A more detailed description of Clients' rights relating to the protection of personal data that arise from the Law
1. Right of access to personal data. If the Client requests Tucan to confirm whether his personal data is being processed, Tucan shall inform the Client about:
a) the purpose of processing his personal data;
b) the categories of personal data processed;
c) the identification of the recipients or categories of recipients to whom personal data has been or may be supplied, in particular, if they reside in third countries;
d) the period of retention of personal data;
e) the right to request the rectification of personal data, their deletion, the restriction of their processing or the right to object to the processing of personal data;
f) the right to bring proceedings before the Office for Personal Data Protection on the grounds that the Client's rights have been violated;
g) sources of personal data, if personal data was not obtained directly from the data subject;
h) the existence or, in the case of Tucan, the absence of automated individual decision making or profiling;
i) adequate safeguards for the transfer of personal data when it is transferred to a third country.
At the same time, Tucan shall provide the Client with a statement detailing which of his personal data is being processed by Tucan, if requested by the Client.
2. The right to amend personal data. If the Client requests Tucan to correct his/her personal data, Tucan shall without undue delay make such a correction and, if possible, delete the original data. For paper documents, the original data will be retained, but the correction will be taken into account in the data database or other relevant documents (e.g. personal data correction record).
3. Right to deletion of personal data (right "to be forgotten"). If Tucan is asked by the Client to delete his/her personal data, Tucan will accept his/her request, provided that: a) the personal data are no longer necessary for the purpose for which they were processed, or b) the Client revoked his/her consent (in relation to visa processing) and there is no other legal basis for the processing of such data; or c) the Client has exercised its right to object to the processing of personal data; or d) it turns out that Tucan is processing personal data unlawfully; or e) the Client's right to delete his personal data is based on legal regulations; or f) it concerns personal data that was obtained in connection with the offer of Tucan's services by means of information technology (internet, e-mail, telephone). Tucan is not obliged to comply with the Client's request for deletion of personal data if further processing is necessary: a) to exercise the right to freedom of expression or the right to information (unlikely in the case of Tucan); b) to fulfil Tucan's statutory or public interest obligations (e.g. the law determines the obligation to report data of persons who have travelled to a certain state or the investigator asks to be given information about a particular client), c) for reasons of public interest in the field of public health (e.g. Public Health Authority requests information about specific persons, who were in some country with the occurrence of contagious disease during a specific time period); d) for archiving, scientific, historical and statistical purposes (for example, the data are part of the documents which must be archived and deleting the data would mean that the document would lose its informative value); and f) for asserting a legal claim (e.g. Tucan has a claim against the Client and the deletion of his data would prevent Tucan from asserting it).
4. The right to restrict the processing of personal data. If the Client reaches out to Tucan with the request to restrict the processing of his/her personal data, Tucan will accept his/her request if: a) the Client disputes the correctedness of the personal data - Tucan restricts the processing of the data until the correctness of the processed data is verified; b) the processinf of data is unlawful, but the Client does not request a deletion of the data but rather the restriction of its processing; c) Tucan no longer needs personal data to achieve the purpose from its processing, but the Client still needs the data to make a legal claim, or d) the Client objects to the processing of personal data, in which case Tucan will restrict the processing of personal data, until it can confirm that the justified reasons on Tucan's part outweigh the Client's justified reasons.
5. The right to portability of personal data. If the Client turns to Tucan to request his personal data in a structured, commonly used and machine-readable format, Tucan will accept the request, if the data are processed by automated means (e.g. on a PC) and if the Client explicitly requests it, Tucan may transfer data directly to another operator.
6. The right to object to the processing of personal data. Since Tucan also processes personal data on the legal basis of its own legitimate interest (the sending of newsletter to Clients), which can be considered to be a part of direct marketing, Tucan is obliged to, if the Client objects to the processing of personal data for this purpose (direct marketing), no longer process the Client's data for this purpose. In other words, Tucan will no longer send newsletters to the Client and it will remove him from the newsletter's mailing list.