We process personal data solely on the basis of, and in the extent permitted by, Regulation of the European Parliament and Council No. 2016/679, on personal data protection and related regulations. This also applies to all processors that process personal data in accordance with our instructions.
You will find all the information concerning personal data processed by ČD, as well as updates to these terms and conditions, on http://www.cd.cz/pravasubjektu.
PERSONAL DATA CONTROLLER – ČD
The controller of personal data processed in connection with the “ČD Bike Questionnaire” contest is the company České dráhy, a.s., ID No.: 709 94 226, with Registered Office at Nábřeží L. Svobody 1222, 110 15 Praha 1, Czech Republic, registered in the Commercial Registry maintained by the Municipal Court in Prague, Section B, rider 8039.
DATA PROTECTION OFFICER
Regarding matters related to the processing of personal data, you can contact the personal data protection officer at ČD by e-mail on: dpo@cd.cz.
PURPOSES OF PROCESSING AND THEIR LEGAL BASIS
These data : name, surname, telephone number, e-mail address are processed for this purpose:
- Provision of transport to groups (including provision of seats) per the orderer’s requirements
… in order to fulfil our responsibilities under the Transport Contract
The provision of personal data is a contractual requirement of ČD. Without the provision of your personal data, ČD cannot provide the requested service.
RECIPIENTS OF PERSONAL DATA
We provide personal data exclusively to:
- the administrators of our information systems where personal data are processed,
Personal data can also be provided to public authorities, should this be required by legislation, if doing so is essential to protect against unreasonable harm to another’s freedom, life, health or rights of ownership.
DURATION OF STORAGE
We will terminate personal data processing automatically after 12 months have passed from the date of the order to transport a group.
In the event that the purpose of the processing lapses earlier, then we will terminate the processing of your personal data for this defunct purpose prior to the end of this period.
THE DATA SUBJECT’S RIGHTS
You have the following rights vis-à-vis us concerning your personal data:
Access to personal data
You have the right to be issued a confirmation of whether we are processing your personal data, as well as the right to receive a copy of your personal data and the details of such processing. In addition, you have the right to access a catalogue of your rights – to correction, erasure, limitations on processing, to raise an objection, to lodge a complaint with a supervisory authority.
Correction of personal data
You have the right to correct inaccurate personal data and to supplement incomplete personal data. This means, for example, that whenever you change your e-mail address or telephone number we will always update it immediately so as to ensure problem-free communication. Therefore, please always inform us of changes to your personal data.
Limitation of processing
You have the right to have us limit the processing of personal data to its storage and evident differentiation from other processed personal data if you believe that:
- the personal data are not accurate
- the processing of the personal data is illegal, but you do not wish to erase them
- you need your personal data for the establishment, exercise or defence of legal claims, even though ČD no longer needs them
- you object to the legitimacy of our interest in processing such data, for the duration of the period in which ČD will analyse the legitimacy of such interest
Erasure of personal data
You have the right to “be forgotten”, i.e. the right to have us erase all your personal data once they are no longer necessary for the purposes for which they were processed and there is no legal basis for further processing, and of course also if your personal data were processed illegally. They will further be erased if you raise an objection to such processing and we conclude that our legitimate interest does not outweigh your interest in terminating such processing (in cases where your personal data are processed on the basis of our legitimate interest), or if you raise an objection to such processing for purposes of direct marketing. We will also erase your personal information if we are ordered to do so in accordance with the law.
Your personal data cannot be erased, however, if there exist reasons for which it is possible to continue processing despite your request, in particular the need for further processing for the establishment, exercise or defence of our legal claims, the fulfilment of our legal responsibilities or the exercise of rights to the freedoms of speech and information, as well as for scientific or historical research or for statistical or archiving purposes in the public interest. Unless further processing is essential, however, we will grant your request immediately.
Portability
You have the right to “take away” your personal data from us and give them to a different controller. In this manner, it is possible to transfer all the personal data that we process by automated means on the basis of your consent or a contract. We will make available all data to you or to a new controller in a structured, commonly used and machine-readable format. Completing the transfer process is the responsibility of your new controller and its technical facilities, however. Simply put, we cannot guarantee that the new controller will be able to read and work with your personal data.
Lodging a complaint with a supervisory authority
If you are convinced that your rights under legislation have been violated, you can address a complaint directly to the supervisory authority in certain EU member states, in particular in the member state of your normal residence, your place of employment, or the place where the alleged violation occurred. The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).
EXERCISING THE DATA SUBJECT’S RIGHTS
Customers’ rights concerning personal data can be exercised at any time in the manners specified below, which will ensure that your request is handled as quickly as possible:
1. www.cd.cz/kontaktni-formular/
2. data message sent to ID: e52cdsf
3. written letter sent to České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic, with an officially authenticated signature
4. e-mail sent to dpo@cd.cz with an electronic signature attached
5. in person in the filing room (“podatelna”) at České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic, where your identity will be verified
For exercising your rights, we have prepared the Form for Exercising Customer’s Rights Concerning Personal Data, but you can also send us your request in your own format. In order to grant your requests, however, we must first and foremost verify that the person submitting the request is really you. This is the only way to prevent the abuse of your personal data by a third party, an irreversible change to your personal data, or even their loss. Documents uploaded to our website or sent by e-mail must therefore be accompanied by your guaranteed electronic signature. If you are sending documents by e-mail or as a data message, please always enter “GDPR” as the subject of your message. If you are an In Karta cardholder, you can upload documents to the e-shop without this signature after logging in. You can also send documents as letters sent by post, to which you affix your officially certified signature. On the e-mail subject line or envelope, please always write “GDPR”.
If you exercise your rights in person in the filing room (“Podatelna”) at our headquarters at České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic, only an identification document issued by a state administrative body will be required to verify your identity.
Although we want to make it as easy as possible for you to exercise your rights, we must eliminate the risk of illegitimate interventions into the processing of your personal data. Therefore, if we have doubts as to whether such a request is being submitted by you, we will ask you to provide additional information.
NOTICE CONCERNING THE CONSEQUENCES OF SUCCESSFULLY EXERCISING THE DATA SUBJECT’S RIGHTS
If you successfully exercise your right to erasure of all personal data for all specified purposes, this will result in the termination of the contractual relationship between the customer and ČD established by the contract.