Data protection regulations grant data subjects, data owners, and users of the Data Controller’s website or social media channels a number of rights.

The rights protecting data subjects are listed below:

– Right of access: The right to obtain information as to whether personal data concerning the data subject are being processed, and, where that is the case, access to such data and information regarding the purposes of the processing, the categories of data concerned, the recipients or categories of recipients, the retention periods and the origin of the data.

– Right of rectification: The right to obtain the rectification of inaccurate or incomplete personal data.

– Right of erasure: The right to obtain the erasure of personal data in the following circumstances:

• When the data are no longer necessary for the purpose for which they were collected.
• When the data subject withdraws consent.
• When the data subject objects to the processing.
• When erasure is required in order to comply with a legal obligation.
• When the data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

– Right to object: The right to object to specific processing activities based on the consent of the data subject.

– Right of restriction of processing: The right to obtain the restriction of processing in any of the following circumstances:

• Where the data subject contests the accuracy of the personal data, for a period enabling the entity to verify the accuracy of the data.
• Where the processing is unlawful and the data subject opposes the erasure of the personal data.
• Where the entity no longer requires the data for the purposes for which they were collected, but the data are required by the data subject for the establishment, exercise or defence of legal claims.
• Where the data subject has objected to processing pending verification of whether the legitimate grounds of the entity override those of the data subject.

– Right to data portability: The right to receive personal data in a structured, commonly used and machine-readable format and to transmit those data to another data controller where:

• The processing is based on consent;
• The processing is carried out by automated means.

– Right to lodge a complaint with the competent supervisory authority (the Spanish Data Protection Agency) via www.aepd.es where the data subject considers that the processing does not comply with the applicable regulations.

Data subjects may exercise the aforementioned rights by writing to the Data Controller at the following address: correo@tranviascoruna.com, stating in the subject line the right they wish to exercise.

The Data Controller shall respond to the request as soon as possible, taking into account the time limits established by data protection regulations.