As the administrator of personal data, the Investment and Business Development Agency CzechInvest, with its registered office at Štěpánská 15, 120 00 Prague 2, Identification no.: 71377999 (hereinafter referred to as the “Administrator”), hereby informs subjects with which it comes into contact about the manner and scope of processing personal data on the part of the Administrator, including the scope of data-related rights connected with the processing of their personal data.
Processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the “GDPR”), and in accordance with the relevant internal legal regulations in the area of personal data protection. When processing personal data, CzechInvest, as the administrator of personal data, shall take into account the data subject’s right to privacy and personal life on the basis of the obligations stipulated by special acts.
Competency of the Administrator and purposes of personal data processing ensuing therefrom
On the basis of special legal regulations, the Administrator processes personal data necessary for identification of the data subject and for fulfilment of the legal obligations stipulated by the legal regulations in the areas falling within its competency, which are:
- support for small and medium-sized enterprises pursuant to Act No. 47/2002 Coll., on Support for Small and Medium-Sized Enterprises and on the Amendment of Act No. 2/1969 Coll., on the Establishment of Ministries and Other Central Bodies of the State Administration of the Czech Republic, as amended
- support for businesses on the basis of programmes approved by the government of the Czech Republic pursuant to a special act (e.g. Act No. 218/2000 Coll., the Business Property and Infrastructure Support Programme, etc.)
- functions of a designated organisation in the provision of investment incentives pursuant to special Act No. 72/2000 Coll., on Investment Incentives and on the Amendment of Certain Acts, as amended (the Investment Incentives Act)
- business support, e.g. for start-ups, aimed at firms’ growth on the domestic and foreign markets, support for domestic subcontractors, cooperation with domestic and foreign entities, linking of the private and public sectors, etc.
Legal grounds of personal data processing
The Administrator primarily uses legal grounds for the processing of personal data for fulfilment of its legal obligations, for fulfilment of tasks in the public interest, for the exercise of public authority and for performance necessary for the fulfilment of contracts. The Administrator can also use other legal grounds such as consent to the processing of personal data provided by the data subject, for protection of vitally important interests of the subject and for the legitimate interests of the Administrator.
Categories of personal data
- identification data (e.g. name, surname, title, date of birth, identification number, tax identification number, birth registration number)
- contact data (e.g. address of permanent residence, delivery address, e-mail address, telephone number, data box)
- payment data (e.g. bank account number)
- other information necessary for performance of contracts
- data provided beyond the framework of the relevant legal regulations and processed in connection with consent granted by the subject or on the basis of other legal grounds
The Administrator conducts processing of personal data. Processing is carried out using computer technology or, in the case of personal data in printed form, manually. In the course of processing, the Administrator complies with all security principles for administration and processing of personal data.
The Administrator obtains personal data especially from data subjects, from basic registers, from information systems of the state administration and from freely accessible public registers.
The period for processing personal data is derived from the period set forth in the relevant contracts, in the agency’s Data Retention and Destruction Policy and in the relevant legal regulations. This period is necessary to ensure the rights and obligations ensuing from the relationship as well as from the relevant legal regulations.
Based on the above, the subject’s personal data can be transferred or made accessible only to persons, bodies and institutions to which such right flows from the above-mentioned regulation, act or public interest. No automated decision-making shall occur in connection with the processing of personal data.
The Administrator processes data with the subject’s consent, with the exception of cases specified by the law when the processing of personal data does not require the subject’s consent.
Exercise of the subject’s rights
The subject’s rights are set forth particularly in Section III of the GDPR and Section 81 et seq. of Act No. 89/2012 Coll. This concerns the following rights:
- right of access to personal data
- right to correction, completion and deletion of personal data
- right to restriction of personal data processing
- right to portability of data
- right to raise objections to personal data processing
- right to not be a subject of automated individual decision-making with legal or similar effects, including profiling
The subject can exercise the above-mentioned rights via, for example, the form available here.
It is possible to deliver the completed form using the following methods:
- in person or by post to the address: Personal Data Protection Officer, Investment and Business Development Agency CzechInvest, Štěpánská 15, 120 00 Prague 2
- electronically signed with a valid qualified signature and sent by e-mail to the address firstname.lastname@example.org
- via data box – to ID: cyrj9gf
At the same time, the subject has the right to contact, at any time and with regard to his/her objection, the supervisory body, which is the Office for Protection of Personal Data (pplk. Sochora 727/27, 170 00 Prague 7 – Holešovice).
Personal Data Protection Officer
In the event of a breach of personal data protection, it is possible to directly contact the Administrator’s personal data protection officer.
It is possible to submit appeals for the exercise of the subject’s rights using the methods set forth above or by directly contacting the personal data protection officer, Lucie Jahnová (email@example.com).