Article 13 GDPR
Information provided when data is collected from the data subject

1. If the personal data of the data subject is collected from the data subject, the controller shall provide the data subject with all of the following information when obtaining the personal data:

(a) their identity and contact details and, where applicable, the identity and contact details of their representative;

(b) where applicable contact details of the data protection officer;

(c) the purposes of the processing of personal data and the legal basis for the processing;

(d) where the processing is carried out on the basis of Article 6 (1) (f) legitimate interests pursued by the controller or by a third party;

(e) information on recipients of personal data or categories of recipients, if any;

(f)

*

where applicable, information regarding the intended transfer of personal data to a third country or an international organization and whether the Commission has determined that an adequate level of protection exists or not, or, in the case of a transfer referred to in Article 46, Article 47, or the second subparagraph of Article 49(1), a reference to the appropriate or suitable safeguards, and information on how to obtain a copy of the information or where it is made available.

2. In addition to the information referred to in paragraph 1, during the acquisition of personal data, the controller shall provide the data subject with the following other information necessary to ensure the fairness and transparency of the processing:

(a) the period for which the personal data will be kept and, where this is not possible, the criteria for determining that period;

(b) information on the right of the controller to request access to, rectification, deletion or restriction of personal data concerning the data subject, or the right to object to the processing, as well as the right to transfer data;

(c) where the processing is based on Article 6(1)(a) or Article 9(2)(a) – information regarding the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal;

(d) information on the right to lodge a complaint with the supervisory authority;

(e) information on whether the provision of personal data is a legal or contractual requirement or a condition for entering into a contract and whether the data subject is obliged to provide it and what are the possible consequences of not providing the data;

(f) information regarding automated decision-making, including profiling, as referred to in Article 22(1) and (4), and—at least in those cases—meaningful information regarding the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

3. If the controller plans to further process the personal data for a purpose other than the purpose for which the personal data was collected, the controller shall inform the data subject of such other purpose before such further processing and provide him/her with any other relevant information referred to in paragraph 2.

4. Paragraphs (1), (2) and (3) shall not apply when, and to the extent that, the data subject already has this information.