Data Subject Rights (GDPR)

1. Who you are in relation to us

In the context of personal data processing by Media Design S.R.L., you are a "data subject" under GDPR. You have a number of rights that you can exercise at any time, free of charge (with the exceptions mentioned below).

2. Your rights under GDPR

2.1 Right of access (Art. 15)

You have the right to receive confirmation as to whether or not we process personal data about you and, if so, a copy together with information about:

• the purposes of processing;
• the categories of data processed;
• the recipients to whom the data are or will be disclosed;
• the envisaged retention period or the criteria used to determine it;
• the existence of your rights to request rectification, erasure, restriction, or to object;
• the existence of the right to lodge a complaint with ANSPDCP;
• the source of the data (if not obtained directly from you);
• the existence of automated decision-making, including profiling.

2.2 Right to rectification (Art. 16)

You have the right to obtain, without undue delay, the rectification of inaccurate data and the completion of incomplete data.

2.3 Right to erasure ("right to be forgotten") (Art. 17)

You have the right to obtain the erasure of data concerning you in the following situations:

• data are no longer necessary for the purposes for which they were collected;
• you withdraw your consent and there is no other legal basis;
• you object to processing and there are no legitimate grounds to justify it;
• data were processed unlawfully;
• data must be erased for compliance with a legal obligation.

Exceptions: the right to erasure does not apply to data we are required to retain (invoicing 10 years, tax reporting, other legal obligations).

2.4 Right to restriction of processing (Art. 18)

You have the right to obtain restriction of processing (temporary suspension) when:

• you contest the accuracy of the data;
• processing is unlawful but you do not want erasure;
• we no longer need the data for the original purposes but you request them for legal claims;
• you have objected to processing and we are verifying whether our legitimate grounds override yours.

2.5 Right to portability (Art. 20)

You have the right to receive the data you provided to us in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and to transmit them to another controller, without hindrance from us. This right applies only to data processed on the basis of consent or contract.

2.6 Right to object (Art. 21)

You have the right to object, at any time:

• to processing based on legitimate interest, on grounds relating to your particular situation;
• to processing for direct marketing, including related profiling — in this case we stop processing immediately, without exceptions.

2.7 Right regarding automated individual decision-making (Art. 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects on you or significantly affects you. MediaDesign.ro does not use such automated decisions.

2.8 Right to withdraw consent

For processing based on consent (non-essential cookies, newsletter, marketing), you have the right to withdraw consent at any time, as simply as when you gave it (EDPB Guidelines 03/2022). Withdrawal does not affect the lawfulness of prior processing.

3. How to exercise these rights

To exercise any of these rights:

1. Use the dedicated form: /legal/data-subject-request — the fastest way.
2. Send an email: contact@mediadesignro.ro with the subject "GDPR Data Subject Request".
3. Send a written request: to our registered office (Str. Lt. Col. Pretorian Nr. 3, Bl. N116, Sc. A, Ap. 7, Zalău, Sălaj county, postal code 450131, Romania).

4. Response timeline

Under GDPR Art. 12(3), we will respond to your request without undue delay and in any case within 30 days of receipt. This period may be extended by up to 60 days if the request is complex or we receive multiple requests; in this case we will notify you of the extension and the reasons within the first 30 days.

5. Cost

The response to your requests is free of charge. We may charge a reasonable fee based on administrative costs only if the request is manifestly unfounded or excessive (in particular by its repetitive nature).

6. Identity verification

To protect your data, we may ask for additional information to confirm your identity before processing the request (e.g., confirmation of the email address associated with the account). If we cannot confirm your identity, we reserve the right to refuse the request, justified.

7. Cases in which we may refuse

Under GDPR Art. 12(5), we may refuse a request that is:

• manifestly unfounded (e.g., without basis in GDPR);
• excessive (in particular by its repetitive nature);
• without the possibility of identity verification.

In these cases, we will explain the reasons for the refusal and inform you of the right to lodge a complaint with ANSPDCP and to seek judicial remedy.

8. Complaint to the supervisory authority

If you are not satisfied with the way we handled your request, you have the right to lodge a complaint with:

Romanian Data Protection Supervisory Authority (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, postal code 010336, Romania
Phone: +40 318 059 211 / +40 318 059 212
Email: anspdcp@dataprotection.ro
Web: www.dataprotection.ro

You also have the right to seek judicial remedy directly before the competent court to obtain a ruling on your rights.

Last updated: 1 June 2026.