The internal notification system of the company Dopravní podnik města Hradec Králové, as
The company Dopravní podnik města Hradec Králové, as , with registered office at Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, ID number: 25267213, registered in the commercial register maintained by the Regional Court in Hradec Králové, section B, entry 1625 (hereinafter " the Company "):
a) with regard to Act No. 171/2023 Coll., on the protection of whistleblowers, as amended (hereinafter " ZOO " or " the Act on the Protection of Whistleblowers "), the so-called Whistleblowing, which mainly states the conditions for submitting and assessing a notification about a possible illegal actions, and conditions for providing protection to natural persons who made the notification, and
b) with regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC (hereinafter referred to as " GDPR "), which lays down in particular the rules regarding the protection of natural persons in connection with the processing of personal data,
introduced the Company's Internal Reporting System.
The Company's internal whistleblowing system implements rights and obligations under the Whistleblower Protection Act.
I. NOTIFIER AND NOTICE
1. Whistleblower
1.1 A whistleblower is a natural person who made a notification in accordance with the Act on the Protection of Whistleblowers.
2. Notice
2.1 Notification means a notification according to the Whistleblower Protection Act.
II. INTERNAL NOTIFICATION SYSTEM
1. Relevant person and contact information for submitting the Notice
1.1 In accordance with the Act on the Protection of Whistleblowers, the Company has implemented the Company's internal reporting system, intended for receiving and processing Notifications.
1.2 The company has appointed the following competent person to carry out the activities of the competent person according to the Act on the Protection of Whistleblowers: Ing. Josef Januš (hereinafter " Relevant Person ").
1.3 The relevant person is the person who receives and handles the Notification within the Company's internal notification system.
1.4 The Company allows notification to be submitted in writing, orally and in person, as follows:
Telephone of the relevant person: +420 495 089 270,
e-mail Relevant person: oznameni@dpmhk.cz ,
· through the contact form Relevant person on the website www.dpmhk.cz
· by mail to the delivery address: Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, with the information " To the attention of the relevant person ",
· in person at the office Relevant persons: Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, building, ground floor, room no. 19; office hours Relevant persons for personal meetings Mon – Fri, 8:30 a.m. – 10:30 a.m., or by prior arrangement.
2. Content of notification – identity of the Notifier
2.1 According to § 2, paragraph 2 of the ZOO, the Notification also contains information about the name, surname and date of birth, or other information from which it is possible to infer the identity of the Notifier. The notification does not have to contain the data according to the first sentence, if it was submitted by a person whose identity is known to the Relevant Person.
3. Non-exclusion of whistleblowers
3.1 The Company does not exclude receiving Notifications from a person who does not perform work or other similar activities for the Company in accordance with § 2 paragraph 3 letter a), b), h) or i) ZOO.
4. Notification to the Department
4.1 The methods of notification to the Ministry of Justice are listed at: https://oznamovatel.justice.cz/chci-podat-oznameni/
5. Whistleblower Protection
5.1 The conditions for the right to Whistleblower protection and the scope and content of Whistleblower protection are set out in the Whistleblower Protection Act.
5.2 Protection from retaliation does not apply to a person who has made a Notification without having reasonable grounds to believe that it is based on true information.
6. Procedure of the Relevant Person after submitting the Notice
6.1 The Notifier is allowed to submit a Notification via the internal notification system in writing and verbally (including a telephone notification) or at his request in person .
6.2 If the Notifier requests it, the Relevant Person is obliged to accept the notification personally within a reasonable period of time, but no later than 14 days from the day the Notifier requested it.
6.3 The Relevant Person is obliged to notify the Notifier in writing of the acceptance of the Notification within 7 days of its receipt, unless:
a) The Notifier explicitly asked the Relevant Person not to inform him of the acceptance of the Notification, or
b) it is obvious that the notification of acceptance of the Notification would reveal the identity of the Notifier to another person.
7. Handling of information and personal data
7.1 Only the Relevant Person can read the submitted Notices. The relevant person will not provide information that could defeat or jeopardize the purpose of submitting the Notice.
7.2 Information on the identity of the Notifier and the person pursuant to § 4 paragraph 2 letter a) to h) ZOOs can only be provided with their written consent, unless the Relevant Person is obliged to provide this information to the relevant public authorities in accordance with generally binding legal regulations; this applies similarly to information on the identity of the person listed in the Notice, if it is a procedure according to Title III. ZOO.
7.3 If the Competent Person provides information about the identity of the Whistleblower to a public authority pursuant to § 20, paragraph 2 of the ZOO, he is obliged to inform the Whistleblower in advance, together with the reasons for which he is obliged to provide information about the identity, and to allow the Whistleblower to provide the information expressed.
8. Assessment of Notices
8.1 The relevant person is obliged to assess the reasonableness of the Notification and inform the Notifier in writing of the results of the assessment within 30 days from the date of receipt of the Notification. In factually or legally complex cases, this period can be extended by up to 30 days, but no more than twice. The Relevant Person is obliged to inform the Notifier in writing about the extension of the deadline and the reasons for its extension, unless:
a) The notifier explicitly asked the Competent Person not to inform him about the results of the assessment, or
b) it is obvious that notification of the results of the assessment would reveal the identity of the Notifier to another person.
8.2 If, when assessing the reasonableness of the Notification, the Competent Person discovers that it is not a Notification pursuant to the Whistleblower Protection Act, it shall notify the Notifier in writing without undue delay.
8.3 If the Notification is evaluated as reasonable , the Company's relevant person will propose measures to prevent or correct the illegal situation. If the notification is submitted to the relevant person of the obliged entity for which the Notifier does not perform work or other similar activity, the Relevant Person proposes corrective measures to the person for whom the Notifier performs work or other similar activity, unless the nature of the matter precludes this. If the Company does not take the measures proposed by the Relevant Person, it will take other appropriate measures to prevent or correct the illegal situation; this does not apply if it is a measure proposed to a person other than the obliged entity that designated this Competent Person.
The Company shall immediately notify the Relevant Person of the adopted measure, who shall notify the Informant in writing without undue delay, unless:
a) The notifier explicitly asked the Competent Person not to inform him about the measures taken, or
b) it is obvious that notification of the measures taken would reveal the identity of the Notifier to another person.
8.4 If the Notification is not evaluated as justified , the relevant person shall notify the Notifier in writing without undue delay that, based on the facts stated in the Notification and the circumstances known to him, he did not find any suspicion of the commission of an illegal act, or found that the Notification is based on false information, and instructs the Informant on the right to file a report with a public authority.
9. Recording of Oral Notices
9.1 The Relevant Person shall make an audio recording or a recording of the oral Notice, which faithfully captures the essence of the oral Notice. An audio recording of an oral Notice can only be made with the Notifier's consent. The relevant person will allow the Informant to comment on the recording or transcription of the audio recording, if it has been taken; the Notifier's statement shall be attached to the record or transcript.
10. Records and Retention of Notices
10.1 The relevant person is obliged to keep records of received Notifications in electronic form, to the extent of:
a) the date of receipt of the Notice,
b) name, surname, date of birth and contact address of the Notifier, or other data from which it is possible to infer the identity of the Notifier, if such data is known to the Notifier,
c) summary of the content of the Notification and identification of the person against whom the Notification was directed, if his identity is known to him,
d) the date of completion of the assessment of the reasonableness of the Notification by the Competent Person and their result.
10.2 The relevant person is obliged to keep the Notification submitted through the internal notification system and the documents related to the Notification for a period of 5 years from the date of its receipt.
10.3 In the case of Notifications submitted through the internal notification system, only the Relevant Person has access to the records, to the documents related to the Notification and to the stored Notification.
11. Knowingly false Notification - misdemeanor
11.1 Pursuant to Section 23(1) of the ZOO, a natural person commits an offense by submitting a knowingly false Notification.
11.2 A fine of up to CZK 50,000 can be imposed for an offense according to § 23, paragraph 1 of the ZOO.
12. External notification system
12.1 The competent authority for operating the external notification system is the Ministry of Justice.
III. PROTECTION OF PERSONAL DATA
1. General principles and processed personal data
1.1 Any processing of personal data pursuant to the Act on the Protection of Whistleblowers is carried out in accordance with the GDPR.
1.2 As a personal data controller, the company processes the following personal data:
a) name, surname, date of birth and contact address of the Notifier, or other data from which it is possible to infer the identity of the Notifier, if such data is known to the Notifier; and
b) identification data of the person against whom the Notice is directed, if these data are known to him.
1.3 Notification can also be made anonymously, in which case personal data of the Notifier is not processed.
2. Information according to Article 13 GDPR
In accordance with Article 13 GDPR, the Company hereby provides the following information to all personal data subjects:
a) Identity and contact details of the personal data controller
The administrator of personal data is the Company.
b) Commissioner for the protection of personal data
The company has appointed a personal data protection officer, namely GDPR Hradec s.r.o. , with registered office: Orlické nábřeží 376/17, 500 03 Hradec Králové, ID number: 06708218, contact person: Mgr. Martin Jeřábek , e-mail: info@gdprhradec.cz , phone: +420 495 510 765.
c) Processing purposes
Processing and handling of Notifications according to the Act on the Protection of Whistleblowers.
d) Legal basis of processing
The legal basis for the processing of personal data is the legal title listed in Article 6 paragraph 1 letter c) GDPR, when the processing of personal data is necessary for the fulfillment of a legal obligation that applies to the Company as a controller, and the title referred to in Article 6 paragraph 1 letter a) GDPR, i.e. the consent of the Notifier (data subject) for the purposes of possibly providing information about the identity of the Notifier and for the purposes of making an audio recording or transcription of the oral Notification.
e) Category of concerned data subjects
Whistleblowers, other persons according to the Act on the Protection of Whistleblowers, and persons affected by the Notice.
f) Potential recipients of personal data
Law enforcement authorities, if the legal conditions for the transfer of processed personal data to this authority are met.
g) Time of personal data processing
For the period necessary to dispose of the Notice and the facts stated in it, and for the period of fulfillment of obligations stipulated by generally binding legal regulations, in particular the Act on the Protection of Whistleblowers.
h) Source of personal data
Notice and personal information provided by the Notifier.
i) Rights of data subjects:
1) Right of access to personal data
The data subject has the right to access all processed personal data. Upon his request, the Company will provide a copy of the processed personal data in a machine-readable format.
2) The right to correct personal data
The data subject has the right to have the administrator correct inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the data subject has the right to supplement incomplete personal data, including by providing an additional statement.
3) The right to erasure of personal data
The data subject has the right to the erasure of personal data that the Company has processed without authorization.
4) The right to limit the processing of personal data
The data subject has the right to block his/her personal data under the conditions specified in Article 18 of the GDPR (in particular, if an objection is raised, there is a dispute about the legality of data processing).
5) Right to portability of personal data
The data subject has the right for the Company to provide him with automatically processed personal data in a structured, commonly used and machine-readable format, or for the Company to transfer this data to another administrator, if this is technically feasible.
6) The right not to be subject to automated decision-making
The data subject has the right not to be the subject of any decision based solely on automated processing, including profiling, which would have legal effects for him or significantly affect him. The Company does not perform any such automated decision-making or profiling.
7) The right to object
The data subject has the right to object to the processing of personal data due to a legitimate interest.
8) Request for personal data processing
If personal data is provided by the Notifier, it will be processed in accordance with the GDPR regulation. The processing of the Informant's personal data is carried out on the basis of the Act on the Protection of Whistleblowers and Article 6(1)(a) c) GDPR, is not a contractual requirement, and the Notifier is not obliged to provide personal data.
The provision or non-provision of personal data has no consequence for the Notifier, except that in case of non-provision of personal data, the Company will not be able to identify the Notifier.
9) Right to file a complaint
The data subject has the right to contact the Company at any time with a complaint, or file a complaint with the Office for the Protection of Personal Data , address: headquarters of Plk. Sochora 27, 170 00 Prague 7 or request judicial protection.
3. Method of exercising rights to the protection of personal data
3.1 To exercise your rights in connection with the Notice, contact the Company's: Relevant person .
3.2 On the website http://www.dpmhk.cz/ there are samples of forms for exercising the rights of data subjects.
3.3 In some cases defined by legislation, the Company is not obliged to fully or partially comply with the request. This will be the case in particular if the request is manifestly unfounded or disproportionate, especially because it is repeated. In such cases, the Company may:
· impose a reasonable fee taking account of administrative costs or
· refuse to comply with the request.
If the Company receives a request in the matter of personal data protection, but has reasonable doubts about the identity of the sender of the request, it may request the provision of additional information necessary to confirm the identity of the requester.