a) The controller must inform the data subject of the action taken on the request without delay, but in any case, within one month of receipt of the request. If necessary, taking into account the complexity of each request and the number of requests, this period may be extended by a further two months.
b) The controller shall inform the data subject of the extension of the time limit and indicate the reasons for the delay, within one month of receiving the request. If the data subject has submitted the request electronically, the information shall be provided electronically, unless the data subject requests otherwise.
c) If the controller does not act on the data subject’s request within one month of receipt of the request, the data subject may lodge a complaint with a supervisory authority and have the right to a judicial remedy.
d) The company shall provide the requested information free of charge. If the data subject’s request is unfounded or due to its repetitive nature, excessive, the controller may charge a reasonable fee for the administrative costs of completing the requested action, or refuse to act upon the request.
e) The controller shall inform all recipients to whom, or with whom, the personal data has been shared, of any rectification, erasure or restriction on the processing of personal data, unless this proves to be impossible or requires a disproportionate effort. At the request of the data subject, the controller shall inform him or her of the recipients.
f) The data controller shall make a copy of the personal data available – which is the subject of the data processing – to the data subject. For additional copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. If the data subject has submitted the request electronically, the information shall be provided in electronic format, unless the data subject requests otherwise.