1. The Data Subject has the right, by submitting a request to the Controller without any consideration, to obtain the following information:
   a. The types of its Personal Data that are being processed.
   b. Purposes of processing.
   c. Decisions made based on automated processing, including profiling.
   d. The targeted sectors or establishments with whom its personal data will be shared from inside and outside the State.
   e. Controls and standards for the period of storage and preservation of his/ her personal data.
   f. Procedures for correcting, erasing or limiting processing and objection to his/ her personal data.
   g. Protection measures for cross-border processing carried out in accordance with Articles (22) and (23) of this By-Law.
   h. Actions to be taken in the event of a breach or misuse of his/ her Personal Data, especially if the breach or misuse has a direct and serious threat to the privacy and confidentiality of his/her Personal Data.
   i. How to submit complaints to the Bureau.
2. In all cases, the Controller shall, before starting the processing, provide the Data Subject with the information stipulated in paragraphs (b), (d) and (g) of Paragraph (1) of this Article.
3. The Controller may reject the Data Subject's request to obtain the information mentioned in Paragraph (1) of this Article, if the following is established:
   a. The request is not related to the information referred to in Paragraph (1) of this Article, or it is excessively repetitive.
   b. The request conflicts with judicial procedures or investigations conducted by competent authorities.
   c. The request may negatively affect the efforts of the Controller to protect information security.
   d. The request affects the privacy and confidentiality of Personal Data of third parties.