In Karta Card Privacy Policy

We process personal data solely on the basis of, and in the extent permitted by, Regulation of the European Parliament and Council No. 2016/679, on personal data protection and related regulations. This also applies to all processors that process personal data in accordance with our instructions.

You will find all the information concerning personal data processed by ČD, as well as updates to these terms and conditions, on www.cd.cz/pravasubjektu.

PERSONAL DATA CONTROLLER – ČD

The controller of personal data processed in connection with In Karta cards is the company České dráhy, a.s., ID No. 709 94 226, with Registered Office at Nábřeží L. Svobody 1222, 110 15 Praha 1, Czech Republic, registered in the Commercial Registry maintained by the Municipal Court in Prague, Section B, rider 8039.

DATA PROTECTION OFFICER

Regarding matters related to the processing of personal data, you can contact the personal data protection officer at ČD on tel. 221 111 122 or by e-mail on dpo@cd.cz.

PURPOSES OF PROCESSING AND THEIR LEGAL BASIS

Data concerning the customer’s name, surname, date of birth, place of birth, address, photograph, signature, e-mail address, telephone number, In Karta card number, In Karta chip number, type of purchased application type, acts perform regarding the In Karta card, in particular its blocking, change of application, travel document purchase data, their type, purchase frequency, discounts used, for children under 15 years of age also name, surname, date of birth and address of statutory representative are processed exclusively for these purposes:

… in order to fulfil our responsibilities under the Contract on the Issue and Use of an In Karta Card

… in order to fulfil our responsibilities under legislation

For marketing purposes, we use profiling, i.e. a method of automatically processing personal data which evaluates aspects of the customer and enables us to create offerings of products or services tailored to specific customers, in particular their age and purchase history. You can elect not to receive commercial offers at any time and free of charge, however, by using a link found in every e-mail.

… in order to be able to adjust our offering of train connections according to their popularity, etc.

… in order to be able to send tailored commercial offers and discounts to specific customers, e.g. summer holiday events for students, etc.

(under legislation, we have a legitimate interest in such processing and can conduct it even without your explicit consent)

CONSENT

These data – use of travel documents for a specific train connection, the time and place of such connection, including information about the inspection of the travel document and the selected carriage class – are processed only if you grant us your consent to do so and exclusively for these purposes:

For marketing purposes, we use profiling, i.e. a method of automatically processing personal data which evaluates aspects of the customer and enables us to create offerings of products or services tailored to specific customers by using data about their travel behaviour over and above their basic data. You can elect not to receive commercial offers at any time and free of charge, however, by using a link found in every e-mail.

… so that we can send you only commercial offers and discounts tailored to your previous travel preferences and spare you from receiving offers that most likely are not of any interest to you

RECIPIENTS OF PERSONAL DATA

We provide personal data exclusively to:

• the administrators of our information systems where personal data are processed, and
• contractual partners which accept the In Karta card in the areas of inland and international transport, municipal mass transport and ČD travel document sales, and those who participate in the production if In Karta cards.

A list of all processors is available on https://www.cd.cz/assets/info/cim-se-ridime/zpracovatele-osobnich-udaju.pdf.

Personal data can also be provided to public authorities, should this be required by legislation, if doing so is essential to protect against unjustified harm to another’s freedom, life, health or ownership.

DURATION OF STORAGE

We will terminate the processing of personal data as soon as your contractual relationship with ČD based on the Contract on the Issue and Use of an In Karta card ends, but no later than after 12 months have passed since the date on which a travel document, possibly purchased in connection with an In Karta card prior to the end of the contractual relationship, was used. We will terminate the archiving of data specified on travel documents (tax receipts) after 10 years have passed since their date of issue. In the event that the purpose of the processing lapses earlier, then we will terminate the processing of your personal data for this defunct purpose prior to the termination of the contractual relationship. We will terminate the processing of personal data obtained on the basis of consent for a given purpose as soon as you revoke your consent.

CUSTOMERS’ RIGHTS

You have the following rights vis-à-vis us concerning your personal data:

Access to personal data

You have the right to know whether we are processing your personal data, as well as the right to receive a copy of your personal data and the details of such processing. In addition, you have the right to access a catalogue of your rights – to correction, erasure, limitations on processing, to raise an objection, to lodge a complaint with a supervisory authority.

Correction of personal data

You have the right to correct inaccurate personal data and to supplement incomplete personal data. This means, for example, that whenever you change your e-mail address or telephone number we will always update it immediately so as to ensure problem-free communication. Therefore, please always inform us of changes to your personal information.

Objection to processing

If you believe that our legitimate interest in processing your personal data in cases where we may do so even without your consent is not well-founded, in particular for marketing purposes, then you have the right to raise an objection to the processing of your personal data, including profiling. We will assess your request and if we determine that our interest in further processing does not outweigh your interest in the termination of such processing, then we will terminate the processing of your personal data. In the event of an objection to marketing, we will terminate such processing immediately.

Limitation of processing

You have the right to have us limit the processing of personal data to its storage and evident differentiation from other processed personal data if you believe that:

• the personal data are not accurate
• the processing of the personal data is illegal, but you do not wish to erase them
• you need your personal data for the establishment, exercise or defence of legal claims, even though ČD no longer needs them
• you object to the legitimacy of our interest in processing such data, for the duration of the period in which ČD will analyse the legitimacy of such interest

Erasure of personal data

You have the right to “be forgotten”, i.e. the right to have us erase all your personal data once they are no longer necessary for the purposes for which they were processed and there is no legal basis for further processing, and of course also if your personal data were processed illegally. We will also erase your personal data if they are being processed on the basis of consent and you revoke such consent. They will further be erased if you raise an objection to such processing and we conclude that our legitimate interest does not outweigh your interest in terminating such processing (in cases where your personal data are processed on the basis of our legitimate interest), or if you raise an objection to such processing for purposes of direct marketing. We will also erase your personal information if we are ordered to do so in accordance with the law.

Your personal data cannot be erased, however, if there exist reasons for which it is possible to continue processing despite your request, in particular the need for further processing for the establishment, exercise or defence of our legal claims, the fulfilment of our legal responsibilities or the exercise of rights to the freedoms of speech and information, as well as for scientific or historical research or for statistical or archiving purposes in the public interest. Unless further processing is essential, however, we will grant your request immediately.

Portability

You have the right to “take away” your personal data from us and give them to a different controller. In this manner, it is possible to transfer all the personal data that we process by automated means on the basis of your consent or a contract. We will make available all data to you or to a new controller in a structured, commonly used and machine-readable format. Completing the transfer process is the responsibility of your new controller and its technical facilities, however. Simply put, we cannot guarantee that the new controller will be able to read and work with your personal data.

Revocation of consent

If we are processing your personal data on the basis of your consent, you can simply revoke such consent at any time. As soon as we receive your revocation of consent, we will no longer process your personal data for these purposes. You will find the procedure for revoking consent in the chapter on exercising customers’ rights.

Lodging a complaint with a supervisory authority

If you are convinced that your rights under legislation have been violated, you can address a complaint directly to the supervisory authority in certain EU member states, in particular in the member state of your normal residence, your place of employment, or the place where the alleged violation occurred. The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

EXERCISING CUSTOMERS’ RIGHTS

Customers’ rights concerning personal data, including the revocation of consent, can be exercised at any time in the manners specified below, which ensure that your request is handled as quickly as possible:

1. www.cd.cz/kontaktni-formular
2. data message sent to ID: e52cdsf
3. written letter sent to České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic
4. e-mail sent to dpo@cd.cz
5. in person at the address České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic

For exercising your rights, we have prepared the Form for Exercising Customer’s Rights Concerning Personal Data, but you can also send us your request in your own format. In order to grant your requests, however, we must first and foremost verify that the person submitting the request is really you. This is the only way to prevent the abuse of your personal data by a third party, an irreversible change to your personal data, or even their loss. Documents uploaded to our website or sent by e-mail must therefore be accompanied by your guaranteed electronic signature. If you are an In Karta cardholder, you can upload documents to the Portal without this signature. You can also send documents as letters sent by post, to which you affix your officially certified signature. On the e-mail subject line or envelope, please always write “GDPR”.

If you exercise your rights in person in the filing room (“Podatelna”) at our headquarters at České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic, only an identification document issued by a state administrative body will be required to verify your identity.

In case you do not remember your password, you can easily request a new one online on https://www.cd.cz/en/profil-uzivatele/spravce-inkaret/neregistrovany/, which will be sent to the e-mail address that you provided in the Contract on the Issue and Use of and In Karta Card. You can also change your password in person in a ČD ticket office.

Although we want to make it as easy as possible for you to exercise your rights, we must eliminate the risk of illegitimate interventions into the processing of your personal data. Therefore, if we have doubts as to whether such a request is being submitted by you, we will ask you to provide additional information.

NOTICE CONCERNING THE CONSEQUENCES OF SUCCESSFULLY EXERCISING CUSTOMERS’ RIGHTS

In order for us to discharge our legal responsibilities or to fulfil a contract that we are to conclude with you, it is essential that you provide most of the personal data we process. It is therefore your responsibility to provide these personal data to us. If you do not do so, we will be unable to make the requested service available to you.

If a request to erase all personal data for all specified purposes is granted, this will result in the termination of the contractual relationship between the customer and ČD established by the Contract on the Issue and Use of an In Karta Card, as well as the termination of contractual relationships conditioned by this contract. The customer is then required to return the In Karta card to ČD. No compensation is provided for the non-use of services connected with the card.