Personal data protection

The Hradec Králové Transport Company has always respected the protection of personal data of passengers and its business partners. In connection with the entry into force of the new EU Regulation on the protection of personal data, a comprehensive review of the scope of processed personal data has been carried out in the DP and further measures have been taken aimed at an even higher level of protection of processed personal data. This is reflected in particular in the new possibility for passengers to apply for an anonymous city card, for which no personal data is processed by the DP. Detailed information on the personal data we process, the purposes of processing, the storage period and the rights of individuals are provided in the individual Data Protection Policy, which can be found in the menu on the left.

Forms for download

Request for access to personal data

Request for correction of personal data

Request for restriction of processing of personal data

Request for deletion of personal data

Objection to the processing of personal data

This document provides you with information on how the company Dopravní podnik města Hradce Králové, a.s. („DP“) obtains and processes your personal data in connection with the use of the contactless chip City Card, of which DP is the manufacturer and issuer.

Please note at the outset that you can use the issue option to use the transport services provided by DP:

- portable so-called. FREE CARDS, which does not contain any personal data and DP does not process any personal data in connection with its issue or use;

- non-transferable so-called. anonymous cards, on which the name, surname and photograph are indicated, but the DP does not process or register any personal data.

When processing personal data, we are governed by legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the „EU Regulation“), which enters into force on 25 May 2018.

This document will be updated periodically as the need arises to update it. The updated version of the Principles for the Protection of Personal Data of City Card Users (hereinafter referred to as „Principles“) is effective upon publication on the website www.dpmhk.cz.

We protect your personal data to the maximum extent possible, which corresponds to the technical level of the available means. DP has strict internal rules determining which employees can have access to your personal data and to what extent they can process it, with access rights being limited to the minimum necessary.

We recommend that you read this information carefully. We have done our best to make it as clear as possible. If you are still unclear, we will be happy to explain any concept or passage to you. Please direct any questions to the contact person listed in section 1.2 below.

1. THE CONTROLLER OF YOUR DATA

1.1 The controller of your personal data is:

Hradec Králové City Transport Company, a.s. ., ID: 25267213, registered office: Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, registered in the Commercial Register kept at the Regional Court in Hradec Králové, Section B, Insert 1625.

1.2 Contact person and at the same time Data Protection Officer:

GDPR Hradec s.r.o., with registered office at Fráni Šrámka 1139, 500 02 Hradec Králové, ID: 06708218, contact person: Mgr. Jitka Moníková, e-mail: info@gdprhradec.cz, tel: +420 495 510 765.

1.3 The controller collects, holds and is responsible for the proper and lawful processing of your data. You may exercise your rights against the controller as set out below.

2. DATA PROCESSED, THEIR PURPOSE AND REASON

We only process such data in order to provide you with quality services related to the issuance and use of the City Card. We process your personal data in the following ways and for the following purposes:

2.1. Conclusion of a contract for the issuance of electronic funds - PERSONAL CARDS

2.1.1. BASIC (COMPULSORY) Identification data we process about you for the purpose of concluding the Agreement for the issue of electronic funds - City Card (hereinafter referred to as „Contract“) include those that you provide to us in any of the following ways:

- - by completing the Agreement in person at DP distribution points or
  - by completing the Agreement in the online form available on our website www.dpmhk.cz.

Specifically, we process the following types of personal data:

- - - name and surname (if the holder of the City Card is a child under 15 years of age, then also for the legal guardian),
    - date of birth (if the holder of the City Card is a child under 15 years of age, then the legal guardian is also required),
    - your handwritten signature,
    - photo (only for the purpose of producing the City Card, it is subsequently deleted).

This information is part of each Contract and is required to enable us to enter into the Contract and issue a non-transferable City Card.

- - - E-mail is only required as a mandatory data when you fill in the online application for a City Card together with the attachment of a photo file and sending the payment (information about the date of the City Card collection and the payment is sent to the e-mail).

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.1.2. ADDITIONAL (OPTIONAL) personal data that we process only if you provide it to us when you complete the Contract (in person or online), including:

- - e-mail and telephone number (if the holder of the City Card is a child under 15 years of age, then this information is only for the legal guardian),

If you provide us with this information, we can provide you with a more convenient communication service, e.g. in case your card is found, when communicating about collecting the produced City Card, etc. If you provide us with information on whether you are a student, we can use this to grant you the benefits that DP provides to such persons, i.e. fare discounts.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.1.3. The following are further processed when the City Card is issued and in connection with its activation

OPERATIONAL DATA :

- - - Application/Contract number,
    - the date of issue of the City Card and its validity,
    - the number of the issued City Card,
    - the amount of money on the City Card,
    - the bank account number in the case of an online payment before the City Card is issued, which is used exclusively for the purpose of identifying the payment received and is not used by the DP after the identification.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.2. Conclusion of a contract for the issue of electronic funds - ANONYMOUS CARDS

2.2.1 When concluding a contract for the issuance of an Anonymous Card, we only need the following data for the purpose of its production, which you fill in the Contract for the issuance of electronic funds - Anonymous City Card:

- - name and surname (to be shown on the card for transport control purposes)
  - a photograph (to be displayed on the card for transport control purposes)
  - date of birth (will not be shown on the card, it is only used to verify the possibility of activating fare discounts for persons over 65 years of age).

2.2.2. Once the Anonymous Card has been produced and physically handed over to the holder, the Electronic Cash Issuance Agreement - Anonymous City Card is shredded and no personal data in paper or electronic form is processed about the holder of the Anonymous Card.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.3. Fulfillment of the Contract - online top-up of the City Card

If you take advantage of the option to purchase season tickets and top up your e-wallet via online sales on www.dpmhk.cz, we process the following personal data about you:

- - e-mail, for the purposes of:
    - sending you a notification when your time ticket is about to expire (if you actively choose this option),
    - sending information about the payment,
    - sending information about the successful payment transaction,
    - sending you a password to access your order history,
    - sending the generated new forgotten password,
    - sending information about cancellation of a paid order
  - City Card number for entry into the ordering system and for identification on the tax receipt,
  - order history,
  - order number and partial payment amount,
  - the assigned password to enter the order history.

This data is necessary for the proper functioning of the online City Card top-up service.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.4. Performance of the Contract - processing of other personal data

2.4.1. Data from peer-to-peer communication

We also process data about our mutual communication related to the use of the City Card, such as when dealing with your comments or claims, etc. In this communication we process the following personal data that you provide to us:

- - - name and surname,
    - address of the complainant,
    - contact details (e-mail or telephone),
    - City card number - if the card is blocked, it is listed in the list of blocked cards.

This information is entered on the form: Acceptance of complaint or complaint form.

The reason (legal basis) why we process the data:

- when dealing with complaints and claims, these are actions related to the performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation);

- when blocking the card, these are also acts in which the DP exercises its contractual right under the terms and conditions, i.e. acts related to the performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.4.2. Accounting and tax

We collect your identification and transactional data (in particular, on cash payments made, on cancelled payments, on any refunds for legitimate claims) in order to fulfil our accounting and tax obligations imposed by applicable legislation (in particular the Accounting Act, the Value Added Tax Act, the Payment Act).

This is the information that is shown on the tax documents. Therefore, if we are required by law to keep these documents, we will keep your personal data that must appear on the documents together with them.

The reason (legal basis) why we process the data:

- compliance with legal obligations (we use this reason in accordance with Article 6(1)(c) of the EU Regulation).

2.4.3. Exercise (or defence) of rights

Should a dispute arise between DP and you, we will process your personal data necessary to defend our legal claims in connection with the dispute until the dispute is concluded. As a rule, in this context, we process basic passenger data, data on payments made, data from the complaint procedure, data from mutual communication, data on the legal action taken and its results.

The reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6(1)(f) of the EU Regulation).

3. HOW LONG DO WE KEEP YOUR DATA?

DP processes personal data for the minimum period for which it is obliged to process personal data.

3.1. Personal data of passengers

We process passengers' personal data in our electronic database (and certain documents such as the Contract, complaint report, receipt of a complaint, also in paper form) for the duration of the contractual relationship that is the basis for the processing of this personal data. That is, unless the passenger or DP terminates the Contract or there is another reason for early termination of the Contract (see Art. X. Conditions for the issue and use of contactless chip City Cards), we will process your personal data until the City Card expires (see Article III. Conditions for the issue and use of contactless chip City Cards). You can find out the validity period from each transaction receipt (charging) or at self-service machines.

If the City Card is not renewed by you, we will retain your personal data for 6 months after the expiry date (in a limited processing mode) in case you make a claim. However, if there are any unspent funds on the City Card, we will retain your personal data and keep the City Card available for withdrawal for 3 years after expiry. After the expiry of these periods (i.e. 6 months or 3 years), the personal data will be deleted/anonymised, both in paper and electronic form; however, not if we still need it after the expiry of this period for other purposes, e.g. to defend our claims (i.e. to resolve a dispute that has arisen, e.g. because of a claim) or for other legal reasons (e.g. to comply with accounting and tax obligations, etc.).

If there is early termination of the Contract, we will delete/anonymize the personal data within 4 months of the early termination of the Contract , in documentary and electronic form; however, not if we need them after the expiry of this period for other purposes, e.g. to defend our claims (i.e. to resolve a dispute, e.g. because of a claim) or for other legal reasons (e.g. to comply with accounting and tax obligations, etc.).

Provided by we will use the photo for the City Card only for the production of the City Card (usually processed within 1 working day) and then the photo is returned to you or, if it was provided online, it is deleted within 1 working day of the City Card being produced.

If you apply for a City Card but it is not collected within 6 months, we will delete/anonymize the personal data provided .

3.2. Deletion of personal data on the PERSONAL CITY CARD

As a holder of a PERSONAL City Card, you are entitled to apply to the DP for complete deletion of personal data recorded by the DP. As a result of such a request, the personal data processed by the DP in electronic and paper form in relation to the issued Personal City Card will be deleted/anonymised (after verification of the applicant's identity, if necessary). In this case, the original card will also be blocked and a new anonymous card issued.

Even if we do not receive any request for deletion, the DP automatically to delete the history of orders after 2 years; this is without prejudice to the obligation of the DP to keep tax documents on fare payments for the statutory period.

3.3. Personal data other

Tax documents (order confirmation) will be deleted within 1 month after the expiry of 5 years from the monetary transaction, unless a longer period is required by law in a specific case.

Personal data of the legal representative persons under 15 years of age, the DP shall be deleted/anonymised in relation to the represented person as soon as the reason for representation (e.g. attainment of the age of 15 years) has ceased to exist, or, if the purpose has not ceased to exist, together with the deletion/anonymisation of the personal data of the City Card holder.

Should a dispute arise between DP and you, we will need your personal data to defend our legal claims in connection with the dispute until the end of the dispute.

4. SOURCES OF PERSONAL DATA

We only process personal data that we have received from you or obtained from communication with you when using the City Card. We do not seek or process personal data about you from public sources.

5. RECIPIENTS OF PERSONAL DATA

As a matter of principle, we manage your personal data within DP and do not pass it on to third parties unless it is strictly necessary.

Such a need may arise in the case of external suppliers/service providers such as:

- provider of check-in system services in Hradec Králové (EMTEST a.s., based in Slovakia),

- the provider of the GoPay payment gateway (GOPAY s.r.o. company based in the Czech Republic),

- the operator of the e-shop for on-line recharging of the City Card (EM TEST ČR spol. s r.o., based in the Czech Republic),

- legal service providers (in case of a dispute), auditors (auditing of accounting documents).

In this case, written contractual relationships are entered into with these entities (if they have the status of personal data processors), which contractually ensure the security of the personal data transferred in accordance with the EU Regulation. The IT service providers are principally located within the EU and personal data are not transferred outside the EU.

Certain state administration authorities are entitled to request information about you on an ad hoc basis in order to fulfil their legal obligations (e.g. the Police of the Czech Republic, financial control authorities). We only provide data if the authority to request such data is required by law.

6. WHAT RIGHTS DO YOU HAVE?

Right of access to personal data

You have the right to access all personal data processed. Upon your request, we will provide a copy of the processed personal data in a machine-readable format, or we will allow you to view the concluded Agreement and other documents stored with it.

Right to rectification of personal data

You have the right to have your personal data changed (or incorrect data found for any other reason) corrected. We will make the correction once we can verify the changed data (e.g. from a new identity document).

Right to erasure of personal data

You have the right to erasure of your personal data that we have processed unlawfully.

Right to restriction of processing of personal data

You have the right to have your personal data blocked under the conditions set out in Article 18 of the EU Regulation (in particular if an objection is raised, there is a dispute about the lawfulness of the processing).

Right to portability of personal data

You have the right to have us provide you with the automated personal data in a structured, commonly used and machine-readable format or, where technically feasible, to transmit the data to another controller.

Right to withdraw consent

If you have given us your consent to the processing of your personal data for specified purposes, you have the right to withdraw this consent at any time. However, we do not require your consent in relation to the provision of services related to the use of the City Card.

The right not to be subject to automated decision-making

You have the right not to be subject to any decision based solely on automated processing, including profiling, which would have legal effects concerning you or significantly affect you. DP does not carry out any such automated decision-making or profiling.

Right to object

You have the right to object if the processing is based on our legitimate interest (defence of legal claims).

Right to lodge a complaint

You have the right to contact the DP at any time with your complaint, or to file a complaint with the Office for Personal Data Protection, address: headquarters Pplk. Sochor 27, 170 00 Prague 7 or to seek judicial protection.

Method of exercising rights

To exercise your rights mentioned above, please contact our Data Protection Officer: the company GDPR Hradec s.r.o., with registered office at Fráni Šrámka 1139, 500 02 Hradec Králové, ID No.: 06708218, contact person: Mgr. Jitka Moníková, e-mail: info@gdprhradec.cz, tel.: +420 495 510 765 or you can exercise these rights in person when you visit the DP. To exercise your rights, you can use our forms located at www.dpmhk.cz in the Personal Data Protection section - here you will find for each right a more detailed explanation of the conditions for exercising the right.

We are obliged to inform you free of charge of the measures taken without undue delay and in any case within one month of receipt of the request. This period may be extended by a further two months if necessary and in view of the complexity and number of requests. If we do not comply with your request, we will inform you without delay (within one month at the latest) of the reasons for not complying.

In some cases, as defined by the legislation, we are not obliged to grant the request in whole or in part. This will beto do so, in particular if the request is manifestly unfounded or unreasonable, especially because it is repetitive. In such cases, we may:

(i) impose a reasonable fee taking into account administrative costs; or

(ii) refuse to grant the request.

If we receive a request but have reasonable doubt about the identity of the sender of the request, we may ask you to provide additional information necessary to confirm your identity.

This document provides you with information on how the company Hradec Králové City Transport Company, a.s. (hereinafter also referred to as „Company“)obtains and processes your personal data in connection with by operating the CCTV system.

When processing personal data, we are governed by legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as „EU Regulation“), which comes into force on 25 May 2018.

This document will be updated periodically as the need arises to update it. The updated version of this Privacy Policy regarding the operation of the CCTV system (hereinafter referred to as „Policy“) is effective upon publication on the website www.dpmhk.cz.

We protect your personal data to the maximum extent possible, which corresponds to the technical level of the available means. The Company has strict internal rules determining which employees can have access to your personal data and to what extent they can process it, with access authorisations being limited to the minimum necessary.

The policy is intended to inform the Company's employees and third parties who may be recorded by the Company's CCTV system about the conditions and reasons for which CCTV footage is recorded at the Company.

We recommend that you read this information carefully. We have done our best to make it as clear as possible. If you are still unclear about anything, we will be happy to explain any concept or passage to you. Please direct any questions to the contact person listed in section 1.2 below.

1. CAMERA SYSTEM ADMINISTRATOR AND COMMISSIONER

1.1 The administrator of the CCTV system is:

Hradec Králové City Transport Company, a.s.., ID: 25267213, registered office: Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, a company registered in the Commercial Register kept at the Regional Court in Hradec Králové, Section B, Insert 1625.

1.2 Contact person and at the same time Data Protection Officer:

Company GDPR Hradec s.r.o., with registered office at Fráni Šrámka 1139, 500 02 Hradec Králové, ID: 06708218, contact person: Mgr. Martin Jeřábek, e-mail: info@gdprhradec.cz, tel: +420 495 510 765.

1.3 The controller collects, holds and is responsible for the proper and lawful processing of your data. You may exercise your rights against the controller as set out below.

2. PURPOSE OF THE PRINCIPLES

The purpose of this Policy is to:

setting parameters for monitoring selected premises by a camera system (hereinafter referred to as „Camera system“) in particular in accordance with the EU Regulation and Act No. 262/2006 Coll., the Labour Code, as amended, and the proper fulfilment of the information obligation towards persons who may be recorded by the CCTV system.
fulfil the purposes and principles of data protection pursued by the EU Regulation, provided that the personal data must be:

(a) processed fairly and in a lawful and transparent manner in relation to the data subject - the principle of legality, fairness and transparency.

(b) collected for specified, explicit and legitimate purposes and may not be further processed in a way incompatible with those purposes - the principle of purpose limitation.

(c) proportionate, relevant and limited to what is necessary in relation to the purpose for which they are processed - the principle of data minimisation.

(d) stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed - principle of limitation of imposition.

(e) processed in a manner that ensures appropriate security of personal data, including protection by appropriate technical or organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage - principle of integrity and confidentiality.

3. DATA PROCESSED, THEIR PURPOSE AND REASON

3.1 If you visit us at our headquarters or are in the terminal in Hradec Kralove, please note that selected areas used by our Company are Viewed by and in some cases recorded by CCTV, as further detailed in this Policy.

These areas are visibly marked with a camera pictogram and accompanied by the information required by the EU Regulation.

3.2. The purpose and reason for the establishment and operation of the CCTV system (and therefore the purpose of processing personal data obtained through the CCTV system) is:

1. 1. ensuring the inspection of selected premises in order to help protect the Company's property (ownership right) from damage or theft, processing of the personal data obtained for the purpose of reporting possible crimes to the competent authority and handing over the seized evidence.
  2. ensuring the inspection of selected premises in order to contribute to the protection of property (ownership), life and health of the Company's employees, the processing of the personal data obtained for the purpose of reporting possible crimes to the competent authority and handing over the seized evidence.
  3. ensuring the inspection of selected premises in order to contribute to the protection of property (property rights), life and health of persons moving in the Company's premises and premises operated by the Company, processing of personal data obtained for the purpose of reporting possible crimes to the competent authority and handing over the seized evidence.

4. DESCRIPTION OF MEASURES TAKEN BY THE COMPANY IN CONNECTION WITH THE OPERATION OF THE CCTV SYSTEM

4.1 The Company has taken appropriate measures to ensure that CCTV surveillance does not inappropriately and unreasonably intrude into the private spaces of the individuals concerned.

4.2 The Company has carried out an internal legal analysis in relation to the CCTV system justifying the legality and appropriateness of the use of the CCTV system to the extent used and justifying the application of so-called legitimate interest under Article 6(1)(f) of the EU Regulation.

4.3 All operations of the authorised user with the CCTV recording system, including copying, modifying and deleting records, are logged (a record of the user's activity in the system is made).

4.4 The footage captured by the CCTV system may, in accordance with the purpose set out in this Policy provided to law enforcement authorities, i.e. after the discovery of an incident that could constitute a criminal offence.

5. BASIC DESCRIPTION OF THE CAMERA SYSTEM

5.1 A CCTV system is an automatically operated permanent technical system enabling the acquisition and storage of video recordings from monitored locations.

5.2 The camera system consists of camera circuits, with more detailed specifications in Article 6 of the Principles.

5.3. The camera system is operated in the premises specified in more detail in Article 6 of the Principles.

5.4 The camera system does not record areas intended for purely private activities of persons (e.g. toilets, showers, changing rooms).

5.5 The CCTV system is not used for systematic surveillance of persons or for surveillance contrary to the purposes set out in this Policy.

5.6 The monitored areas are individually specified in Article 6 of the Policy and are always visibly marked with an information board (hereinafter referred to as „Table“) placed in the area of the entrance (or entrance) to the individual monitored premises, as well as in other appropriate places for the purpose of fulfilling the information obligation.

The table always contains:

1. 1. camera pictogram,
  2. a statement on the monitoring of the premises by a camera system with recording (if recording is made),
  3. identification of the Company as the data controller,
  4. a link to more detailed information within the scope of Article 14 of the EU Regulation (which will be placed as close as possible to the Table so that data subjects can easily and transparently get acquainted with this information).

6. INVENTORY OF INDIVIDUAL CAMERAS

6.1. Camera circuit A - Company headquarters

6.1.1. Address: Pouchovská 153/52, Věkoše, Hradec Králové

6.1.2 The camera system consists of the following individual cameras:

Camera 1

Field of view: the handling area in front of the entrance to the bus garage

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 2

Field of view: entrance to the petrol station

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 3

Field of view: entrance to the site and car park - side view

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 4

Field of view: bus parking lot - covered

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 5

Field of view: bus parking lot - covered, access road

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 6

Field of view: car park of the Company's cars

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 7

Field of view: office building, entrance hall - money withdrawal

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 8

Field of view: articulated bus parking area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 9

Field of view: wheelhouse

Camera type: IP camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 10

Field of view: petrol station - indoor area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 11

Field of view: petrol station - indoor area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 12

Field of view: petrol station - indoor area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 13

Field of view: petrol station - indoor area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 14

Field of view: petrol station - indoor area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 15

Field of view: entrance to the premises

Camera type: IP camera, swivel

Recording: no recording - online preview only

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 16

Field of view: dishwasher (interior)

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 17

Field of view: parking lot in front of the administration building

Camera type: IP camera, stationary

Recording: continuous recording, storage time three calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 18

Field of view: trolleybus shelter

Camera type: IP camera, stationary

Recording: no recording - online preview only

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 19

Field of view: trolleybus shelter

Camera type: IP camera, stationary

Recording: no recording - online preview only

Purpose: the purpose set out in Article 3.2 of this Policy

6.1.3. On-line view of the camera circuit A of the CCTV system:

a) is displayed for cameras 1 - 8 and 17 on the monitor in the gatehouse of the Company's headquarters

b) is displayed for camera 9, 15, 18 and 19 on the control room monitor at the Company's headquarters

c) for camera 10 - 14 is not displayed

d) not displayed for camera 16

6.1.4 The recording equipment of the CCTV camera circuit A of the CCTV system is:

a) for camera 1 - 8 placed in a place inaccessible to the public at the gatehouse in a locked cabinet and under constant supervision of the security guard at the gatehouse.

b) for cameras 9 and 17 located in a place inaccessible to the public in the backup server room (the server room is without windows and the entrance to the room is locked) in the control room at the Company's headquarters under the constant supervision of the controllers.

c) for camera 10 - 14 located in a place inaccessible to the public in the cleaning hall (locked substation) at the Company's headquarters.

d) for camera 16 located in a locked cabinet in a locked command centre.

6.1.5 Access to the rooms and premises (cabinets) with recording equipment of the CCTV system's CCTV circuit A shall be granted only to a responsible person designated by the Company.

6.1.6. The transmission cables of the camera system are sealed and stored in cable protectors.

6.2. Camera circuit B - Public transport terminal (public transport terminal)

6.2.1. Address: public transport terminal, Nádražní Street, Hradec Králové

6.2.2 The camera system consists of the following individual cameras:

Camera 1

Field of view: terminal hall

Camera type: analogue camera, swivel

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 2

Field of view: terminal hall - main entrance

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 3

Field of view: terminal hall - public transport information, adjacent entrance to the public transport hall

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 4

Field of view: terminal hall - public transport information, adjacent entrance to the public transport hall

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 5

Field of view: bicycle racks

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 6

Field of view: outdoor areas of the terminal

Camera type: analogue camera, swivel

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 7

Field of view: outdoor areas of the terminal

Camera type: analogue camera, swivel

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 8

Field of view: platforms A1 and B1 - direction to Nádražní street

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 9

Field of view: platforms A1, B1, B2 - direction to the rest area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 10

Field of view: exit to Nádražní Street, roundabout on Nádražní/Sladkovského Street

Camera type: analogue camera, stationary

Recording: no recording - online preview only

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 11

Field of view: platform C1 - E, direction Nádražní street

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 12

Field of view: platform C1

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 13

Field of view: platform C - D, direction Nádražní street

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 14

Field of view: platform D1 - E

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 15

Field of view: platform D1 - E, direction Nádražní street

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 16

Field of view: platforms E1 - F2, direction rest area

Camera type: analogue camera, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

6.2.3. On-line view of the camera circuit B of the camera system is displayed on the monitor of the control room of the Public Transport Terminal. The online preview of the camera circuit B of the CCTV system is also displayed on the dispatching centre of the Hradec Králové Municipal Police, established by the Statutory City of Hradec Králové, when the Statutory City of Hradec Králové is entitled to use such a preview exclusively for the purpose of fulfilling the tasks of the Municipal Police as municipal police according to Act No. 553/1991 Coll., on Municipal Police, as amended, and in compliance with all generally binding legal regulations.

6.2.4. The recording equipment of the CCTV camera circuit B of the CCTV system is located in a place inaccessible to the public in the server room of the Public Transport Terminal (the server room is without windows and the entrance to the room is locked).

6.2.5 Only a responsible person designated by the Company shall have access to the room with the recording equipment of the CCTV camera system circuit B.

6.2.6. The transmission cables of the camera system are sealed and stored in cable protectors.

6.3. Camera circuit C - Terminal of public transport (terminal of long-distance transport)

6.3.1. Address: public transport terminal, Nádražní Street, Hradec Králové

6.3.2 The camera system consists of the following individual cameras:

Camera 1

Field of view: terminal hall

Camera type: analogue, swivel

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 2

Field of view: terminal hall - main entrance

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 3

Field of view: terminal hall - information, adjacent entrance to the hall

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 4

Field of view: terminal hall - information, adjacent entrance to the hall

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 5

Field of view: outdoor areas of the terminal

Camera type: analogue, swivel

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 6

Field of view: platform C1 - F3, direction Nádražní street

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 7

Field of view: platforms F1 - F3, direction rest area

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 8

Field of view: entrance from Nádražní Street

Camera type: analogue, stationary

Recording: no recording - online preview only

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 9

Field of view: exit G1, direction Nádražní street

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 10

Field of view: platform C1 - exit G1, direction rest area

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 11

Field of view: Platform H1 - J3, direction Nádražní street

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 12

Field of view: platform H1 - J3, direction rest area

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 13

Field of view: platform I1 - J3, direction Nádražní street

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 14

Field of view: platforms I1 - J3, direction rest area

Camera type: analogue, stationary

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 15

Field of view: outdoor areas of the terminal

Camera type: analogue, swivel

Recording: no recording - online preview only

Purpose: the purpose set out in Article 3.2 of this Policy

Camera 16

Field of view: terminal platform area

Camera type: analogue, swivel

Recording: continuous recording, storage time five calendar days

Purpose: the purpose set out in Article 3.2 of this Policy

6.3.3. On-line view of the camera circuit C of the camera system is displayed on the monitor of the control room of the Public Transport Terminal. The online view of the camera circuit C of the CCTV system is also displayed on the control room of the Hradec Králové Municipal Police, established by the Statutory City of Hradec Králové, when the Statutory City of Hradec Králové is entitled to use such a view exclusively for the purpose of performing the tasks of the Municipal Police as municipal police according to Act No. 553/1991 Coll., on Municipal Police, as amended, and in compliance with all generally binding legal regulations.

6.3.4. The recording equipment of the camera circuit C of the CCTV system is located in a place inaccessible to the public in the server room of the Public Transport Terminal (the server room is without windows and the entrance to the room is locked).

6.3.5 Only a responsible person designated by the Company shall have access to the room with the recording equipment of the CCTV camera system circuit C.

6.3.6. The transmission cables of the camera system are sealed and stored in cable protectors.

6.4. Camera circuit D - Buses of the Company

6.4.1. cameras are placed in such buses of the Company which are marked with the pictogram of an industrial camera according to Article 5.6 of this Policy.

6.4.2 The camera system consists of five IP cameras in each bus, which occupy the interior of the bus.

6.4.3 The recording is continuous and the storage period of the camera recording is three calendar days.

6.4.4. The camera recording is made for the purpose specified in Article 3.2 of these Principles.

6.4.5 The recording devices of the CCTV camera system circuit D are located in individual buses in a place inaccessible to the public.

6.4.6. Only a responsible person designated by the Company shall have access to the recording equipment of the CCTV camera system circuit D.

6.5. Camera circuit E - Wearable cameras of inspectors

6.5.1 The camera circuit consists of portable cameras recording video and sound, which are placed on the clothing of the Company's auditors.

6.5.2. The camera system consists of one portable camera for each auditor of the Company.

6.5.3 The recording shall be continuous for the duration of and in connection with the transport control and the storage period of the camera recording shall be thirty calendar days.

6.5.4. camera footage is taken for the purpose specified in Article 3.2 of this Policy during and in connection with the performance of transport control.

6.5.5. The recording devices of the CCTV camera circuit E of the CCTV system are part of portable cameras and are encrypted.

6.5.6. Only a responsible person designated by the Company shall have access to the records from the CCTV camera circuit E.

7. Information obligation towards persons recorded by the CCTV system

7.1 In accordance with Article 14 of the EU Regulation, the Company hereby provides the following information to all entities (employees and third parties):

7.1.1. Identity and contact details of the data controller:

The data controller is the Company.

Contact person and at the same time Data Protection Officer - GDPR Hradec s.r.o., with registered office at Fráni Šrámka 1139, 500 02 Hradec Králové, ID: 06708218, contact person: Mgr. Martin Jeřábek, e-mail: info@gdprhradec.cz, tel: +420 495 510 765.

7.1.2. Purposes of processing and legal basis for processing:

1. 1. 1. ensuring the inspection of selected premises in order to help protect the Company's property (ownership right) from damage or theft, processing of the personal data obtained for the purpose of reporting possible crimes to the competent authority and handing over the seized evidence to it[3].
    2. ensuring the inspection of selected premises in order to contribute to the protection of property (ownership), life and health of the Company's employees, the processing of the personal data obtained for the purpose of reporting possible crimes to the competent authority and handing over the seized evidence.
    3. ensuring the inspection of selected premises in order to contribute to the protection of property (property rights), life and health of persons moving in the Company's premises and premises operated by the Company, processing of personal data obtained for the purpose of reporting possible crimes to the competent authority and handing over the seized evidence.

The legal basis for processing is the legal the title referred to in Article 6(1)(f) of the EU Regulation, i.e. the legitimate interest of the data controller.

The legitimate interest lies in ensuring the safety and health protection of employees and other persons on the Company's premises and in ensuring the protection of the Company's property rights. The legitimate interest has been assessed in detail by the Company in terms of fulfilling the conditions for its application.[4]

7.1.3. Categories of data subjects concerned:

- - - Employees of the Company
    - Business partners, customers (visitors) of the Company - including passengers of public transport and long-distance transport

7.1.4. Recipients of personal data:

Law enforcement authorities, provided that the legal conditions for the transfer of processed personal data to that authority are met.

7.1.5. Period of processing of personal data:

3 to 5 calendar days from the date of the recording - see Article 6 of this Policy for further specifications; the exception is in cases where an incident recorded by the CCTV system has occurred - in such a case, the recording will be retained for the time necessary to investigate the incident.

7.1.6. Source of personal data:

The Company's camera system - see Article 6 of this Policy for further specifications.

7.1.7. Rights of natural persons:

1. The right to Access to personal data

An individual has the right to access all personal data processed. Upon request, the Company will provide a copy of the personal data processed in a machine-readable format (however, given the very short retention period of records, it will not be possible to comply with this request if the Company has already deleted the record).

2. The right to Correction personal data

The right to rectification is not applicable to the processing of CCTV footage, as the subject of the personal data processing in question is only the acquisition of CCTV footage of a natural person.

3. The right to deletion personal data

An individual has the right to have the CCTV footage capturing his/her image processed by the Company unlawfully deleted.

4. The right to limitations processing of personal data

An individual has the right to block his or her personal data under the conditions set out in Article 18 of the EU Regulation (in particular, if an objection is raised, if there is a dispute about the lawfulness of the processing).

5. Right to file objection

An individual has the right to object to the processing of personal data on the grounds of legitimate interest (which is the case with CCTV footage).

6. The right to filing a complaint

An individual has the right to contact the Company at any time with his/her complaint, or to file a complaint with the Office for Personal Data Protection, address: headquarters Pplk. Sochor 27, 170 00 Prague 7 or to seek judicial protection.

8. METHOD OF EXERCISING RIGHTS

8.1 To exercise your rights, please contact the Company:

Data Protection Officer - Company GDPR Hradec s.r.o., with registered office at Fráni Šrámka 1139, 500 02 Hradec Králové, ID: 06708218, contact person: Mgr. Martin Jeřábek, e-mail: info@gdprhradec.cz, tel: +420 495 510 765.

8.2. On the website http://www.dpmhk.cz/ there are model forms for exercising the rights of applicants under point 7.1 of the Principles.

8.3 The Company shall inform the applicant free of charge of the measures taken without undue delay and in any case within one month of receipt of the request. This time limit may be extended by a further two months if necessary and in view of the complexity and number of requests. Should the Company not comply with the request, the applicant shall be informed without delay (within one month at the latest) of the reasons for non-compliance.

In some cases, as defined by legislation, the Company is not obliged to grant the request in whole or in part. This will be the case in particular if the request is manifestly unfounded or unreasonable, especially because it is repetitive. In such cases, the Company may:

(i) impose a reasonable fee taking into account administrative costs; or

(ii) refuse to grant the request.

If the Company receives a request but has reasonable doubt as to the identity of the sender of the request, it may request additional information necessary to confirm the identity of the requestor.

This document will be updated periodically as the need arises to update it. Updated version of the Personal Data Protection Policy (hereinafter referred to as „Principles“) is effective upon publication on the website www.dpmhk.cz.

1. THE CONTROLLER OF YOUR DATA

The controller of your personal data is:

Contact person and at the same time Data Protection Officer: company GDPR Hradec s.r.o., registered office: 1139 Fráni Šrámka, 500 02 Hradec Králové, ID: 06708218, contact person: Mgr. Jitka Moníková, e-mail: info@gdprhradec.cz, tel: +420 495 510 765.

The controller collects and holds your data and is responsible for its proper and lawful processing. You may exercise your rights against the controller as set out below.

2. DATA PROCESSED, THEIR PURPOSE AND REASON

We only process such data in order to provide you with a quality driving school service. We process your personal data in the following ways and for the following purposes:

2.1. Acceptance for teaching and training and implementation of training

2.1.1. BASIC (COMPULSORY) the data we process about you for the purposes of the Application for Admission to Teaching and Training includes data that you provide to us in any of the following ways:

- - by completing the Application for Admission to Teaching and Training

Specifically, we process the following types of personal data of the applicant:

- - - driving licence number,
    - name, surname and title,
    - date and place of birth,
    - birth number,
    - citizenship,
    - proof of identity,
    - phone,
    - residential address,
    - signature of the applicant,
    - signature of the legal representative (if the applicant is not legally competent).

This information is included in every Application for Admission to Teaching and Training and is required by the authorities for the purposes of obtaining a driving licence.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.1.2. In the course of providing driving school services, i.e. during the teaching and training of applicants for driving licences, the following are also processed OPERATIONAL DATA:

- - - name and surname,
    - date of birth,
    - Address,
    - phone.

This information is entered in the class register of the instruction and training of applicants for a driving licence and is required by the administrative authorities for the purposes of obtaining a driving licence.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.2. Training for a professional licence

2.2.1. BASIC (COMPULSORY) the data we process about you for the purposes of the Application for Initial Training for a Professional Licence and the Application for the Professional Competence Examination are those that you provide to us in one of the following ways:

- - - completing the Application for Initial Training for a Professional Licence
    - by completing the Application for Professional Competence Examination

Specifically, we process the following types of personal data of the applicant:

- - - driving licence number,
    - name, surname and title,
    - date and place of birth,
    - birth number,
    - addresses of residence,
    - citizenship,
    - proof of identity,
    - phone,
    - signature of the applicant.

This information is included in each Application for Initial Training for a Professional Licence and Application for a Professional Competence Examination and is required by the administrative authorities for the purpose of obtaining a professional authorisation (licence).

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.2.2. In the course of providing driving school services, i.e. during the teaching and training of applicants for a professional licence, the following are also processed OPERATIONAL DATA:

- - - name and surname,
    - date of birth,
    - Address,
    - phone.

These data are entered in the class register of the instruction and training of applicants for a driving licence and are required by the administrative authorities for the purposes of obtaining a professional licence.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.3. Professional driver training

2.3.1. BASIC (COMPULSORY) the data we process about you for the purposes of training drivers who hold a driving licence and a professional licence includes the following personal data:

- - - name and surname,
    - date of birth,
    - ID number,
    - Address,
    - Signature.

This information is part of the training requirement for professional drivers and is required by the authorities.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.3.2. In the course of providing driving school services, i.e. during the teaching and training of applicants for driving licences, the following are also processed OPERATIONAL DATA:

- - - name and surname,
    - date of birth,
    - Address,
    - phone.

This information is included in the class book of the instruction and training of applicants for a driving licence and is required by the administrative authorities.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.4. Performance of the contract in the provision of driving school services - processing of other personal data

2.4.1. Data from peer-to-peer communication

We also process data about our mutual communication related to the provision of driving school services, such as when dealing with your comments or when dealing with claims, etc. In the course of these communications, we process the following personal data that you provide to us:

- - - name and surname,
    - address of the complainant,
    - contact details (e-mail or telephone).

The reason (legal basis) why we process the data:

- when dealing with complaints and claims, these are actions related to the performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation);

2.4.2. Accounting and tax

The reason (legal basis) why we process the data:

- compliance with legal obligations (we use this reason in accordance with Article 6(1)(c) of the EU Regulation).

2.4.3. Exercise (or defence) of rights

The reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6(1)(f) of the EU Regulation).

3. HOW LONG DO WE KEEP YOUR DATA?

We process personal data for the minimum period for which we are obliged to process personal data.

Personal data of applicants/drivers (see Articles 2.1 to 2.3 of this Policy) are processed in our electronic database (and some documents, such as the class register and complaints, also in paper form) for the duration of the contractual relationship that is the basis for the processing of this personal data.

Tax documents will be deleted within 1 month after the expiry of 5 years from the execution of the monetary transaction, unless a longer period is required by law in a specific case.

Should a dispute arise between DP and you, we will need your personal data to defend our legal claims in connection with the dispute until the end of the dispute.

4. SOURCES OF PERSONAL DATA

We only process personal data that we have received from you or obtained in communication with you. We do not seek or process personal data about you from public sources.

5. RECIPIENTS OF PERSONAL DATA

As a matter of principle, we manage your personal data within the DP and do not pass it on to third parties unless it is strictly necessary to do so, which is the case when passing on personal data to the Hradec Králové City Council in the course of its public administration.

Certain state administration authorities are entitled to request information about you on an ad hoc basis in order to fulfil their legal obligations (e.g. the Police of the Czech Republic, financial control authorities, SAO). We only provide data if the authority to request such data is required by law.

6. WHAT RIGHTS DO YOU HAVE?

Right of access to personal data

You have the right to access all personal data processed. Upon your request, we will provide a copy of the personal data processed in a machine-readable format.

Right to rectification of personal data

Right to erasure of personal data

You have the right to erasure of your personal data that we have processed unlawfully.

Right to restriction of processing of personal data

Right to portability of personal data

Right to withdraw consent

If you have given us your consent to the processing of your personal data for specified purposes, you have the right to withdraw this consent at any time.

The right not to be subject to automated decision-making

Right to object

You have the right to object if the processing is based on our legitimate interest (defence of legal claims).

Right to lodge a complaint

Method of exercising rights

In order to exercise your rights listed above, please contact our Data Protection Officer - see point 1. of this Policy or you can exercise these rights in person when you visit DP. To exercise your rights, you can use our forms located at www. dpmhk.cz in the Personal Data Protection section - here you will find for each right a more detailed explanation of the conditions for exercising the right.

In some cases, as defined by the legislation, we are not obliged to grant the request in whole or in part. This will be the case in particular if the request is manifestly unfounded or unreasonable, especially because it is repetitive. In such cases, we may: (i) impose a reasonable fee taking into account the administrative costs; or (ii) refuse to comply with the request.

If we receive a request but have reasonable doubt about the identity of the sender of the request, we may ask you to provide additional information necessary to confirm your identity.

This document provides you with information on how the company Hradec Králové City Transport Company, a.s. (hereinafter referred to as „DP“) obtains and processes your personal data in connection with the provision of SMS ticket service, in the implementation of transport control, in the provision of contractual tour transport, in the announcement and organisation of public tenders, in the sending of newsletters, in the recording of losses and finds and in its other normal business activities .

When processing personal data, we are governed by legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the „EU Regulation“), which comes into force on 25 May 2018.

1. THE CONTROLLER OF YOUR DATA

The controller of your personal data is:

Contact person and at the same time Data Protection Officer: company GDPR Hradec s.r.o., registered office: 1139 Fráni Šrámka, 500 02 Hradec Králové, ID: 06708218, contact person: Mgr. Martin Jeřábek, e-mail: info@gdprhradec.cz, tel: +420 495 510 765.

The controller collects and holds your data and is responsible for its proper and lawful processing. You may exercise your rights against the controller as set out below.

2. DATA PROCESSED, THEIR PURPOSE AND REASON

We process your personal data in the following ways and for the following purposes:

2.1. Provision of the Mobile Ticket Service (SMS)

2.1.1. If you want to use the Mobile Ticket SMS service, we process information about your telephone number, as it is not possible to use the Mobile Ticket service without a telephone.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.1.2. As this service is technically provided by MATERNA Communications a.s., the telephone numbers from which mobile tickets were purchased are processed by this company, including the history of mobile tickets purchased. However, the company does not have any personal data about your identity other than the telephone number. The data on mobile tickets purchased is processed for a period of 3 months in case you make a claim and we can trace back the information necessary to verify the reason why the SMS ticket was not delivered to you. After this period, the data is only kept for archiving purposes for tax regulations and for the period required by applicable legislation.

2.1.3. If you make a complaint about the Mobile Ticket service, we will keep a record of and require personal data about you in order to be able to settle the complaint until the complaint is settled and then for a period of three years in case of a possible dispute and the possibility of our subsequent defence:

- - - name and surname
    - the phone number from which the disputed SMS was sent and the time of sending
    - e-mail
    - contact telephone number
    - the outcome of the complaint procedure and communication with you.

The reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6(1)(f) of the EU Regulation).

2.2. Transport control

2.2.1. If the auditor finds that there has been a violation of the conditions of carriage, the auditor shall draw up a Transport Inspection Record containing the following personal data:

- - - name and surname of the passenger
    - date of birth
    - delivery address
    - proof of identity (e.g. ISIC, ID card number)
    - details of the journey being checked (line, date, time, direction of travel)
    - the passenger's signature.

Subsequently, these data are recorded in the electronic system DP - Transport Control by means of the document Report of violation of contractual transport conditions.

The reason (legal basis) why we process the data:

- compliance with legal obligations - Specifically, pursuant to Section 18a of Act No. 111/1994 Coll., on Road Transport and Act No. 266/1994 Coll., on Railways (we use this reason in accordance with Article 6(1)(c) of the EU Regulation).

2.2.2.2. If the amount due is not paid, the above-mentioned data is forwarded to the contracted law firm for the purpose of subsequent collection of the debt or the debt is transferred to a third party. We do not pass on debtor data to any public debtor registers.

The reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6(1)(f) of the EU Regulation).

2.2.3. If, as a result of a transport check, the amount due is subsequently paid before being passed on to a third party for recovery, the personal data collected for these purposes are anonymised in electronic form within 2 months and shredded in paper form within the same period.

2.3. Contract tour transport

2.3.1. If you wish to use the services of the contractual tour transport, we process the following personal data about you, which you provide to us by filling in the online form at www.dpmhk.cz „Tour transport order“:

- - - name and surname of the client
    - VAT number in the case of a natural person
    - residential address
    - name and surname of the contact person
    - contact person's phone and e-mail (order confirmation is sent to the e-mail)
    - details of the requested transport (date, destination, etc.).

Confirmation of the order leads to the conclusion of the Contract for the provision of tour transportation. This information is an essential part of any Contract for the provision of tour transport and without it we would not be able to provide you with tour transport.

The reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.3.1. We also process data about our possible mutual communication related to the organisation and provision of the tour transport, such as when dealing with your comments or claims, etc. In this communication we process the following personal data that you provide to us:

- - - name and surname
    - address of the complainant
    - contact details (e-mail or telephone)
    - the reason and method of resolving the complaint.

The reason (legal basis) why we process the data:

- when dealing with complaints and claims, these are actions related to the performance of the concluded contract (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.4. Public procurement and administration

2.4.1. If we are legally obliged to announce a public contract in accordance with Act No. 134/2016 Coll., on public procurement or according to internal rules (small-scale contract), we process data on the participants in the public contract and data provided in the bids of these participants, as a rule:

- - - details from the CVs provided by members of the tenderer's implementation team (if this type of qualification is required),
    - evidence of the education and qualifications of the members of the implementation team (if this type of qualification is required).

2.4.2 We are obliged to archive this personal data in accordance with the statutory requirement for a period of 10 years from the end of the procurement procedure.

The reason (legal basis) why we process the data:

- compliance with legal obligations - 134/2016 Coll., on public procurement (we use this reason in accordance with Article 6(1)(c) of the EU Regulation).

2.5. Sending the newsletter

Communication on the basis of so-called legitimate interest without your consent

If you have used our services and have not expressed your disagreement with the sending of newsletters, we are entitled, in accordance with Article 6(1)(f) of the EU Regulation (i.e. the legitimate interest of our company consisting in the possibility of using direct marketing) and in accordance with Section 7(3) of Act No. 480/2004 Coll., on certain information society services, to send youwithout your prior consent to the email you provided commercial communications relating to our own identical or similar services. By commercial message we mean newsletter only containing news about changes in public transport, timetable changes or general information about changes in public transport operations; other types of marketing activities are not used by the Company .

However, we will not send these commercial communications to you at all if you have already indicated at the time of entering into the contractual relationship (participation in the event) that you do not want to receive them. We will also not send you these communications if you have not used the services offered by our Company for more than 5 years.

You will also have the option to opt-out of receiving these newsletters again within each email you receive, where we will always explicitly notify you of this fact. At the same time, you will have a clear and distinct possibility to simply and free of charge refuse the further sending of these offers (any form of reply to the sent e-mail, e.g. in the form of the text „DO NOT SEND“ is sufficient).

Furthermore, we expressly draw your attention to your right to raise the so-called. LINK against the processing of your personal data on the grounds of the so-called legitimate interest of our Company in accordance with Article 21 of the EU Regulation. If you raise this objection to the processing of your personal data for direct marketing purposes (i.e. sending marketing communications without your consent) (you can use the prepared Forms ), this is also the reason why we will no longer send you the newsletter.

Consent-based communication

If the conditions for sending the newsletter without your consent are not met (but you have subscribed to the newsletter via the web form), we will only be able to send you the newsletter and process your e-mail address for this purpose with your prior consent. The text of the consent to receive the newsletter, as well as the other conditions related to the consent given, is available at HERE.

We will start processing personal data (e-mail) only after you fill in your e-mail address for sending the newsletter in the relevant web form, agree to the processing of this personal data and then activate and confirm the newsletter subscription according to the instructions contained in the received e-mail message. If the newsletter subscription is not confirmed in accordance with the instructions contained in the received email message within 14 days, the entered email will be deleted without undue delay.

Giving consent is VOLUNTARY and you can withdraw your consent at any time. Withdrawal of consent is only effective for the future and its withdrawal does not affect the lawfulness of previous processing of personal data based on the consent given.

If you do not give us your consent, the only consequence is that you will not be sent information about the newsletter. This has no effect on the quality of the services provided by the Company.

The legal basis for sending the newsletter in this case is therefore your consent in accordance with Article 6(1)(a) of the EU Regulation.

2.6. Form „Non-binding request for advertising services“

If you take the opportunity to contact us via the web contact form „Non-binding request for advertising services“, we will obtain the following data:

- - name and surname
  - e-mail.

We will only use this personal data for the purpose of processing your request/request and will delete it no later than 2 months afterwards (unless we have another legal reason for keeping it).

The reason (legal basis) for this processing is usually:

- handling of your request as a communication related to the inquiry of the service offered by us (we use this reason in accordance with Article 6(1)(b) of the EU Regulation).

2.7. Records of losses and finds

If you apply for the return of a lost item or for the return of an item from a safe deposit box if you lose the key to the box, we will record the following personal data about you:

- - Name and surname
  - Telephone number
  - Residence
  - Identity document number

These personal data are recorded in order to prove to which person the found items were handed over, in accordance with Act No. 89/2012 Coll., the Civil Code and in accordance with the Contractual Conditions of Carriage issued by DP in accordance with Decree No. 175/2000 Coll., on the Transport Regulations for Public Rail and Road Passenger Transport.

The reason (legal basis) for this processing is:

- performance of a legal obligation (we use this reason in accordance with Article 6(1)(c) of the EU Regulation).

2.8. Accounting and tax

The reason (legal basis) why we process the data:

- compliance with legal obligations (we use this reason in accordance with Article 6(1)(c) of the EU Regulation).

2.9. Conclusion and performance of customer-supplier relationships

For the proper functioning of our Company, we need to enter into such customer-supplier relationships that are related to our business activities (e.g. fuel supply contracts, lease agreements, contracts for the provision of various types of services, contracts for the supply of parts for fleet repairs, contracts with tax advisors, legal advisors, etc.). For these purposes, we process only a minimum amount of personal data (if provided to us, identification and contact data such as name and surname, residence, e-mail or telephone number, or VAT number of the natural person) that is directly related to the concluded contractual relationship and its performance. In this context, we only store personal data for the duration of the contractual relationship (or for the fulfilment of legal obligations arising in particular from tax or accounting legislation).

The reason (legal basis) for this processing is:

- performance of the concluded contract (in accordance with Article 6(1)(b) of the EU Regulation).

2.10. Exercise (or defence) of rights

Should a dispute arise between DP and you, we will process your personal data necessary to defend our legal claims in connection with the dispute until the dispute is concluded. As a rule, we process basic identification data, data on payments made, data from the complaint procedure, data from mutual communications, data on legal actions taken and the results of such actions.

The reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6(1)(f) of the EU Regulation).

3. HOW LONG DO WE KEEP YOUR DATA?

We process personal data for the minimum period for which we are obliged to process personal data. Specifically, in relation to the activities defined above (see point 2. of the Policy), these periods are as follows:

Mobile ticket SMS	Phone number and history of SMS ticket orders	3 months
Mobile ticket SMS	Personal data related to the Mobile Ticket Service (SMS) complaint	3 years from the end of the complaint procedure
Transport control	Personal data obtained by the inspector during the transport inspection - the amount due is paid after the transport inspection	Deletion/anonymisation of personal data within 2 months of payment in paper and electronic form
Transport control	Personal data obtained by the inspector during the transport inspection - the amount due is not paid after the transport inspection and is forwarded for recovery	Retained until the decision terminating the recovery proceedings/termination of the execution order becomes final
Contract tour transport	Personal data obtained in the course of providing the service, in particular on contractual documents	3 years after completion of transport (exception: accounting documents)
Public procurement and organisation	Public contracts under the Public Procurement Act	10 years from the end of the procurement procedure
Public procurement and organisation	Small-scale public contracts	10 years from the end of the contract
Sending news by e-mail	In the event of a legitimate interest being asserted	For as long as the legitimate interest lasts
Sending news by e-mail	If consent is granted	For the period of validity of the consent - 5 years /until revoked
Non-binding request for advertising services	Personal data provided in the web form	2 months after the request is processed
Xxx	Accounting and tax	As a rule, 5 years from the date of the taxable supply, unless in some cases a longer period is required by legislation
Xxx	Customer - supplier relations	For the duration of the contractual relationship and any period for exercising the right to claim for defects in the performance provided
Xxx	Defending legal claims	Until the dispute is resolved and one year after

4. SOURCES OF PERSONAL DATA

We only process personal data that we have received from you or obtained in communication with you. We do not seek or process personal data about you from public sources.

5. RECIPIENTS OF PERSONAL DATA

As a matter of principle, we manage your personal data within DP and do not pass it on to third parties unless it is strictly necessary.

Such a need may arise in the case of external suppliers/service providers such as:

- provider of the Mobile Ticket Service (SMS)

- legal service providers (in the case of recovery of outstanding claims arising from transport inspections)

- public procurement administrators

- auditors (audit of accounting documents).

Certain state administration authorities are entitled to request information about you on an ad hoc basis in order to fulfil their legal obligations (e.g. the Police of the Czech Republic, financial control authorities, the SAO, public procurement supervisory authorities). We only provide data if the authority to request such data is imposed by law.

6. WHAT RIGHTS DO YOU HAVE?

Right of access to personal data

You have the right to access all personal data processed. Upon your request, we will provide a copy of the personal data processed in a machine-readable format.

Right to rectification of personal data

Right to erasure of personal data

You have the right to erasure of your personal data that we have processed unlawfully.

Right to restriction of processing of personal data

Right to portability of personal data

Right to withdraw consent

If you have given us your consent to the processing of your personal data for specified purposes, you have the right to withdraw this consent at any time.

The right not to be subject to automated decision-making

Right to object

You have the right to object if the processing is based on our legitimate interest.

Right to lodge a complaint

Method of exercising rights

(i) impose a reasonable fee taking into account administrative costs; or

(ii) refuse to grant the request.

If we receive a request but have reasonable doubt about the identity of the sender of the request, we may ask you to provide additional information necessary to confirm your identity.

This document provides you with information about how Dopravní podnik města Hradce Králové, a.s. uses cookies and other information related to your visit to the website: www.dpmhk.cz .

Information about your computer

Each time you visit our website, we collect information regarding the error log (including the time the error was logged, its description and the IP address displayed). This data is automatically deleted after one month.

We use this data for the operation of the website, in particular to detect and eliminate errors, to determine the use of the website and to modify or further improve the website, and in this respect is necessary for the proper functioning of the website.

Use of cookies

Like many other websites, our website uses cookies. Cookies are small text files that are stored on your computer and store certain settings and data through your browser. Each cookie typically contains the name of the domain from which the cookie was sent, the name of the cookie, the cookie value and cookie expiration information.

Cookies allow your computer to be recognised and to access certain default settings. Cookies help us to improve the website and offer you a better service.

Some cookies (so-called functional cookies) must be stored on your computer as they are essential for the basic operation and functionality of our website. They also help with security and compliance with legal requirements. Cookies store information about the fact that you have clicked on the „cookies“ bar at the bottom of the website, so that you do not see it next time.

For other types of cookies we need your consent, which you can give in the banner at the bottom of the website. These are the following cookies that we use:

What cookies we use

analytics that help us improve the user experience of our website by understanding how users use it
essential, which are important for the basic functionality of the website

Some cookies may collect information that is subsequently used by third parties to, for example, track user behaviour on the website. This allows us to determine which pages of our website are cluttered or what users need most often. All data is anonymised so that specific users cannot be identified from the data.

Publisher/ Cookie name	Type	Durability
Google Analytics	Analytical
(_ga, cid, utmv, utmz, utma, utmb, utmc)		6 months

Google Analytics

We use Google Analytics for statistical analysis. Google Analytics is a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94034, USA („Google“). Google Analytics uses cookies and programs that are part of the websites and collects non-personal data on our behalf concerning visitors to our websites. The cookies and embedded programs only provide us with non-personal statistical information about visits to our websites, the duration of each page view, the paths taken by users through the websites, information about visitors' screen settings and other general data. We use this type of information, which is primarily statistical in nature, to improve the service we provide to our customers.

The information about your use of the website (including your IP address) generated by Google using cookies will be transmitted to and stored by Google on servers in the United States. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators and to provide other services relating to website activity and internet usage.

Google may also transfer this anonymised information to third parties where required to do so by law or where such third parties process the information on Google's behalf. Google will not associate your IP address with other data held by Google.

Links to Facebook and Youtube

If there are links to Facebook or YouTube on our website, these links are not plugins. By opening these links, you will be redirected to the external pages of these providers without any connection to the display of our website. The information that you are currently viewing our website will not be transmitted to these servers.

Mapy.cz Plugin

The Mapy.cz plugin is integrated on our website. If you open a web page containing this plugin in our internet menu, a direct link to the Mapy.cz server is created and the icon of the plugin that you see and the related functions are transferred directly to your browser, which is linked to the view of our website. The information that you are currently viewing our website will be transmitted to this server.

Please note that the content and scope of the data collected directly via the Mapy.cz plugin and the purpose of use are determined solely by the provider of this server. For more information, please refer to the privacy policy of this provider.

For a complete and up-to-date overview of every third-party access to your web browser, you can install a plugin for this purpose (if one is created for your browser type). You can also choose to have your computer warn you every time a cookie is sent, or you can disable all cookies - this can be done in your browser settings. Every browser is a little different, so please check your browser's Help menu to find out how to set your cookies correctly. However, if you disable the storage of cookies completely, it is possible that some of the services we provide may not work or may not work properly.

Hradec Králové City Transport Company, a.s.

with registered office at 500 03 Hradec Králové, Pouchovská 153/52, Věkoše

ID: 25267213

Represented by: p. Bc. Zdeněk Abraham, Chairman of the Board of Directors

entry in the Commercial Register - file. No.: B 1625 registered with the KS in Hradec Králové

In accordance with Article 37(7) of the GDPR, it announces that it has appointed a Data Protection Officer, which is the company:

GDPR Hradec s.r.o.

with registered office at Fráni Šrámka 1139, 500 02 Hradec Králové

ID: 06708218

represented by: executive director JUDr. Petr Moník, LL.M

contact person: Mgr. Martin Jeřábek, tel.: +420 495 510 765,

e-mail: info@gdprhradec.cz.