Article 13 (GDPR)

Obligation to provide information when collecting personal data from the data subject.

If personal data is collected from the data subject, the person responsible shall inform the data subject of the following at the time this data is collected:

the name and contact details of the person responsible and, if applicable, his representative; if applicable, the contact details of the data protection officer;

the purposes for which the personal data are to be processed and the legal basis for the processing; if the processing is based on Article 6 paragraph 1 letter f, the legitimate interests pursued by the controller or a third party; where applicable, the recipients or categories of recipients of the personal data and, where applicable, the intention of the controller to transfer the personal data to a third country or an international organization, as well as the presence or absence of an adequacy decision by the Commission or, in the case of transfers pursuant to Article 46 or Article 47 or Article 49(1), second subparagraph, a reference to the appropriate or reasonable guarantees and the possibility of obtaining a copy of them,

In addition to the information referred to in paragraph 1, the person responsible provides the data subject with the following additional information at the time this data is collected, which is necessary to ensure fair and transparent processing:

the period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period; the existence of a right to information on the part of the person responsible about the personal data concerned and to correction or deletion or restriction of processing or a right to object to the processing and the right to data portability; if the processing is based on Article 6 paragraph 1 letter a or Article 9 paragraph 2 letter a, the existence of a right to withdraw consent at any time without affecting the legality of the processing carried out on the basis of the consent up to the point of withdrawal; the existence of a right of appeal to a supervisory authority;

If the controller intends to further process the personal data for a purpose other than that for which the personal data was collected, he shall provide the data subject with information about this other purpose and any other relevant information pursuant to paragraph 2 prior to such further processing.

Paragraphs 1, 2 and 3 do not apply if and to the extent that the data subject already has the information.