Your Rights as a Data Subject (GDPR)

Under the General Data Protection Regulation (GDPR — Regulation EU 2016/679), you have the following rights regarding your personal data processed by CAI Technology.

Right to information (Art. 13-14)

You have the right to be informed about how your data is processed. Full information in our Privacy Policy.

Right of access (Art. 15)

You can request a copy of your personal data, with information on: processing purposes, data categories, recipients, retention period, source (if not from you).

Response: 30 days (extendable to 90 for complex requests). Free for first request/year.

Right to rectification (Art. 16)

You can request correction of inaccurate or completion of incomplete data.

Right to erasure — "right to be forgotten" (Art. 17)

You can request deletion when:

• Data no longer necessary for collection purpose;
• You withdraw consent (where it was the legal basis);
• You object and there are no compelling legitimate grounds to continue;
• Data was processed unlawfully;
• Legal erasure obligation exists.

Exceptions: tax obligations (10 years), defense in court, freedom of expression.

Right to restriction (Art. 18)

You can request temporary blocking of processing (data retained but not used) when: contesting accuracy, processing illegal but you don't want erasure, data no longer needed by us but you need them for legal claims, or you objected and we verify if our legitimate grounds prevail.

Right to portability (Art. 20)

You can receive data in structured, commonly-used, machine-readable format (JSON, CSV) and request direct transfer to another controller, where technically feasible. This right applies only to data you provided directly, processed on consent or contract basis.

Right to object (Art. 21)

You can object to processing based on legitimate interest or for direct marketing. For direct marketing, objection is absolute — we stop processing immediately.

Right not to be subject to automated decisions (Art. 22)

You have the right not to be subject to a decision based solely on automated processing (incl. profiling) producing legal effects or significantly affecting you. Our practice: no automated profiling for material decisions; any AI automation is human-in-the-loop for impact decisions.

Right to withdraw consent (Art. 7(3))

When processing is based on your consent (e.g., newsletter), you can withdraw consent any time, without affecting the lawfulness of prior processing. Mechanism: "Unsubscribe" link in every newsletter, or request to support@caitech.eu.

How to exercise your rights

Send request to support@caitech.eu. We recommend specifying:

• Right invoked (e.g., "access request under GDPR Art. 15");
• Identity (we may request ID copy with sensitive fields redacted);
• Request details (specific data, period, etc.).

We respond within 30 days max (extended to 90 for complex requests, with notification within first 30 days). Free for first access request/year; afterwards reasonable fee may apply for repetitive requests.

Complaint to supervisory authority

If your rights have been violated, you can lodge a complaint with:

Romanian Data Protection Authority (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, sector 1, Bucharest
Email: anspdcp@dataprotection.ro
Web: www.dataprotection.ro

Judicial remedy

Regardless of the ANSPDCP complaint, you have the right to an individual judicial remedy at the competent courts.