Protection of personal data

Information on the Processing of Your Personal Data

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - hereinafter referred to as “the Regulation”), we would like to use this document to inform you about the processing of your personal data within our organisation.

1. Who is your Data Controller?

The controller of your personal data is the Centre of Administration and Operations of the Czech Academy of Sciences (Středisko společných činností AV ČR, v. v. i.), Business ID No: 60457856, registered seat: Národní 3, Prague 1, post code 117 20, phone: +420 221 403 111, e-mail: ssc@ssc.cas.cz.

2. How can you contact our Data Protection Officer?

You can contact our Data Protection Officer with your requests, questions, or remarks at the address Centre of Administration and Operations of the Czech Academy of Sciences, Division of Controlling and Risk Management - Data Protection Officer, Národní 3, Prague 1, post code 117 20, or by sending an e-mail to poverenec@ssc.cas.cz.

3. What types of personal data do we process and why?

I. We process such personal data as your name and surname and/or business name as applicable, date of birth, residence address and/or registered seat as applicable, Business ID Number as applicable, e-mail address, and telephone number for the purpose of entering into and performing a contract in order to meet the legal requirements for the performance of a contract pursuant to Article 6(1) (b) of the Regulation. We will process this data for the duration of the contract.

II. For communication in matters concerning the performance of the contract, we will potentially also process personal data of natural persons specified in the contract who act on your behalf (e.g. their identification and contact details), as well as the identification and contact data of any of your employees (contact persons) specified in the contract. This data will be processed for the above specified purposes in order to meet the legal requirement for the performance of a contract pursuant to Article 6(1) (b) of the Regulation. This data will be processed for the above-specified purpose for the duration of the contract.

III. We will also process the above-mentioned personal data for the purposes of exercising and defending our legal rights. This data will be processed for the above-specified purposes on the legal basis of our legitimate interests pursuant to Article 6(1) (f) of the Regulation. Our legitimate interests in this case are exercising and defending our legal rights. This data will be processed for the above-specified purposes for the duration of the period for exercising a claim for a defective performance (complaint), as well as for the duration of the limitation and prescription periods for individual rights defined in Act No 89/2012 Coll., the Civil Code. Should we exercise any such claims before a court or other public authorities, the data shall be processed for the duration of the proceedings before these authorities.

Provision of the specified data for the above-mentioned purposes is voluntary; however, it will not be possible to enter into and perform a contract with you if you do not provide this data. We would also be subsequently unable to exercise our rights or yours in the event of a dispute regarding entering into and performing a contract or in the event of a breach of contract.

The above-specified personal data processing based on our legitimate interests does not require your consent; however, you have the right to lodge a complaint against it free of charge and at any time.

IV. If it becomes necessary to publish a contract to which you are a party in the Register of Contracts pursuant to Act No. 340/2015 Coll., on special conditions for the effectiveness of certain contracts, the disclosure of such contracts and on the Register of Contracts (hereinafter referred to as the Act on the Register of Contracts), your personal data and potentially the personal data of natural persons specified in the contract who act on your behalf (i.e. their identification and contact data), as well as the identification and contact data of your employees (contact persons) will be published in this register to the necessary extent in accordance with the Act on the Register of Contracts. We will carry out this data processing based on the legal basis of compliance with a legal obligation pursuant to Article 6(1) (c) of the Regulation. Provision of this data for the specified purpose is therefore mandatory and failure to provide the data would mean, inter alia, a possible breach of the Act on the Register of Contracts. In the event that such a contract is published in the Register of Contracts pursuant to the Act on the Register of Contracts, personal data will only be disclosed to a limited extent in accordance with the provisions of Section 3 of this Act, i.e. in such a manner which does not threaten or breach your interests, rights or freedoms, or those of the above specified data subjects, particularly the right to the protection of privacy.

V. We further process such personal data as your name and surname and/or business name as applicable, date of birth, residence address and/or registered seat as applicable, Business ID Number as applicable, e-mail address, and telephone number for the purpose of entering into and performing a contract (e.g. reservations, responding to orders). Processing will be carried out on the legal basis of a legitimate interest pursuant to Article 6(1) (f) of the Regulation. We also process camera recordings. Our legal interest in this case is adequate monitoring of communal areas from the point of view of the safe movement of people and property.

We will process this data for a period of 2 years.

VI. We will further process your personal data in the form of camera recordings for the purposes of adequate monitoring of communal areas from the point of view of safe movement of persons and property. Processing will be carried out on the legal basis of a legitimate interest pursuant to Article 6(1) (f) of the Regulation.

We will process this data for a period of 1 month.

VII. The processor hereby undertakes to provide its employees or persons cooperating with the processor with all relevant information on the processing of their personal data which the Controller carries out pursuant to this Contract.

4. Who are the recipients of your personal data?

We only pass on your personal data to the necessary extent to the following categories of recipients:

authorised employees of the Controller;
our contractual partners, in the event that they participate in the processing of your personal data alongside us (i.e. processors), such as providers of technical support, servicing or operation of our computer systems, programmes, networks and website; data storage system providers; postal service providers and providers of employee benefits; marketing services; and payroll accounting;
other entities in cases where we are required to provide your personal data by law (e.g. the Police of the Czech Republic and other public authorities);
other entities, if it is essential for the protection of our legitimate interests (e.g. lawyers, bailiffs, courts, and government offices);
the public, in the event that certain personal data is published in the Register of Contracts.

5. What are your rights?

You have the right to:

request confirmation of the processing of your personal data from the Controller, and, if such data is being processed, you have the right to access this data;
rectify out-of-date or incomplete information;
erase or restrict personal data which concerns you;

You also have the right to:

lodge a complaint with the Office for Personal Data Protection, with its registered seat at the address: Pplk. Sochora 27, Prague 7, 170 00, email: posta@uoou.cz;
determine the portability of your data;
withdraw consent to personal data processing at any time, provided that personal data processing is based on such consent. Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before it is withdrawn.