GDPR

Information on Prague University of Economics and Business Processing and Protection of Personal Data

Preamble
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)—hereinafter GDPR—Prague University of Economics and Business, hereby informs data subjects on the conditions under which their personal data area processed. Prague University of Economics and Business is fully compliant with GDPR.

  1. Personal Data Controller
    The Personal Data Controller is Prague University of Economics and Business, W. Churchill Sq. 1938/4, 130 67 Prague 3 – Žižkov, Czech Republic, ID No.: 613 84 399, VAT ID No.: CZ61384399, data box ID: canj9d5. Prague University of Economics and Business (hereinafter also VŠE) is a public university as defined in Act No. 111/1998 Coll., on Higher Education Institutions. VŠE’s mission is to freely and independently provide education and the associated scientific, research, developmental, innovative, artistic, and other types of creative activity, as well as any activity related to the above.
  2. Data Protection Officer
    VŠE Data Protection Officer is RNDr. Karel Nenadál, dpo@vse.cz, telephone: +420 224 095 710. Other contact information for the Data Protection Officer is available at https://insis.vse.cz/lide/clovek.pl?id=1053. You can contact the Data Protection Officer if you have any questions or concerns related to the processing and protection of your personal data.
  3. Principles for Personal Data Processing at VŠE
    VŠE considers personal data protection a key issue and devotes much attention to it. Your personal data are processed only within the scope necessary for the university’s operations, or in relation with VŠE services you use. We protect personal data to the maximum extent possible and in accordance with the applicable legal regulations. Principles and rules governing the processing of personal data at VŠE are defined in Directive No. SR 05/2018 “Protection and Processing of Personal Data“. The Directive applies the rules and principles following from GDPR as follows:

    1. Lawfulness: we are required to always process your personal data in accordance with legal regulations and based upon at least one legal title.
    2. Fairness and transparency: we are required to process your personal data openly and transparently, and provide you with information on the processing method and on who will have access to your personal data. This includes our obligation to inform you of any instance of severe security breach or personal data leakage.
    3. Purpose limitations: we are allowed to collect your personal data only for a clearly defined purpose.
    4. Data minimisation: we are required to process only personal data that are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
    5. Accuracy: we are required to take every reasonable step to ensure regular updates or correction of your personal data.
    6. Storage limitations: we are required to store your personal data no longer than it is necessary for the purposes for which the personal data are processed. Therefore, when the period necessary for the purpose for which the personal data are processed terminates, we are going to delete or anonymize your personal data so that they may not be traced back to you.
    7. Integrity and confidentiality, non-repudiation, and availability: we are required to secure your personal data and protect them from unauthorised or illegal processing, loss, or damage. For this reason, we have taken many technical and organizational measures to protect your personal data. Simultaneously, we ensure that only authorized employees may access your personal data.
    8. Accountability: we are required to be able to demonstrate our compliance with all the conditions indicated above.
  4. Purposes for which we process personal data
    To fulfil its mission, VŠE processes personal data for the following purposes:

    1. Education
      1. Study programmes
      2. Instruction
      3. Admission procedure
      4. Exchange programmes
      5. Lifelong learning
      6. Library services
    2. Research & Development, and Creative work
      1. Project investigation
      2. Expert conference organization
      3. Publishing and editorial services
      4. Habilitation and professorships procedures
    3. Administration and Operations
      1. HR and wages
      2. Financial management and accounting
      3. Asset administration
      4. Operating agendas
      5. E-infrastructure (IT and storage systems, computer network, e-mail)
    4. Safeguarding Assets and Security
      1. Camera Systems
      2. Access to secured areas
      3. Security monitoring of computer network operation
      4. Handling security incidents
    5. Safeguarding Assets and Security
      1. Catering and accommodation
      2. Contractual business
    6. Information Provision and Promotion
      1. Websites
      2. Marketing and promotion
      3. Alumni
  5. Categories of persons whose personal data we process
    VŠE processes personal data of the following categories of persons (data subjects):

    1. Employees (persons employed by VŠE),
    2. Students (persons taking part in any of VŠE educational program),
    3. Applicants (persons taking part in admission procedures to study at VŠE),
    4. Alumni (persons who studied at VŠE in the past),
    5. Third parties (persons not employed by VŠE who take part in educational, research, contractual, and other VŠE activities),
    6. Survey participants (persons who take part in research and projects as research subjects),
    7. Customers (persons making use of or purchasing VŠE products and services).
  6. Categories of personal data processed
    VŠE processes personal data provided directly by individual natural persons—whether based upon their consent or other legal reasons—as well as other personal data created as part of processing activities and those necessary for its operation. Chief among them are:

    1. Address and identification data (name, surname, date and place of birth, marital status, birth ID No., title, nationality, postal and email addresses, telephone number, ID card/passport number, digital identifier, signature, etc.).
    2. Descriptive data (education, knowledge of foreign languages, professional qualifications, knowledge and skills, number of children, portrait photography, video / audio records of persons, military service, previous employment, health insurance, membership in interest organizations, criminal records, etc.).
    3. Student data (records on study programs and study activities, academic results, academic awards).
    4. Financial management data (bank connection, wages, bonuses, fees, liabilities and receivables, orders, purchasing, taxes, etc.).
    5. Job-related data (records on jobs and work-related activities, employer, unit, job descriptions and positions, work evaluation, awards, etc.).
    6. Data concerning operations and locations (usually data from electronic systems concerning a specific data subject, e.g., data on the use of information systems, data operation and electronic communication, telephone use, access to various areas, CCTV records, etc.).
    7. Subject activity data (publications, expert activities, participation in conferences, taking part in projects, data on business trips or student academic trips, etc.).
    8. Data concerning another person (address and identification data of a family member, husband/wife, child, partner, etc.).
    9. Special personal data category (sensitive personal data on health condition, membership in unions, etc.).
  7. Legal reasons for personal data processing
    Personal data processing that takes place as part of the activities indicated above is carried out
    based upon the following legal reasons:

    1. Fulfilment of legal obligations concerning the Controller:
      We need to process your personal data to fulfil our legal obligations as a Controlling entity. These obligations are dictated by: Act No. 111/1998 Coll., on Higher Education Institutions; Act No. 130/2002 Coll., on the Support of Research and Development from Public Funds; Act No. 262/2006 Coll., Labour Code; Act No. 563/1991 Coll., on Accounting; Act No. 127/2005 Coll., on Electronic Communications; Act No. 480/2004 Coll., on certain Information Society Services; Act No. 181/2014 Coll. on Cyber Security; and others.
    2. Contract performance:
      Here we need your personal data to be able to conclude a contractual relationship and for the purposes of the subsequent contractual performance; the data may be necessary to provide before the conclusion of the contract.
    3. Controller’s legitimate interest consist, among other things, in:
      • protection of assets and preventing fraud,
      • transfer of personal data within a university unit for internal administrative and operational purposes,
      • ensuring security of computer network and information.
    4. Data Subject Consent:
      this is your consent to process your personal data for a single purpose or several purposes.
  8. Personal data transfer
    To fulfil its legal obligations, VŠE may transfer selected data to specified entities (e.g., public administration authorities). Similarly, this applies on cases when the authorisation to transfer personal data outside VŠE is given by individual instances of consent expressed by data subjects.
  9. Personal data storage period
    Data are stored only for the period of time necessary with respect to the processing activity in question; in accordance with an applicable shredding plan they are subsequently liquidated or archived. Personal data processed with your consent are stored only as long as the purpose for which your consent was given lasts.
  10. Exercise of Data Subjects’ rights
    Data Subjects shall be entitled to exercise their rights under GDPR as of 26 May 2018. Data subjects must exercise their rights vis-à-vis the Personal Data Controller by sending a request to its data box: canj9d5, an email to the Data Protection Officer: dpo@vse.cz, or by handing it in person to the Data Protection Officer, see https://insis.vse.cz/lide/clovek.pl?id=1053. Before processing such a request, VŠE has the right and obligation to verify the petitioner’s identity.
  11. The right to lodge a complaint with the competent supervisory authority
    Data subjects shall be entitled to lodge a complaint concerning personal data processing to the competent supervisory authority, specifically The Office for Personal Data Protection. Contact:
    The Office for Personal Data Protection
    address: Pplk. Sochora 27, 170 00 Prague 7
    tel.: 234 665 111
    website: https://www.uoou.cz/en/

This information is available in Czech and English versions. If there is a discrepancy between the Czech and English versions, the Czech version takes precedence.

  • Author: DPO dpo@vse.cz
  • Created on:
  • Last update: