RIGHT OF ACCESS:
By exercising this right, you request that the right to access the data processing carried out by the organization be provided free of charge within a maximum period of one month from receipt of this request. All information referred to in Article 15 of the GDPR be sent to the address indicated above by mail, in a legible and intelligible manner, and within the indicated period.

You have the right to know:

Whether or not we are processing personal data concerning you.
The source of your data, if you did not provide it to us.
The purposes of the processing of your data.
The categories of data involved.
The recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly recipients in third parties or international organizations.
The recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly recipients in third parties or international organizations.
If possible, the expected retention period for personal data, or otherwise, the criteria used to determine this period.
If automated decisions—including profiling—are made using your personal data, you will be informed of the data stored about you.

RIGHT TO RECTIFICATION:
By exercising this right, you request that the right to rectification be provided free of charge, in accordance with Article 16 of the GDPR. Proof of this information must be provided.

You have the right to have your personal data accurate and up-to-date.
By completing it if it is incomplete.
By updating or correcting it if it is inconsistent with current data or is inaccurate.

RIGHT TO ERASURE:
By exercising this right, you request that the right to erasure, or the right to be forgotten, be provided free of charge, in accordance with Article 17 of the GDPR. This right may only be exercised if:

The data are no longer necessary for the purposes for which they were collected or processed.
If the processing was based on express consent, you withdraw your consent and the processing cannot be justified on another legal basis.
You have previously successfully exercised your right to object to the processing of your data.
The data has been processed unlawfully.
The data must be erased to comply with a legal obligation.

The aforementioned requirements will not apply if the processing is necessary for:

Exercising the right to freedom of expression and information.
For compliance with a legal obligation, or
for the performance of a task carried out in the public interest by the data controller, or
for the establishment, exercise, or defense of legal claims.

RIGHT TO LIMITATION OF PROCESSING:
By exercising this right, you request that we provide you free of charge with the right to restrict the processing indicated, in accordance with Articles 18 and 19 of the GDPR. This means that we may retain your personal data without using it for the intended purposes, provided that one of the following conditions is met:

You request the rectification of your personal data for a period that allows us, as the organization responsible for the processing, to verify its accuracy.
The processing is unlawful and you oppose the deletion of your personal data, requesting instead that its use be restricted.
We no longer require your personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense of legal claims.
You have objected to the processing while we verify whether the legitimate grounds for processing it outweigh your right.

Where processing of personal data has been restricted, such data may only be processed, with the exception of storage, with your consent, for the establishment, exercise, or defense of legal claims, to safeguard the rights of another natural or legal person, or for reasons of substantial public interest. Once processing restriction has been applied, you will be informed before the restriction is lifted.

RIGHT TO DATA PORTABILITY:
By exercising this right, you request that the personal data concerning you be provided to you free of charge, in accordance with Article 20 of the GDPR. We will make the personal data you have provided available to you in a structured, commonly used, and machine-readable format. Furthermore,

You have the right to request that it be transmitted directly to another data controller when technically feasible.

You will only have this right when:

We are processing your personal data based on your express consent, or
the legal basis is the performance of a contract, and
whenever the processing is carried out by automated means.

RIGHT TO OBJECT:
By exercising this right, you may object to the processing of your personal data, in accordance with Articles 21 and 22 of the GDPR. This right requires us to stop using your personal data.

You may exercise your right to object when the processing is based on our "legitimate interests."

If the processing is based on your consent, you may withdraw it and obtain similar effects as the right to object.

RIGHT NOT TO BE SUBJECT TO AUTOMATED DECISIONS
based on the processing of your personal data, including profiling.
You may object to being subject to a decision that has legal effects or that otherwise significantly affects you, provided that it was based exclusively on automated processing of your data and without human intervention.
If you have been subject to a decision of the type described and you do not agree, you can request that we review the decision to obtain human intervention, express your point of view, or otherwise challenge it.
You do not have the right to object when the decision made by automated means:

Is necessary for the conclusion or performance of a contract with you,
Is authorized by law and there are adequate measures to safeguard your rights and freedoms, or
is based on your explicit consent.

TIME FRAME AND PROTECTION
If within one month, ANF Certification Authority does not notify you that the right exercised cannot be fully or partially fulfilled, it is mandatory that:

The communication be justified in order to, where appropriate, request protection from the Spanish Data Protection Agency, pursuant to Article 57 of the GDPR.
If, prior to filing a complaint with the Spanish Data Protection Agency, you believe that your rights have not been properly respected, you may request an assessment from the Data Protection Officer.