Information on the rights of the data subject 

1. Summary of the data subject’s rights:

   a. Transparent information, communication, and facilitation of the exercise of the data subject’s rights;

   b. Right to prior information – if personal data are collected from the data subject;

   c. Information to the data subject and provision of information if the personal data were not obtained directly from the data subject by the data controller;

   d. Right of access by the data subject;

   e. Right to rectification;

   f. Right to erasure (“right to be forgotten”);

   g. Right to restriction of processing;

   h. Obligation to notify about rectification or erasure of personal data or restriction of processing;

   i. Right to data portability;

   j. Right to object;

   k. Rights related to automated decision-making in individual cases, including profiling;

   l. Limitations;

   m. Information to the data subject regarding data breaches;

   n. Right to lodge a complaint with a supervisory authority (right to administrative remedy);

   o. Right to an effective judicial remedy against a supervisory authority;

   p. Right to an effective judicial remedy against the data controller or data processor.  

Detailed rights of the data subject: 

Transparent information, communication and facilitation of the exercise of the data subject’s rights 

2. The data controller shall provide the data subject with all information and each notification relating to the processing of personal data in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, particularly where any information is addressed specifically to a child. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. Upon request of the data subject, the information may also be provided orally, provided the identity of the data subject is proven by other means. 

1. The data controller shall facilitate the exercise of the data subject’s rights. 

   
   

2. The data controller shall inform the data subject without undue delay and in any event within one month of receipt of the request about the measures taken in response to the request for exercising their rights. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, provided that the data subject is informed of such extension within one month of receipt of the request. 

   
   

3. If the data controller does not take action on the request of the data subject, the data controller shall inform the data subject without delay and at the latest within one month of receipt of the request about the reasons for not taking action, and about the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. 

   
   

4. The data controller shall provide the information and communication relating to the data subject’s rights free of charge; however, a reasonable fee may be charged where the requests are manifestly unfounded or excessive as provided for by the Regulation

    

5. Detailed rules are set out under Article 12 of the Regulation. 

   
   

Right to prior information – where personal data are collected from the data subject 

8. The data subject shall have the right to be informed about the facts and circumstances related to data processing prior to the commencement of such processing. In this regard, the data subject shall be informed of: a. The identity and contact details of the data controller and, where applicable, of the controller’s representative; b. The contact details of the data protection officer, if applicable; c. The purposes of the intended processing and the legal basis of the processing; d. In case of processing based on legitimate interests, the legitimate interests pursued by the controller or a third party; e. The recipients or categories of recipients of the personal data, if any; 

   
   

9. To ensure fair and transparent processing, the data controller shall also inform the data subject of the following additional information: a. The period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period; b. The data subject’s right to request access to and rectification or erasure of personal data or restriction of processing concerning the data subject, and the right to object to such processing, as well as the right to data portability; c. Where the processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; d. The right to lodge a complaint with a supervisory authority; e. Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as the possible consequences of failure to provide such data; f. The existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved and the significance and the envisaged consequences of such processing for the data subject. 

   
   

10. Where the data controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the data controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant additional information. 

    
    

11. The detailed rules on the right to prior information are laid down in Article 13 of the Regulation. 

Information to the data subject and information to be provided if the personal data were not obtained from the data subject 

12. If the data controller did not obtain the personal data from the data subject, the controller shall provide the data subject with the information referred to in the previous section no later than one month after obtaining the personal data; if the personal data are used for contacting the data subject, at the latest upon the first communication with the data subject; or if the data are to be disclosed to another recipient, at the latest when the personal data are first disclosed. This information shall include the categories of personal data concerned, the source of the personal data, and, if applicable, whether the data come from publicly accessible sources. 

    
    

13. The further rules are governed by the provisions laid down in the previous section (Right to prior information). 

    
    

14. Detailed rules on this information obligation are set out in Article 14 of the Regulation. 

Right of access of the data subject 

15. The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the related information referred to in points 8-9 of this chapter. (Article 15 of the Regulation). 

16. Where personal data are transferred to a third country or to an international organization, the data subject has the right to be informed about the appropriate safeguards pursuant to Article 46 of the Regulation. 

    
    

17. The data controller shall provide a copy of the personal data undergoing processing to the data subject. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. 

    
    

18. Detailed rules on the right of access are set out in Article 15 of the Regulation. 

Right to rectification 

19. The data subject has the right to have inaccurate personal data concerning them rectified by the data controller without undue delay upon request. 

    
    

20. Considering the purpose of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. 

    
    

21. These rules are set out in Article 16 of the Regulation. 

Right to erasure (“right to be forgotten”) 

22. The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay, and the controller shall be obliged to erase personal data concerning the data subject without undue delay if: 

a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b. the data subject withdraws consent on which the processing is based and there is no other legal ground for processing;
c. the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
d. the personal data have been unlawfully processed;
e. the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;
f. the personal data have been collected in relation to the offer of information society services directly to a child. 

23. The right to erasure shall not apply if processing is necessary for: 

    a. exercising the right of freedom of expression and information;
    b. compliance with a legal obligation or the performance of a task carried out in the public interest or in the exercise of official authority;
    c. reasons of public health;
    d. archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of those objectives;
    e. establishment, exercise, or defense of legal claims.

     

24. Detailed rules on the right to erasure are contained in Article 17 of the Regulation. 

Right to restriction of processing 

25. Where processing is restricted, such personal data may be processed only with the data subject’s consent or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for important public interest of the Union or a Member State, except for storage. 

26. The data subject has the right to obtain restriction of processing from the data controller if one of the following applies: 

    
    

    a. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy;
    b. the processing is unlawful and the data subject opposes erasure and requests restriction instead;
    c. the controller no longer needs the personal data for processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
    d. the data subject has objected to processing pending verification whether the controller’s legitimate grounds override those of the data subject. 

    
    

27. The data subject shall be informed before the restriction of processing is lifted. 

    
    

28. Relevant rules are contained in Article 18 of the Regulation. 

Notification obligation related to rectification, erasure or restriction of processing 

29. The data controller shall communicate any rectification, erasure, or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Upon request, the data subject shall be informed about those recipients. 

    
    

30. These rules are set out in Article 19 of the

    Regulation. 

Right to Data Portability 

31. Under the conditions set out in the Regulation, the data subject shall have the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another data controller without hindrance from the controller to whom the personal data were provided, if: 

a. the processing is based on consent or on a contract; and
b. the processing is carried out by automated means. 

32. The data subject may also request the direct transmission of personal data between data controllers. 

    
    

33. Exercising the right to data portability shall not adversely affect the rights and freedoms of others and shall not infringe Article 7 of the Regulation (Right to erasure, “right to be forgotten”). The right to data portability shall not apply where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. 

    
    

34. Detailed rules are set out in Article 20 of the Regulation. 

Right to Object 

35. The data subject shall have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on public  interest, the exercise of official authority (Article 6(1)(e)), or legitimate interests pursued by the controller (Article 6(1)(f)), including profiling based on those provisions. In such cases, the controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

    
    

36. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. 

    
    

37. The data subject shall be explicitly informed of their right to object no later than at the first communication with the data subject, and this information shall be presented clearly and separately from other information. 

    
    

38. The data subject may exercise the right to object by automated means based on technical specifications. 

    
    

39. Where personal data are processed for scientific or historical research purposes or statistical purposes, the data subject shall have the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest. 

Automated Decision-Making in Individual Cases, Including Profiling 

40. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. 

    
    

41. This right shall not apply if the decision: a. is necessary for entering into or performance of a contract between the data subject and the controller; b. is authorized by Union or Member State law to which the controller is subject, which also lays down suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests; or c. is based on the explicit consent of the data subject. 

    
    

42. In the cases mentioned under points (a) and (c), the controller shall implement suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests, including at least the right to obtain human intervention from the controller, to express their point of view, and to contest the decision. 

    
    

43. Further rules are contained in Article 22 of the Regulation. 

Restrictions 

44. Union or Member State law may restrict the scope of rights and obligations (Articles 12–22, 34, and 5 of the Regulation) applicable to the controller or processor by legislative measures, provided that such restrictions respect the essence of fundamental rights and freedoms. 

43. The conditions for such restrictions are set out in Article 23 of the Regulation. 

Information to the Data Subject About a Personal Data Breach 

46. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. The communication shall describe the nature of the personal data breach clearly and in an understandable manner and include at least: a. the name and contact details of the data protection officer or other contact point where more information can be obtained; b. the likely consequences of the personal data breach; c. the measures taken or proposed by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. 

    
    

47. The data subject need not be informed if any of the following conditions are met: a. the controller has implemented appropriate technical and organizational protection measures, such as encryption, which were applied to the data affected by the breach; b. the controller has taken subsequent measures to ensure the high risk to the rights and freedoms of data subjects is no longer likely to materialize; c. communication would involve disproportionate effort. In such cases, a public communication or similar measure shall be made to inform the data subjects effectively. 

    
    

48. Further provisions are contained in Article 34 of the Regulation.

Right to Lodge a Complaint with a Supervisory Authority (Right to Administrative Remedy) 

49. The data subject shall have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of their personal data infringes the Regulation. The supervisory authority with which the complaint is lodged shall inform the complainant about the progress and outcome of the complaint, including the right to an effective judicial remedy. 

    
    

50. These rules are contained in Article 77 of the Regulation. 

    
    

If the data subject believes that their personal data processing does not comply with applicable laws, they may complain to the data controller or contact the supervisory authority: 

National Authority for Data Protection and Freedom of Information (NAIH) Address: 1055 Budapest, Falk Miksa utca 9–11. Phone: +36 1 391 1400 Email: ugyfelszolgalat@naih.hu Website: www.naih.hu

1. Complaints related to the data processing practices of DMC can also be submitted directly to: Duna Medical Center Ltd. Address: 1095 Budapest, Lechner Ödön fasor 5. 

Right to an Effective Judicial Remedy Against a Supervisory Authority 

1. Without prejudice to any other administrative or non-judicial remedies, every natural or legal person shall have the right to an effective judicial remedy against legally binding decisions of a supervisory authority concerning them. 

   
   

2. Without prejudice to any other administrative or non-judicial remedies, every data subject shall have the right to an effective judicial remedy if the competent supervisory authority does not deal with a complaint or fails to inform the data subject within three months about the progress or outcome of the complaint. 

   
   

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority has its seat. 

   
   

4. Where proceedings are brought against a decision of a supervisory authority in relation to which the Board has issued an opinion or decision within the consistency mechanism, the supervisory authority shall submit that opinion or decision to the court. 

   
   

5. These provisions are contained in Article 78 of the Regulation. 

Right to an Effective Judicial Remedy Against the Controller or Processor 

1. Without prejudice to available administrative or non-judicial remedies, including the right to complain to a supervisory authority, every data subject shall have the right to an effective judicial remedy if they consider that their rights under the Regulation have been infringed as a result of the non-compliant processing of their personal data. 

2. Proceedings against a controller or processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Such proceedings may also be brought before the courts of the Member State where the data subject has their habitual residence, unless the controller or processor is a public authority exercising public powers of a Member State. 

   
   

3. These provisions are contained in Article 79 of the Regulation. 

   
   

4. Imperial Dental applies IT, organizational, and technical measures during data processing to ensure data protection. In the event of a data breach, the supervisory authority and, if necessary, the data subjects will be notified in accordance with applicable laws. 

Budapest, 1 July 2025