obliged to inform all recipients to whom personal data have been disclosed on any rectification of personal data, unless this proves impossible or requires excessive time and resources. At the request of the Data Subject the Bank shall inform the Data Subject on all recipients.

- 9. Right to Erasure

The Data Subject shall be entitled to initiate the erasure of personal data concerning him/her in the following cases:

- a) the personal data are no longer necessary for the purposes they were collected or otherwise processed;
- b) the Data Subject withdraws the consent granted, by virtue of which processing was performed, and no other legal basis exists for processing;
- c) the Data Subject objects to the processing, and there is no other legal basis for the processing overriding legitimate reasons, rights or freedoms of Data Subject;
- d) Data Subject’s personal data were unlawfully processed;
- e) Personal data must be erased in order to comply with an obligation imposed on the Controller by Law;
- f) The personal data have been collected in relation to using services of information society.

Where the Bank has previously disclosed the personal data of the Data Subject and has an obligation to erase thereof, the Bank shall take all reasonable measures, including the implementation of technical measures, that are necessary in order to inform those data controllers that obtained the Data Subject’s personal data, of the mandatory erasure of such personal data. In its notice, the Bank is obliged to notify all other data controllers that the Data Subject has requested that all the links to the Data Subject’s personal data or the copies and duplicates of such personal data be erased.

After granting the Data Subject’s request for the enforcement of the right to erasure, the Bank shall inform all recipients to whom the Data Subject’s personal data have been disclosed of each single erasure of personal data, unless this proves impossible or involves excessive time and resources. At the request of the Data Subject the Bank shall inform the Data Subject on all recipients.

The Bank shall be under no obligation to erase personal data to the extent in which processing is required due to:

- a) exercising freedom of expression and information;
- b) complying with the statutory obligation of the Bank requiring processing or execution of tasks in the public interest or performance of Controller’s official duties;
- c) the realization of public interest in the area of public health;
- d) for the purpose of archiving in the public interest, scientific or historical research as well as statistical purposes, and it is reasonably expected that the exercise of this right could prevent or significantly jeopardize realization of objectives of that purpose;
- e) for the submission, enforcement or defense of legal claims.
- 10. Right to restriction of processing

The Data Subject shall be entitled to restriction of processing by the Bank where any of the following applies:

- a) the accuracy of the personal data is contested by the Data Subject, for a period enabling the Bank to verify the accuracy of the personal data;
- b) the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
- c) the Bank no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the submission, enforcement or defense of legal claims;
- d) the Data Subject has objected to processing, pending verification whether the legitimate grounds of the Bank override those of the Data Subject.

If processing has been restricted, such personal data may be further processed only with the Data Subject’s consent, with the exception of storage thereof or for the submission, enforcement or defense of legal claims or for the protection of the rights of another natural persons, i.e. legal entities or for reasons of important public interest.

The Data Subject shall be informed by the Bank before the restriction of processing is lifted.

After granting the Data Subject’s request, the Bank shall inform all recipients to whom the Data Subject’s personal data have been disclosed of the processing restriction thereof, unless this proves impossible or involves excessive time and resources. At the request of the Data Subject the Bank shall inform the Data Subject on all recipients.

- 11. Right to object

If, according to the provisions of this Notice, processing is necessary for the purposes of the legitimate interests pursued by the Bank or by a third party, the Data Subject may object to their personal data being processed for those purposes. The Bank shall no longer process personal data of the person who objected, unless it can demonstrate legitimate grounds for the processing that override the interests, rights and freedoms of the Data Subject, or for the submission, enforcement or defense of legal claims.

- 12. Right to data portability

The Data Subject is entitled to receive from the Bank his/her personal data previously submitted to the Bank in a structured, commonly used and electronically-readable format:

- a) processing is based on a consent;
- b) processing is automated.