MTA Privacy Policy

a. Right of confirmation

Every data subject has the right, as granted by the European guideline and regulation authority to request confirmation from the data controller as to whether their personal data is being processed. If the data subject wishes to exercise this right of confirmation, they may contact an employee of the data controller at any time.

b Right to receive information

Any data subject whose personal data is processed has the right, as granted by the European legislator, to receive information from the data controller at any time and free of charge regarding their personal data being stored and to receive a copy of this information. In addition, the European guideline and regulation authority grants the data subject access to the following information:

• the purposes for which the data is being processed;
• the categories of personal data that is being processed;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• if possible, the planned duration for which the personal data shall be stored, or, if this is not possible, the criteria for determining this duration;
• the existence of the right to have personal data corrected or deleted, or to restrict how much they can be processed by the data controller, or the right to object to the processing of your personal data;
• the right to lodge a complaint with a supervisory authority;
• if the personal data are not collected from the data subject; all available information on the origin of the data;
• the existence of automated decision-making including profiling pursuant to Article 22.1 and 22.4 GDPR and, at least in these cases, meaningful information on the logic involved and the scope and intended effects of such processing with respect to the data subject.

The data subject also has the right to know whether personal data has been transmitted to a third country or to an international organisation. In such a case, the data subject is also entitled to obtain information on the relevant guarantees in connection with the transmission.
If the data subject wishes to exercise this right to information, they may contact an employee of the data controller at any time.

c Right to correction

Any data subject has the right, as granted by the European guideline and regulation authority, to demand the immediate correction of any inaccurate personal data relating to them. Furthermore, and taking into account the purposes of processing, the data subject has the right to request that incomplete personal data be completed, also by means of a supplementary declaration.
If the data subject wishes to exercise this right of correction, they may contact an employee of the data controller at any time.

d Right to deletion (Right to be forgotten)

Any data subject has the right, as granted by the European guideline and regulation authority, to demand from the data controller that their personal data be deleted immediately, provided that one of the following reasons applies and insofar as the data processing is not necessary:

• The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
• The data subject revokes their consent to the processing of personal data pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR and there is no other legal basis for processing.
• The data subject lodges an appeal against the processing of data pursuant to Art. 21(1) GDPR and provided that there are no overriding legitimate reasons for processing, or the data subject lodges an appeal against the processing of data pursuant to Art. 21(2) GDPR.
• The personal data has been unlawfully processed.
• Deletion of the personal data is necessary to fulfil a legal obligation under Union or Member State law to which the data controller is subject.
• The personal data has been collected in relation to the services provided
  by the information society in accordance with Art. 8(1) GDPR.

Insofar as one of the above reasons is applicable and a data subject wishes to arrange for the deletion of personal data stored at MTA GmbH, they may, at any time, contact an employee of the controller. The employee of MTA GmbH shall ensure that the deletion request is acted on immediately.
If the personal data of MTA GmbH was made public and our company as the controller is obligated to delete the data in compliance with Art. 17(1) GDPR, taking into account the available technology and implementation costs, MTA GmbH shall take appropriate measures, including technical means, to inform other controllers who process the published personal data that the data subject has requested from such other controllers the erasure of all links to such personal data or of copies or replications of such personal data, unless the processing is necessary. The employee of MTA GmbH shall make the necessary arrangements on a case by case basis.

e Right to restriction of processing

Any data subject has the right, as granted by the European legislator, to demand that the data controller restrict the processing of such data if one of the following conditions is met:
• The data subject disputes the correctness of the personal data and the data controller is granted sufficient time to verify whether the data is correct or not.
• The processing of data is unlawful, the data subject declines the deletion of personal data and instead demands that the use of personal data be restricted.
• The data controller no longer needs the personal data for the purposes of processing, but the data subject needs the data to assert, exercise or defend legal claims.
• The data subject has lodged an objection to the processing of the data pursuant to Art. 21(1) GDPR and it is not yet clear whether the legitimate grounds asserted by the data controller outweigh those of the data subject.
Insofar as one of the abovementioned conditions is met and a data subject wishes to request the restriction of personal data stored by MTA GmbH, they can contact an employee of the data controller at any time. The employee of MTA GmbH shall make arrangements for the restriction of processing.

f Right to data portability

Any data subject has the right, as granted by the European guideline and regulation authority, to receive any of the personal data they have provided to the data controller in a structured, established and machine readable format. In addition, the data subject has the right to transmit these data to another data controller without hindrance by the current data controller to whom the personal data have been made available, provided that the processing is based on consent given pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or a contract pursuant to Art. 6(1)(b) GDPR and the processing is performed with the aid of automated procedures, provided that the processing is not necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the data controller.
Furthermore, when exercising their right to data portability in accordance with Art. 20(1) GDPR, the data subject has the right to demand that the personal data be transmitted directly by a data controller to another data controller, insofar as this is technically feasible and insofar as this does not affect the rights and freedoms of other persons.
In order to assert the right of data portability, the data subject may at any time contact an employee of MTA GmbH.

g Right to object

Any data subject has the right, as granted by the European guideline and regulation authority, for reasons arising from their particular situation, to object at any time to the processing of their personal data, as provided for in Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.
MTA GmbH shall no longer process personal data unless we can prove compelling reasons of security for such processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.
If MTA GmbH processes personal data to carry out direct advertising, then the data subject has at any time the right to object to the processing of personal data for the purpose of such direct advertising. This also applies to profiling insofar as it is associated with such direct advertising. If the data subject objects to the processing of data for direct advertising purposes by MTA GmbH, then MTA GmbH shall no longer process the personal data for such purposes.
In addition, the data subject has the right, for reasons arising from his or her particular situation, to oppose the processing of personal data concerning him or her that is processed by MTA GmbH for scientific or historical research purposes or for statistical purposes in accordance with Art. 89(1) GDPR, unless such processing is necessary for the fulfilment of a task that is in the public interest.
In order to exercise the right to object, the data subject can contact any employee of MTA GmbH or another employee directly. Notwithstanding Directive 2002/58/EC, the data subject is also free, in connection with the use of information society services, to exercise his/her right to object by means of automated procedures using technical specifications.

h Automated individual decision-making, including profiling

Any data subject has the right, as granted by the European guideline and regulation authority, not to be subject to a decision based solely on automated processing, including profiling, which has a legal effect on them, or substantially impairs them in a similar manner, provided that the decision, (1) is not necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is admissible under the laws of the European Union or of the Member States to which the data controller is subject and where such laws contain appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject, or (3) is made with the express consent of the data subject.
If the decision is (1) necessary for the conclusion or performance of a contract between the data subject and the controller or (2) is made with the express consent of the data subject, then MTA GmbH shall take appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, including at least the right to obtain the intervention of a person from the controller, to express his/her own position and to challenge the decision.
Should the data subject wish to assert their rights with regard to automated decision-making, they may contact an employee of the data controller at any time.

i Right to revoke consent

Any data subject has the right, as granted by the European guideline and regulation authority, to withdraw consent to the processing of personal data at any time.
Should the data subject wish to assert their right to revoke their consent, they may contact an employee of the data controller at any time.