Personal data protection

Principles for working with your data

CzechInvest, Agency for Enterprise and Investment Promotion, with registered office
Štěpánská 15, 120 00 Prague 2, ID: 71377999 (hereinafter referred to as the “Controller”), as a personal data controller, hereby takes the liberty to inform the subjects with whom it comes into contact about the manner and scope of processing of personal data by the Controller, including the scope of data rights related to the processing of their personal data.

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27. April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as GDPR) and in accordance with the relevant national data protection legislation. As a personal data controller, based on the obligation given by specific laws, it takes care of the right to protect the private and personal life of the subject when processing personal data.

Competence of the Data Controller and the resulting areas of purposes for processing personal data

On the basis of specific legal regulations, the controller processes personal data necessary to identify the subject and to fulfil the legal obligations set out in legal regulations within the areas falling within its competence, which are:

• support for small and medium-sized entrepreneurs according to Act No. 47/2002 Coll., on the support of small and medium-sized enterprises and on the amendment of Act No. 2/1969 Coll., on the establishment of ministries and other central bodies of state administration of the Czech Republic, as amended
• support for entrepreneurs on the basis of programmes approved by the Government of the Czech Republic under a special law (e.g. Act No. 218/2000 Coll. or the Programme for Support of Business Real Estate and Infrastructure, etc.)
• the functions of the designated organisation in the provision of investment incentives under Special Act No. 72/2000 Coll., on investment incentives and on amendments to certain acts (Act on investment incentives), as amended
• business support, such as the so-called. start-ups in their growth on the domestic and foreign market, support for domestic subcontractors, cooperation with domestic and foreign entities and connecting the private and public sectors, etc.

Legal titles of personal data processing

The controller primarily uses the legal titles to process personal data for the performance of a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority and for the performance of a task necessary for the performance of a contract. It may also use other legal titles, such as consent to the processing of personal data provided by the subject, to protect the vital interests of the subject and the legitimate interests of the Controller.

Categories of personal data:

• Identification data (e.g. name, surname, title, date of birth, ID number, VAT number, birth number)
• contact details (e.g. permanent address, delivery address, email address, telephone number, data box)
• payment details (e.g. bank account number)
• other data necessary for the performance of the contract,
• data provided in excess of the applicable laws processed under the subject’s consent or on the basis of another legal title

The processing of personal data is carried out by the Controller. The processing is carried out by computer technology or manually for personal data in paper form, in compliance with all security principles for the management and processing of personal data.

The administrator obtains personal data mainly from subjects, from basic registers, from public administration information systems and from freely accessible public registers.

The processing period of personal data is derived from the time limits specified in the relevant contracts, in the Agency’s Filing and Shredding Rules or in the relevant legal regulations. It is the time necessary to secure the rights and obligations arising from both the contractual relationship and the relevant legislation.

On the basis of the above, the personal data of the subject may only be transferred or disclosed to persons, authorities or institutions to whom such right derives from the above regulation, law or public interest. There is no automated decision-making in the processing of personal data.

The controller processes data with the consent of the subject, except in cases provided for by law where the processing of personal data does not require the consent of the subject.

Exercise of subject’s rights

The rights of the subject are set out in particular in III. chapter of the GDPR and § 81 and subsequently Act no. 89/2012 Coll. These are the following rights:

• the right of access to personal data
• the right to rectification, completion or deletion
• the right to restriction
• the right to data portability
• the right to object
• the right not to be subject to automated individual decision-making with legal or similar effects, including profiling

The above rights may be exercised by the subject, for example, by using the form set out in here .

The completed form can be delivered in the following ways:

• in person or in writing to the Personal Data Protection Officer, CzechInvest Business and Investment Promotion Agency, Štěpánská 15, 120 00 Prague 2, ID No.: 71377999
• electronically signed with a valid qualified signature to poverenec@czechinvest.org
• via data box – to ID: cyrj9gf

The subject also has the right to address his/her complaint at any time to the supervisory authority, which is: the Office for Personal Data Protection (pplk. Sochora 727/27, 170 00 Prague 7 – Holešovice).

Data Protection Officer (DPO)

In the event of a personal data breach, you may contact the Data Protection Officer of the Controller directly.

A request to exercise the rights of the subject can be submitted in the above manner or by directly contacting the Data Protection Officer (DPO): Andrea Ligačová(poverenec@czechinvest.org).

This Personal Data Processing Declaration is publicly available on the Controller’s website and will be updated as necessary.