Right to withdraw consent

If you as the data subject have given consent to the processing of your personal data (for one or more specified purposes), you shall have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Consent can be withdrawn by a written statement sent to the data controller.

The withdrawal of consent to the processing of personal data shall have no adverse effects or bring any sanctions for the data subject. It is possible, however, that after the data subject withdraws consent, the controller is no longer able to provide that data subject with a certain service or services if those are of such nature that they cannot be provided without personal data.

The right of a data subject to access their personal data

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and to the information defined in paragraph 1 of Article 15 of the Regulation. The controller shall provide a copy of the personal data undergoing processing. Pursuant to Article 12 of the Regulation, information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge.

If requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the law firm may either: a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

Pursuant to point d) of paragraph 5 of Article 14 of the Regulation, the data subject shall not have the right to obtain information regarding the collection and further processing of their personal data in cases where the data controller obtained this data with the purpose of keeping it confidential within the lawyer – client relationship, and for using it, at the lawyer’s discretion, in the client’s best interest.

Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent on the basis of which the processing of special categories of personal data or of personal data related to criminal convictions and offences is performed, and where there is no other legal ground for the processing;

(c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;

(d) the personal data have been processed unlawfully;

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

The above shall not apply to the extent that processing is necessary for the establishment, exercise or defence of legal claims.

Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a) you contest the accuracy of the personal data for a period enabling the provider to verify the accuracy of the personal data;

(b) the processing is unlawful and you oppose the erasure of the data and request the restriction of their use instead;

(c) the provider no longer needs the data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;

(d) you have objected to processing, pending the verification whether the legitimate grounds of the provider override yours.

Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract, and where the processing is carried out by automated means.

In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other (administrative or other) judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the State of your habitual residence, of your place of work or place of the alleged infringement (In Slovenia, this is the Information Commissioner) if you consider that the processing of your personal data infringes regulations on the protection of personal data.

Without prejudice to any other (administrative or non-judicial) remedy, you shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning that decision, and also where the supervisory authority does not handle your complaint or does not inform you within three months on the progress or outcome of the complaint.

Each data subject shall have the right to request access to their personal data in writing. The written request shall be sent to the law firm’s head office at Slovenska cesta 47, 1000 Ljubljana, or by email at [email protected]. It is in the same manner that the data subject may exercise their right to restriction of processing, to erasure and data portability.