- 6. Rights of Data Subjects

The Data Subject’s rights in terms of personal data processing, including the right to legal remedy, are governed by the provisions of the Law. The Data Subject may request the Bank:

- a) To provide information whether the Bank processes his/her personal data and access to such data in accordance with Article 26 of the Law (right of access);
- b) To rectify any inaccurate personal data without any undue delay. Depending on the purpose of processing, the Data Subject is entitled to supplement his/her incomplete personal data, which also includes giving of additional statement;
- c) To erase his/her personal data (right to erasure);
- d) To restrict the processing of his/her personal data (right to restriction of processing);
- e) To receive from the Bank his/her personal data previously provided to the Bank in a structured, commonly used and electronically- readable format (right to data portability);
- f) To object to the processing of his/her personal data, if the purpose of data processing is a legitimate interest of the Bank or of a third party, or the performance of a task in the public interest or the fulfilment of Bank’s authorizations as prescribed by Law, in both cases including profiling (exercising the right to object);
- g) If automated decision-making is applied, Data Subjects are entitled to request human intervention under Bank’s control in the decision-making, thus communicate their position in respect of the decision;
- h) To dispute the decision before an authorized person of the Bank;
- i) To lodge a complaint regarding the processing of personal data to the Commissioner for Information of Public importance and Personal Data Protection (hereinafter: “the Commissioner“), and the exercise of their rights under the Law.

Before the Data Subject’s request is granted, the Bank may request that the Data Subject provides additional information in order to specify the request.

The Bank shall inform the Data Subject of the measures taken on the request or objection as soon as possible, but no later than 30 (thirty) days following the submission of the request (objection). If necessary, the above deadline may be extended by 60 (sixty) days further, taking into account the complexity and number of requests.

In the event of the Bank’s doubt concerning the identity of the party filing a request under this section, the Bank may request to be provided with additional information in order to confirm the Data Subject’s identity, with leaving an additional deadline to act under the request for data supplementation, but no longer than 5 business days.

Should the Bank not receive all data required for identification of the Data Subject, i.e. the request is not supplemented, the Bank shall reach the decision to dismiss the request as incomplete, and if possible (if the Data Subject has left contact details), it shall notify the Data Subject of not considering his/her request with explanation.

The Bank may charge necessary administrative costs of providing information, i.e. acting upon the request, and refuse to act upon the request of the Data Subject, in case the request of the Data Subject is obviously unfounded or excessive, especially if the same request is frequently repeated, in accordance with the Law.

- 7. Right of access

Unless otherwise provided by the Law, Data Subjects are entitled to become aware of all personal data that the Bank processes in relation to their person.

At the Data Subject’s request, the Bank shall also confirm whether it processes the Data Subject’s personal data and provide the Data Subject access to such data, and the following information:

- a) the purpose of data processing;
- b) the types of personal data processed;
- c) the recipients or categories of recipients to whom personal data have been disclosed or will be disclosed, and in particular recipients in other states or international organizations;
- d) the planned personal data retention period, or if this is not possible, the criteria for determining that period;
- e) the existence of the right to request from the Controller to rectify or delete personal data, the right to restrict processing and the right to object to processing;
- f) the right of lodging a complaint to the Commissioner;
- g) Information available on the source of personal data, if data have not been collected from the Data Subject;
- h) the existence of automated decision-making process, including profiling, and at least in such cases, meaningful information on the logic used, as well as on the significance and expected consequences of that processing for the Data Subject;

The Bank may request reimbursement of the necessary costs for making additional copies requested by the Data Subject. In the event when the right of the Data Subject to obtain information (right of access) under this Section adversely affects the rights and freedoms of others, in particular business secrets or intellectual property, the Bank may deny the request of the Data Subject.

- 8. Right to rectification

The Data Subject is entitled to rectification of his/her inaccurate data without any undue delay. Depending on the purpose of processing, the Data Subject is entitled to supplement his/her incomplete personal data, which also includes giving of additional statement. The Bank is