Processing of personal data
Processing of personal data
The purpose of this document is to provide you, in accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as "GDPR") and in the sense of other relevant legislation (Act No. 110/2019 Coll., on the processing of personal data), information on the conditions under which the processing of personal data provided by you will be carried out within the framework of the lifelong learning course offered by Charles University.
PERSONAL DATA CONTROLLER
The controller of personal data is Charles University, Ovocný trh 560/5, 116 36 Prague 1, ID: 00216208, VAT: CZ00216208, mailbox ID: piyj9b4 (hereinafter referred to as the "Controller").
The Administrator is a public university pursuant to Act No. 111/1998 Coll., on Universities, as amended. Within the scope of its mission, the Administrator freely and independently carries out education and, in connection therewith, scientific, research, development, innovation, artistic or other creative activities and related activities.
CATEGORIES OF PROCESSING OF PERSONAL DATA
The Controller processes both your personal data provided directly by you (whether on the basis of consent or other legal grounds) and other personal data generated in the context of processing activities and necessary for their provision. This may include the following categories of personal data:
- Address and identification data: name, surname, email, date and place of birth, telephone, birth number, nationality, address, signature, etc.;
- descriptive data: education, knowledge of foreign languages, professional qualifications, knowledge and skills;
- any other information fulfilling the definition of personal data arising in connection with the implementation and administration of lifelong learning (e.g. information on participation in learning activities, information on the results of learning activities);
- your image and voice (photograph or audiovisual recording).
The Controller declares that he/she has obtained or will obtain your personal data to the extent described above from you as a data subject, or in the course of the implementation of lifelong learning courses/programmes (hereinafter referred to as "LLP").
The personal data referred to in points 1) - 3) is obtained by the Administrator on the basis of your application or registration in the CŽV portal of FTVS UK. The personal data referred to in point 4) is obtained by the Controller through your written consent.
LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
The Administrator processes your personal data for the purpose of fulfilling its legal and contractual obligations to which you are a party as a participant or prospective participant in a CŽV course or for the performance of actions taken prior to the conclusion of a contract at your request, specifically because of your interest in participating in a CŽV course, which allows the Administrator to process your personal data for the purpose of concluding a contract at your request.
Furthermore, the Administrator processes your personal data for the fulfilment of the legal obligations that apply to it with reference to Sections 60 and 60a of Act No. 111/1998 Coll., on Higher Education (administration of the CŽV, registration of the results of the CŽV and issuance of the certificate of completion of the CŽV, or its second copies) and with reference to Section 3 of Decree No. 277/2016 Coll, on the transmission of statistical data by universities (hereinafter referred to as the "Decree"), whereby the Administrator is obliged to transmit, on the basis of this Decree, the specified personal expenses of each participant and each graduate of a vocationally oriented lifelong learning programme or a programme eligible for further study in accredited study programmes, the total hourly subsidy of which is at least 50 hours, to the Ministry of Education, Youth and Sports (hereinafter referred to as the "MoEYS").
In some cases, the Administrator may only obtain and process your personal data with your explicit and free consent. You may withdraw your consent at any time using the contact details set out in this Policy. The specific terms and conditions for the use of your personal data after consent is given are always set out in each individual consent.
PURPOSE OF PROCESSING
The controller processes your personal data for the following purposes:
- administration related to your participation in the CŽV course, including the recording of results and the issuance of certificates or copies thereof,
- the conclusion of a contract for participation in a CŽV course and the performance of such an obligation based on this contract, or the exercise of rights arising from such an obligation,
- the transmission of data on the participant to the Ministry of Education and Science, if this obligation arises from the Decree.
The processing of your personal data will not involve automated decision-making or profiling pursuant to Article 22 of the GDPR.
TRANSFER OF PERSONAL DATA
The Controller declares that access to your personal data will only be granted to competent employees of the Controller who are entrusted with tasks related to the purpose of processing your personal data. However, your personal data may be transferred to the operator of the Controller's website. Any further information about the processors will be provided to you upon request.
In some isolated cases, your personal data may be disclosed to a minimal extent (e.g. name) to individual specific contractors and specialised suppliers of the CŽV course (e.g. instructor, possibly cooperating state bodies, sports associations). Your personal data is transferred to such persons to the minimum extent necessary for the implementation of the CŽV course. Furthermore, the Controller may transfer your personal data for the purpose of fulfilling its legal obligations. The Controller may transfer selected data to designated entities (such as public authorities).
Except for the above, the Controller does not provide your personal data to third parties (recipients).
RETENTION PERIOD OF PERSONAL DATA
Your personal data shall only be stored for the period of time strictly necessary in relation to the personal data processing activity in question and shall then be destroyed or archived in accordance with the Controller's applicable filing system, but for a maximum period of 30 years. Personal data that we process with your consent is only retained for the duration of the purpose for which the consent was given or until the time specified in each individual consent.
WHAT ARE YOUR RIGHTS IN RELATION TO PROCESSING
PERSONAL DATA?
As a data subject, you have in particular:
- The right of access to personal data, on the basis of this right, upon your request the Data Controller will provide you with information on what personal data it processes, for what purpose, from what source the personal data was obtained, to whom your data was provided and the intended period for which it will be stored;
- the right to rectification, which means that you can request that the Controller erase the personal data concerning you without undue delay, as well as the right to have incomplete personal data completed;
- the right to erasure, you can also ask the Controller to erase or completely anonymise your personal data for which there is no longer any other reason to continue processing such data. You also have the right to have your personal data erased by the Controller without undue delay if you withdraw your consent. However, the Controller may only comply with your request if it is no longer actually required to process the personal data or if the processing is not based on a legal obligation of the Controller. Thus, the Controller cannot delete personal data, for example, if the statutory archiving period for certain documents expires, etc. However, the Controller will of course explain this to you in response to your request. In the GDPR you will find this right under Article 17;
- the right to restrict the processing of your personal data, at your request the Controller will restrict the processing of your personal data about which there is a problem or dispute - e.g. whether the personal data is accurate, whether the processing is unlawful, etc. During the period of restriction of processing, your personal data may only be stored and may otherwise only be processed on the basis of your consent, for the establishment, exercise or defence of legal claims or for reasons of public interest. This right is enshrined in Article 18 GDPR;
- the right to data portability, if your personal data is processed by the Controller in electronic form, you may request the Controller to transfer it to another controller. If possible in a particular case, the Controller will transfer your personal data on the basis of your request;
- the right not to be subject to any decision based solely on automated processing;
- the right to withdraw consent for processing of personal data based on your consent;
- the right to lodge a complaint with the supervisory authority, which is the Data Protection Authority, see contact details below.
HOW CAN YOU EXERCISE YOUR RIGHTS?
THE DATA CONTROLLER
The data subject is entitled to exercise their rights under the GDPR. The data subject shall exercise his/her rights vis-à-vis the Data Controller by sending a request to the Data Controller's mailbox: piyj9b4 or by e-mail: vnejsivztahy@ftvs.cuni.cz or in writing to the address: the Faculty of Physical Education and Sport of Charles University, with its registered office at José Martího 269/31, 162 52 Prague 6 or in person at the above address in the office at door no.
HOW TO PROCEED IF YOU BELIEVE THAT THE PROCESSING OF YOUR PERSONAL DATA HAS VIOLATED THE LAW OR THE GDPR?
In this case, you have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection:
Data Protection Authority
Pplk. Sochora 27
170 00 Prague 7
tel. +420 234 665 111
e-mail:posta@uoou.cz
Website: https://www.uoou.cz.
Further information about the processing of your personal data can be found on the Administrator's website.