YOUR PRIVACY RIGHTS

1. Introduction

The GDPR gives individuals meaningful control over their personal data. As a data controller, Media Rex Alliance is committed to upholding these rights promptly and without unnecessary barriers. This page sets out all rights available to you and exactly how to exercise them.

For information about what data we hold and how we use it, please see our Privacy Policy.

2. Your Rights Under the GDPR

Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data together with information about: the purposes of processing, the categories of data, recipients, retention periods, and your other rights. The first copy is provided free of charge.

Right to Rectification (Art. 16 GDPR)

You have the right to have inaccurate personal data corrected without undue delay. You also have the right to have incomplete data completed, for example by providing a supplementary statement.

Right to Erasure — "Right to be Forgotten" (Art. 17 GDPR)

You have the right to request deletion of your personal data where:

• The data is no longer necessary for the purpose it was collected;
• You withdraw consent and there is no other legal basis for processing;
• You object to processing and there are no overriding legitimate grounds;
• The data has been unlawfully processed; or
• Erasure is required to comply with a legal obligation.

This right does not apply where processing is necessary for legal compliance (e.g. retention of invoices under Dutch fiscal law) or for the establishment, exercise, or defence of legal claims.

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request that we limit the processing of your personal data (i.e. store it but not actively use it) while:

• You contest the accuracy of the data;
• Processing is unlawful and you oppose erasure;
• We no longer need the data but you need it for legal claims; or
• You have objected to processing and we are assessing whether our legitimate grounds override yours.

Right to Data Portability (Art. 20 GDPR)

Where processing is based on your consent or on a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV), and to have it transmitted to another controller where technically feasible.

Right to Object (Art. 21 GDPR)

You have the right to object to processing based on our legitimate interests (Art. 6(1)(f) GDPR). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or processing is necessary for legal claims. Your right to object to direct marketing is absolute — we must stop immediately upon your objection.

Rights in Relation to Automated Decision-Making (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects on you. Where such processing takes place, you have the right to obtain human review of the decision, to express your point of view, and to contest the decision. See our Privacy Policy for information on our automated processing activities.

Right to Withdraw Consent (Art. 7(3) GDPR)

Where we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal. You can withdraw consent via the unsubscribe link in any marketing email, through your cookie preferences, or by contacting us directly.

3. How to Submit a Data Subject Request

3.1 Contact

To exercise any of the rights above, please contact us:

• Email: privacy@mediarexalliance.com
• Post: Barbara Strozzilaan 201, 1083HN Amsterdam, The Netherlands

Please describe your request as clearly as possible (e.g. "I request a copy of all personal data you hold about me under Art. 15 GDPR").

3.2 Identity Verification

To protect your data and prevent unauthorised access, we may ask you to verify your identity before processing your request. We will use reasonable means to verify identity proportionate to the sensitivity of the request.

3.3 Response Timeline

We will respond to your request within one calendar month of receipt (Art. 12(3) GDPR). Where requests are complex or numerous, we may extend this period by a further two months, in which case we will notify you within the first month and explain the reason for the extension.

3.4 Fees

Requests are free of charge. Where requests are manifestly unfounded or excessive — in particular because of their repetitive character — we may either charge a reasonable administrative fee or refuse to act (Art. 12(5) GDPR). We will inform you if this applies.

4. Supervisory Authority

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Dutch supervisory authority:

• Autoriteit Persoonsgegevens (AP)
• PO Box 93374
• 2509 AJ The Hague, Netherlands
• Website: autoriteitpersoonsgegevens.nl
• Phone: +31 (0)70 888 8500 (weekdays 09:00–13:00)
• Online complaint form: available on the AP website

We encourage you to contact us first so we can address your concerns directly, but you are always free to contact the AP at any time.

5. Contact

For any questions about your rights or this page, please contact us at privacy@mediarexalliance.com . Further information about how we process personal data is available in our Privacy Policy.