As a data subject, you have all of the rights referred to in Art. 15 of the GDPR 2016/679, namely the following:
i. confirmation as to whether or not personal data concerning you are being processed, and their communication in an intelligible form;
ii. obtain the indication of: a) the origin of personal data; b) the processing purposes and methods; c) the logic applied if processing is carried out with the aid of electronic instruments; d) the identification of the controller, processors and any designated representative pursuant to Art. 3.1, of the GDPR 2016/679; e) of persons or categories of persons to whom the personal data may be communicated or may become aware of the data as an appointed representative in the country, or designated or authorised persons;
iii. obtain: a) the update, rectification or, when applicable, the integration of data; b) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; c) an attestation that the operations referred to in letters (a) and (b) have been brought to the attention of those to whom the data have been communicated or disseminated, also as regards their content, except in cases in which such fulfilment proves impossible or involves a use of means manifestly disproportionate to the protected right;
iv. to oppose the following, in whole or in part: a) the processing of personal data concerning you for legitimate reasons, even if pertinent to the purpose of its collection; b) the processing of personal data concerning you for the purpose of sending advertising material, direct sales material or for carrying out market research or commercial communications by e-mail and/or through traditional marketing methods, by telephone and/or post. It is noted that for direct marketing purposes through automated methods, the right of opposition of the data subject as set out in point (b) above extends to traditional methods and that the possibility remains for the data subject to exercise the right to object, even if only partially. Therefore, the data subject can decide to only receive communications using traditional methods, only automated communications, or neither of the two types of communication.
You also have the rights referred to in Articles 16-21 of the GDPR 2016/679 (Right of rectification, right to be forgotten, right of limitation of processing activities, the right to data portability, right of opposition), as well as the right to lodge complaints with the Guarantor Authority.