As a data subject affected by data processing, you have various rights under the GDPR and LOPDGDD. You can assert these rights informally at any time using the contact details of the controller provided above. Specifically, you have the following rights:

• Information: You have the right to obtain information about your personal data processed by us. This includes information about the purposes of processing, the categories of data, the recipients and the planned storage period or the criteria for determining it. We will provide you with a copy of your data on request.

• Rectification: You have the right to have incorrect or incomplete personal data about you rectified or completed.

• Erasure: You can request the erasure of your personal data if the legal requirements are met. This is particularly the case if the purpose of the processing no longer applies, if you have withdrawn your consent or if the data has been processed unlawfully. Please note that statutory retention obligations may prevent immediate erasure.

• Restriction of processing: You have the right to request the restriction of the processing of your data under certain conditions. For example, you can have the processing restricted if you dispute the accuracy of the data (for the duration of the review) or if you have lodged an objection to the processing and it is not yet clear whose interests prevail. In such cases, your data - apart from being stored - will only be processed with your consent or for specific purposes (e.g. to assert legal claims).

• Objection to processing: If we process your personal data on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR), you have the right to object to this processing at any time for reasons arising from your particular situation. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. You can object to processing for direct marketing purposes at any time without giving reasons; in this case, we will no longer use the data concerned for direct marketing purposes.

• Data portability: You have the right to request data that we process automatically on the basis of your consent or to fulfil a contract in a commonly used, machine-readable format. At your request, we can also transfer this data directly to another controller if technically feasible.

Revocation of consent: Many data processing operations are only permitted with your express consent. You have the right to withdraw your consent at any time. All you need to do is send us an informal message (e.g. by e-mail). The revocation does not affect the legality of the data processing up to the revocation - i.e. the processing carried out up to that point remains legitimate.

Right to lodge a complaint with the supervisory authority: If you are of the opinion that we are violating data protection regulations when processing your data, you have the right to lodge a complaint with a data protection supervisory authority. To do so, you can contact the supervisory authority in the EU member state of your place of residence, your place of work or the place of the alleged infringement. For Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD), which you can reach at www.aepd.es. The right of appeal applies without prejudice to other administrative or judicial remedies.