without prejudice to bringing any other administrative or judicial proceedings.
14. Methods to exercise the data subject’s rights
The data subject may exercise the rights at any time by sending to the Data Controller and/or the Data Processor (where appointed):
- a registered letter with return receipt sent to: M.P.I. MAGNETI PERMANENTI INDUSTRIALI S.R.L. with registered office in Via G.B. Vico, 25/B – 20007 Cornaredo, (MI), VAT 07684030153;
- an email to: privacy@mpi.it
ANNEXES:
10. RIGHTS OF THE DATA SUBJECT (Articles 13-21)
10.1. Right to access the personal data (art. 15)
“1. The data subject has the right to obtain from the data controller confirmation on whether processing of personal data concerning them is underway or not and in that case, to obtain access to the personal data and the following information:
a) the aims of processing;
b) the categories of the personal data in question;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if the recipients are in third party countries or international organisations;
d) where possible, the intended period of storage of the personal data or, if not possible, the criteria used to determine said period;
e) the existence of the right of the data subject to request the data controller to rectify or delete the personal data or limit the processing of personal data concerning them or to object to their processing;
f) the right to file a complaint with an oversight authority;
g) where the data have not been collected from the data subject, all available information on their origin;
h) the existence of an automated decisional process, including profiling referred to in article 22, paragraphs 1 and 4 and, at least in such cases, significant information on the logic used, as well as the importance and intended consequences of said processing for the data subject.
2. Should the personal data be transferred to a third party country or international organisation, the data subject has the right to be informed of the existence of adequate warranties pursuant to article 46 relating to the transfer.
3. The data controller provides a copy of the personal data subject to processing.
In case additional copies should be requested by the data subject, the data controller may charge a reasonable expense contribution based on administrative costs. Should the data subject apply by electronic means, and unless indicated otherwise by the data subject, the information is provided in a commonly used electronic form.
4. The right to obtain a copy under paragraph 3 must not affect the rights and freedoms of others.”
10.2. Right to rectify the personal data (Art. 16)
“The data subject has the right to obtain from the data controller the rectification of incorrect personal data concerning them with no unjustified delay. Taking into account the purposes of the processing, the data subject has the right to obtain integration of incomplete personal data, also providing an integrative statement.”
10.3. Right of deletion of personal data («right to be forgotten») (Art. 17)
“1. The data subject has the right to obtain from the data controller the deletion of the personal data concerning them with no unjustified delay and the data controller is obliged to delete the personal data with no unjustified delay, for one of the following reasons:
a) the personal data are no longer necessary for the aims for which they were collected or otherwise processed;
b) the data subject revokes the consent on which processing is based in compliance with article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a), and if there is no other legal foundation for the processing;
c) the data subject objects to the processing pursuant to article 21, paragraph 1, and there is no prevailing lawful reasons to perform processing, or they object to the processing pursuant to article 21, paragraph 2;
d) the personal data were processed unlawfully;
e) the personal data must be deleted to fulfil a legal obligation set forth by the laws of the European Union or of the member State the data controller is subject to;
f) the personal data were collected with regards to the offer of information society services pursuant to article 8, paragraph 1.”
10.4. Right to the limitation of personal data processing (Art. 18)
“1. The data subject has the right to obtain the limitation of processing from the data controller when one of the following cases applies:
a) the data subject disputes the accuracy of personal data for the period required for the data controller to ascertain the accuracy of said personal data;
b) the processing is unlawful and the data subject objects to the deletion of the personal data and asks their use to be restricted instead;
c) although the data controller no longer needs them for the aims of processing, the data subject needs the personal data for ascertaining, exercising or protecting a right in court;
d) the data subject objected to the processing pursuant to article 21, paragraph 1, pending ascertainment of any prevalence of the data controller’s lawful reasons over those of the data subject.
2. If processing is restricted pursuant to paragraph 1, said personal data are processed, except for storage, only with the data subject’s consent or for ascertaining, exercising or protecting a right in court, or to protect the rights of another natural or legal person or for reasons of significant public interest for the European Union
or a member State.
3. The data subject who has obtained limitation of processing pursuant to paragraph 1, is informed by the data controller prior to revoking said limitation.”
10.5. Right to object to personal data processing (Art. 21)
1. The data subject has the right to object at any time, for reasons connected to their particular situation, to processing of personal data concerning them pursuant to article 6, paragraph 1, letters e) or f), including profiling on the basis of said provisions.
The data controller refrains from further processing the personal data unless they prove the existence of mandatory lawful reasons to perform processing overriding the interests, rights and freedoms of the data subject or for ascertaining, exercising or protecting a right in court.
2. Should the personal data be processed for aims of direct marketing, the data subject has the right to object to processing of personal data concerning them for said purpose at any time, including profiling to the extent it is connected to said direct marketing.
3. Should the data subject object to processing for the purpose of direct marketing, the personal data are no longer processed for said purposes.
4. The data subject is expressly made aware of the right referred to in paragraphs 1 and 2 which is presented clearly and separately from any other information, no later than the time of first communication with the data subject.
5. Within the context of the use of information society services and without prejudice to directive 2002/58/EC, the data subject may exercise their right to objection with automated means that use specific techniques.
6. Should the personal data be processed for the purpose of scientific or historical research or for statistical purposes pursuant to article 89, paragraph 1, for reasons connected to their particular situation, the data subject has the right to object to the processing of personal data concerning them, except where the processing is required for executing a task of public interest.”
10.6. Right to portability of the personal data (Art. 20)
“1. The data subject has the right to receive the personal data concerning them that had been provided to a data controller in a structured, commonly used form, readable with an automatic device and has the right to send said data to another data controller with no impediments by the data controller they had provided them to where:
a) processing is based on consent pursuant to article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a), or on a contract pursuant to article 6, paragraph 1, letter b); and
b) processing is carried out with automated means.
2. When exercising their rights related to data portability pursuant to paragraph 1, the data subject has the right to have the personal data sent directly by one data controller to another, when technically feasible.
3. Exercising the right referred to in paragraph 1 of this article is without prejudice to article 17. Said right does not apply to processing required for executing a task of public interest or connected to exercising public rights the data controller is vested with.
4. The right referred to in paragraph 1 must not harm the rights and freedoms of others.”

Dear Customer,
Mr. Erminio Belotti of the company M.P.I. MAGNETI PERMANENTI INDUSTRIALI S.r.l. with registered office in Via G.B. Vico, 25/B – 20007 Cornaredo, (MI), VAT 07684030153, in his capacity as Controller of the personal data processing, would like to inform you that EU Regulation 2016/679 of the European Parliament and Council (“General Regulation on Data Protection), establishes regulations on the protection of natural persons as regards processing of personal data, as well as regulations concerning the free circulation of said data.
The regulation protects the rights and fundamental freedoms of natural persons, specifically the right to personal data protection.
The data controller (natural or legal person who establishes the aims and methods for personal data processing) implements appropriate measures to provide the data subject with all information concerning the processing.
According to the indicated regulations, said processing shall be inspired by principles of fairness, lawfulness and transparency and protection of your confidentiality and your rights.
Pursuant to article 12 of EU Regulation 2016/679, in case of collection from the data subject of data concerning them, the Data Controller provides the following information to the data subject, when the personal data are obtained:
1. Object of the Processing
The Data Controller handles the personal data, identification of a natural person (data subject) such as name, surname, ID number, company name, address, telephone, email, bank and payment details etc. you have provided upon entering into contracts for the Data Controller’s services.
2. Data Controller and Representative of the Controller
The Data Controller is: Mr. Erminio Belotti.
c/o M.P.I. MAGNETI PERMANENTI INDUSTRIALI S.r.l. with registered office in Via G.B. Vico, 25/B – 20007 Cornaredo, (MI), VAT 07684030153, Tel +39 02 93566034 / Fax +39 02 93561592, privacy@mpi.it
The Representative of the Data Controller (where applicable) is: Not appointed.
The updated list of the Data Processors (where applicable) and persons in charge of processing is kept at the registered office of the Data Controller.
3. Person Responsible for Data Protection (where applicable)
The Person Responsible for data protection is: Not appointed.
4. Aims of data processing
The data provided by you shall be processed without your express Consent for the following aims:
3A) execution of pre-contractual measures
4A) legal obligation the data controller is subject to
7A) pursuit of the lawful interest of the Data Controller or third parties.
The data provided by you shall be processed with your specific written Consent for the following aims (where applicable):
1B) Marketing activities (NA)
2B) Activation and management of the service to send newsletter
3B) Activation and management of the services through the company’s website
The data processing is lawful because:
1C) the data subject has expressed their consent to processing their personal data (services from the company’s website and newsletter)
3C) the processing is required to fulfil a legal obligation the Controller of processing is subject to
6C) the processing is required for the pursuit of the lawful interest of the Controller of the processing or of third parties, provided that they do not undermine the data subject’s interests or rights and fundamental freedoms that require personal data protection, in particular if the data subject is a minor. (services from the company’s website and newsletter)
5. Lawful interests of the data controller (where applicable only if the lawfulness conditions of the processing under point 3 are type 6C)
The processing of data is based on the following lawful interests: any right to legal defence.
6. Methods of data processing
The personal data are processed by means of the operations set out in art. 4 par. 2) and more precisely: the collection, recording, organisation, layout, storage, adaptation or modification, extraction, referencing, use, disclosure by sending, disseminating or any other form of disclosure, comparison or interconnection, limitation, deletion or destruction;
the data are processed by using appropriate instruments and procedures to assure safety and confidentiality.
The personal data shall be processed with the following methods:
■ paper manual
■ computerised manual (without automated decision process)
□ computerised with automated decision process including profiling: in that case it is required to indicate the logic used and the expected consequences of said processing for the data subject. ____________________________
□ other: Filming
7. Data disclosure
With no need for express consent (pursuant to art. 6 lett. b) and c)), the Data Controller may disclose your data for the purposes referred to above to Supervisory Bodies, Judicial Authorities, to insurance companies, as well as to entities to whom disclosure is mandatory by law for the accomplishment of said purposes. Said entities shall process the data in their capacity as independent data controllers.
□ the data shall not be disclosed to any category of recipients, nor will they be subject to any manner of disclosure
□ the data shall not be disclosed to other recipients, nor will they be subject to any manner of disclosure
■ the data may be/shall be disclosed to the following categories of recipients: external managers who take part in company processes solely to fulfil specific legal obligations and in compliance with contractual obligations, public and private bodies for social security, welfare and insurance purposes
□ the data may be/shall be disclosed to the following recipients
8. Disclosure of the data to a third party country or international organisation
■ The personal data shall not be sent to a third party country or international organisation.
□ The personal data shall be sent to a third party country or international organisation;
□ The third party country/international organisation is________________;
Furthermore, please note that:
□ There is a decision of adequacy of the Commission;
□ There is no decision of adequacy of the Commission.
9. Nature of the provision of data and consequences of the refusal to answer
The Data Controller is obliged to inform the data subject if the disclosure of the personal data is a legal or contractual obligation or a necessary requirement for entering into a contract, and whether the data subject is obliged to provide their personal data as well as the possible consequences of failure to provide said data;
The provision of the data is:
■ mandatory (Point 4, letter A)
■ optional (Point 4, letter B) (services from the company’s website and newsletter)
In the case where the data provision for the indicated purposes is mandatory, the reason of the obligation is due to execution of precontract measures.
In the case where the data provision for the indicated purposes is mandatory, any refusal to provide said data:
□ has no consequence,
□ might entail failed execution of the contract,
□ might entail partial execution of the contract,
□ failed continuation of the contract,
■ failure to provide the services;
□ other.
In the case where the data provision for the indicated purposes is not mandatory, any refusal to provide said data:
□ has no consequence,
□ failed continuation of the contract,
■ failure to provide the services (services from the company’s website and newsletter)
□ other.
10. Data Storage
The Data Controller shall process the personal data for the time strictly required to fulfil the above purposes.
■ The processed personal data shall be stored for the activation period of the service and for a maximum time of 5 years from its discontinuation.
11. Rights of the data subject
The data subject may exercise their rights with the data controller at any time.
Art. 13 letter b) of EU Regulation 2016/679, states that when the personal data are obtained, the data controller provides the data subject with the existence of the following rights required to assure correct and transparent processing of the personal data:
- access to the data (Art. 15)
- rectification of data processing (art. 16)
- cancellation of the data (Art. 17)
- limitation of data processing (Art. 18)
- objection to data processing (Art. 21)
- portability of the data (Art. 20).
In addition to the rights under article 13, the EU Regulation set forth additional rights that may be exercised by the data subject:
- revocation of consent (Art. 7)
- complain with an oversight authority (Art. 77).
The articles that specifically deal with the individual rights of the Data Subject are attached.
12. Right to revocation of consent (Art. 7)
Art. 7 paragraph 3, states that the data subject has the right to revoke their consent at any time in the following cases:
- where the processing is based on consent given to processing of one’s data for one or more specific purposes (article 6, paragraph 1, letter a),
- where the processing concerns the particular categories of personal data (personal data that reveal race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data regarding health or sexual life or sexual orientation) and is based on consent given to processing of one’s data for one or more specific purposes (article 9, paragraph 2, letter a).
Revocation of consent does not prejudice the lawfulness of the processing based on consent given before the revocation.
The data subject is informed on that prior to giving their consent. The consent is revoked with the same ease with which it is granted.
13. Right to complain with an oversight authority (Art. 77)
Art. 77 states that the data subject, should they believe that the processing concerning them infringes this regulation, has the right to complain with an oversight authority, specifically in the member State where they normally reside or work or where the alleged infringement took place. Without prejudice to bringing any other administrative or judicial proceedings.
The Data Controller informs the data subject of the option of complaining with an oversight authority and to bring judicial proceedings.
The oversight authority the complaint has been filed with, informs the complainant of the status or outcome of the complaint, including the option of bringing judicial proceedings pursuant to article 78.
The data subject also has the right to bring actual judicial proceedings, should the oversight authority fail to handle the complaint or fail to inform them within three months of the status or outcome of the complaint filed. Without prejudice to bringing any other administrative or judicial proceedings.
14. Methods to exercise the data subject’s rights
The data subject may exercise the rights at any time by sending to the Data Controller and/or the Data Processor (where appointed):
- a registered letter with return receipt sent to: M.P.I. MAGNETI PERMANENTI INDUSTRIALI S.R.L. with registered office in Via G.B. Vico, 25/B – 20007 Cornaredo, (MI), VAT 07684030153;
- an email to: privacy@mpi.it
ANNEXES:
10. RIGHTS OF THE DATA SUBJECT (Articles 13-21)
10.1. Right to access the personal data (art. 15)
“1. The data subject has the right to obtain from the data controller confirmation on whether processing of personal data concerning them is underway or not and in that case, to obtain access to the personal data and the following information:
a) the aims of processing;
b) the categories of the personal data in question;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if the recipients are in third party countries or international organisations;
d) where possible, the intended period of storage of the personal data or, if not possible, the criteria used to determine said period;
e) the existence of the right of the data subject to request the data controller to rectify or delete the personal data or limit the processing of personal data concerning them or to object to their processing;
f) the right to file a complaint with an oversight authority;
g) where the data have not been collected from the data subject, all available information on their origin;
h) the existence of an automated decisional process, including profiling referred to in article 22, paragraphs 1 and 4 and, at least in such cases, significant information on the logic used, as well as the importance and intended consequences of said processing for the data subject.
2. Should the personal data be transferred to a third party country or international organisation, the data subject has the right to be informed of the existence of adequate warranties pursuant to article 46 relating to the transfer.
3. The data controller provides a copy of the personal data subject to processing.
In case additional copies should be requested by the data subject, the data controller may charge a reasonable expense contribution based on administrative costs. Should the data subject apply by electronic means, and unless indicated otherwise by the data subject, the information is provided in a commonly used electronic form.
4. The right to obtain a copy under paragraph 3 must not affect the rights and freedoms of others.”
10.2. Right to rectify the personal data (Art. 16)
“The data subject has the right to obtain from the data controller the rectification of incorrect personal data concerning them with no unjustified delay. Taking into account the purposes of the processing, the data subject has the right to obtain integration of incomplete personal data, also providing an integrative statement.”
10.3. Right of deletion of personal data («right to be forgotten») (Art. 17)
“1. The data subject has the right to obtain from the data controller the deletion of the personal data concerning them with no unjustified delay and the data controller is obliged to delete the personal data with no unjustified delay, for one of the following reasons:
a) the personal data are no longer necessary for the aims for which they were collected or otherwise processed;
b) the data subject revokes the consent on which processing is based in compliance with article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a), and if there is no other legal foundation for the processing;
c) the data subject objects to the processing pursuant to article 21, paragraph 1, and there is no prevailing lawful reasons to perform processing, or they object to the processing pursuant to article 21, paragraph 2;
d) the personal data were processed unlawfully;
e) the personal data must be deleted to fulfil a legal obligation set forth by the laws of the European Union or of the member State the data controller is subject to;
f) the personal data were collected with regards to the offer of information society services pursuant to article 8, paragraph 1.”
10.4. Right to the limitation of personal data processing (Art. 18)
“1. The data subject has the right to obtain the limitation of processing from the data controller when one of the following cases applies:
a) the data subject disputes the accuracy of personal data for the period required for the data controller to ascertain the accuracy of said personal data;
b) the processing is unlawful and the data subject objects to the deletion of the personal data and asks their use to be restricted instead;
c) although the data controller no longer needs them for the aims of processing, the data subject needs the personal data for ascertaining, exercising or protecting a right in court;
d) the data subject objected to the processing pursuant to article 21, paragraph 1, pending ascertainment of any prevalence of the data controller’s lawful reasons over those of the data subject.
2. If processing is restricted pursuant to paragraph 1, said personal data are processed, except for storage, only with the data subject’s consent or for ascertaining, exercising or protecting a right in court, or to protect the rights of another natural or legal person or for reasons of significant public interest for the European Union
or a member State.
3. The data subject who has obtained limitation of processing pursuant to paragraph 1, is informed by the data controller prior to revoking said limitation.”
10.5. Right to object to personal data processing (Art. 21)
1. The data subject has the right to object at any time, for reasons connected to their particular situation, to processing of personal data concerning them pursuant to article 6, paragraph 1, letters e) or f), including profiling on the basis of said provisions.
The data controller refrains from further processing the personal data unless they prove the existence of mandatory lawful reasons to perform processing overriding the interests, rights and freedoms of the data subject or for ascertaining, exercising or protecting a right in court.
2. Should the personal data be processed for aims of direct marketing, the data subject has the right to object to processing of personal data concerning them for said purpose at any time, including profiling to the extent it is connected to said direct marketing.
3. Should the data subject object to processing for the purpose of direct marketing, the personal data are no longer processed for said purposes.
4. The data subject is expressly made aware of the right referred to in paragraphs 1 and 2 which is presented clearly and separately from any other information, no later than the time of first communication with the data subject.
5. Within the context of the use of information society services and without prejudice to directive 2002/58/EC, the data subject may exercise their right to objection with automated means that use specific techniques.
6. Should the personal data be processed for the purpose of scientific or historical research or for statistical purposes pursuant to article 89, paragraph 1, for reasons connected to their particular situation, the data subject has the right to object to the processing of personal data concerning them, except where the processing is required for executing a task of public interest.”
10.6. Right to portability of the personal data (Art. 20)
“1. The data subject has the right to receive the personal data concerning them that had been provided to a data controller in a structured, commonly used form, readable with an automatic device and has the right to send said data to another data controller with no impediments by the data controller they had provided them to where:
a) processing is based on consent pursuant to article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a), or on a contract pursuant to article 6, paragraph 1, letter b); and
b) processing is carried out with automated means.
2. When exercising their rights related to data portability pursuant to paragraph 1, the data subject has the right to have the personal data sent directly by one data controller to another, when technically feasible.
3. Exercising the right referred to in paragraph 1 of this article is without prejudice to article 17. Said right does not apply to processing required for executing a task of public interest or connected to exercising public rights the data controller is vested with.
4. The right referred to in paragraph 1 must not harm the rights and freedoms of others.”