Personal data protection at the College of Polytechnics Jihlava

The College of Polytechnics Jihlava proceeds in the processing of personal data in accordance with the following legal regulations:

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
• Law No. 110/2019 Coll., on the processing of personal data
• Act No. 111/1998 Coll., on Universities, as amended
• Privacy Directive (SR No. 2/2019)

Personal Data Protection Policy

The personal data controller is College of Polytechnics Jihlava, Tolstého 16, 586 01 Jihlava, phone: +420 567 141 111, fax: +420 567 300 727, email: vspj@vspj.cz, ID: 71226401, VAT: CZ71226401, mailbox ID: w9ej9jg

A personal data controller under the GDPR is an entity that determines, alone or jointly with others, the purposes and means of the processing of personal data, or is determined by a regulation, which is usual in the case of the VŠPJ.

Purposes of the processing of personal data

The Registrar has designated and processes personal data for various purposes, a list of which can be found here - http://oou.cloud/katalog/sady?u_id=281

Each purpose specifies the scope of the personal data processed, the means of processing personal data, the duration of storage of personal data, the legal basis for processing personal data, the sources of personal data, whether the data is processed through a processor and other information about the processing of personal data that the controller publishes to inform data subjects and to fulfil the principle of transparency.

Data subject rights

The data subject has the following rights in relation to the protection of personal data vis-à-vis the controller:

Right to information about the processing of personal data

This right serves to obtain information concerning the processing of personal data for each specific purpose. This information is available categorised according to each purpose of processing here -  http://oou.cloud/katalog/sady?u_id=281. Here you can find out all the information about the processing of personal data for each specific purpose.

Right of access to personal data

This right entitles the data subject, upon request, to obtain information from the controller as to whether the controller processes his or her personal data and, if so, to what extent. At the same time, the data subject has the right to request a copy of the personal data processed.

Right to rectification

Allows the data subject to request that the controller amend any of the data processed if there has been a change in the data subject (e.g. change of residence, telephone, surname in the case of marriage or divorce).

Right to erasure ("right to be forgotten")

The data subject has the right to have the controller erase the personal data relating to the data subject and the controller is obliged to erase the personal data without undue delay if one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the data subject withdraws the consent on the basis of which the data were processed and there is no further legal basis for the processing;
• the data subject raises reasoned objections to the processing;
• the personal data have been unlawfully processed;
• the personal data must be erased to comply with a legal obligation;

Right to restriction of processing

The data subject has the right to have the controller restrict processing in any of the following cases:

• the data subject contests the accuracy of the personal data for the period necessary to enable the controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject refuses to erase the personal data and requests instead that the use of the personal data be restricted;
• the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims;
• the data subject objects to the processing until it is verified that the legitimate grounds of the controller override those of the data subject;

This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object

The data subject shall have the right to object at any time to processing of personal data concerning him or her, including profiling, on grounds relating to his or her particular situation. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which shall include profiling insofar as it relates to such direct marketing. If the data subject objects to the processing for direct marketing purposes, the personal data will no longer be processed for those purposes.

Right to data portability

The data subject shall have the right to obtain personal data concerning him or her which he or she has provided to the controller in a structured, commonly used and machine-readable format and the right to transmit those data to another controller, without hindrance from the controller to whom the personal data have been provided, where:

• the processing is based on consent or on a contract;
• the processing is carried out by automated means;

In exercising his or her right to data portability, the data subject has the right to have personal data transmitted directly from one controller to another controller, where technically feasible.

Right not to be subject to a decision based solely on automated decision-making processing

The data subject has the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. The data subject shall not have this right where the decision is: (a) necessary for entering into, or performance of, a contract between the data subject and the controller; (b) permitted by Union or Member State law to which the controller is subject and which also provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject; or (c) based on the data subject's explicit consent.

Realization of data subjects' rights

Contact point for the administration of personal data

The request by which the data subject intends to exercise his/her rights should be addressed to the VŠPJ - Contact Point for the Administration of Personal Data, via mail, data box w9ej9jg, or email gdpr@vspj.cz. In the case of electronic communication, the applicant must prove his/her identity unambiguously to the College of Polytechnics Jihlava.

The contact point for the administration of personal data shall forward the data subject's request for processing to the relevant staff according to the purpose of the processing and shall also cooperate with the Data Protection Officer in this respect.

Data Protection Officer

The data protection officer at the VŠPJ is Mgr. Pavla KOSOVÁ, email: poverenec@vspj.cz.

Supervisory Authority

The supervisory authority for personal data protection is the Personal Data Protection Authority. Data subjects can exercise their right to lodge a complaint with the Data Protection Authority in the event of unlawful and unresolved processing of their personal data by the controller. The Authority's website contains a wealth of relevant information, including official opinions on practice questions.