Your GDPR rights
Under EU Regulation 2016/679 (GDPR), you have a number of rights regarding your personal data processed by DAC. This page explains those rights and how you can exercise them.
Last updated: May 5, 2026
Your rights
- Right of access (Art. 15) — you may request confirmation of processing and a copy of the data we hold about you.
- Right to rectification (Art. 16) — you may request correction of inaccurate data or completion of incomplete data.
- Right to erasure (‘right to be forgotten’, Art. 17) — you may request erasure of data if no longer necessary for the original purpose or if you have withdrawn consent.
- Right to restriction (Art. 18) — you may request temporary suspension of processing in certain situations (e.g., contesting data accuracy).
- Right to data portability (Art. 20) — you may receive your data in a structured, machine-readable format and transmit it to another controller.
- Right to object (Art. 21) — you may object at any time to processing for direct marketing or based on legitimate interest.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without retroactive effect.
- Right not to be subject to automated decision-making (Art. 22) — DAC does not use automated decisions with legal effects on you.
- Right to lodge a complaint with ANSPDCP — you may contact the Romanian supervisory authority directly: dataprotection.ro.
How to exercise your rights
Contact the DPO (Data Protection Officer):
Include in your message: full name, contact details, the right you wish to exercise, and a clear description of the request. Additional identity verification may be required to prevent unauthorized access to your data.
Response timeframe
We respond to your requests within a maximum of 30 calendar days from receipt of the complete request. In complex or high-volume situations, the deadline may be extended by an additional 60 days with prior notice.
Costs
Exercising GDPR rights is free of charge. DAC may charge a reasonable fee or refuse the request only in manifestly unfounded or excessive cases (repeated requests).
Related documents
Have questions?
Our team is available for any clarification.


