Article 15 GDPR

1. The data subject has the right to obtain information from the controller about whether or not his personal data are processed and, if so, to have access to those personal data and the following information:

a) the processing purposes;
b)the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
d) if possible, the period during which the personal data is expected to be stored, or if that is not possible, the criteria for determining that period;
e) that the data subject has the right to request the controller to rectify or erase personal data, or to restrict the processing of personal data concerning him, and to object to such processing;
f) that the person concerned has the right to complain to a supervisory authority;
g) where the personal data is not collected from the data subject, all available information about the source of that data;
h) the existence of automated decision-making, including the profiling referred to in Article 22 (1) and (4) and, at least in those cases, useful information on the underlying logic, as well as the importance and expected consequences of that processing for the data subject.