Declaration of personal data processing

Declaration of personal data processing

   According to Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR).
RCD Radiokomunikace as a data privacy administrator allows you to inform about the processing and protection of your personal data.

I. Personal data source

• Business partner
• Employee
• Job applicant

II. How to get personal information:

• Direct (questionnaires, registrations, emails, phone, contact form at www, social networks, business cards etc.).
• From publicly accessible registers, lists and records (e.g. commercial register, trade register, land register, public phone directory etc.)
•  On the basis of consent to the processing of personal data

III. Categories of personal data

• Address and identification data used for unique and unmistakable identification of the natural person of the so-called data subject, e.g. name, surname, title, birth number, date and place of birth, marital status, permanent address, nationality, ID, VAT number and data enabling contact, e.g. contact address, phone, e-mail and other similar information.
• Descriptive data such as education, knowledge of foreign languages, professional knowledge, and skills, number of children, military service, previous employment, health insurance, wage, ID and driving license number, passport number, bank connection etc.
• Sensitive data such as health or biometric data. A typical biometric data is, for example, facial image, fingerprint or signature.
• Information about another person, e.g. address and identification data of a family member, spouse, child etc.
• Other data necessary for contract fulfillment.
• Data provided in excess of applicable laws processed on the basis of consent granted, e.g. processing of photographs, use of personal data for personnel management etc.

 IV. Purpose of personal data processing

• Negotiation of a contractual relationship
• Contract fulfillment
• Protecting the rights of the administrator, recipient, or another concerned person, such as the recovery of administrator's receivables
• Fulfillment of legal duties by the administrator 
• Archiving under the law
• Recruitment procedure
•  The purposes included in consent to the processing of personal and other data.

 V. The scope of personal data processing
    Personal data obtained directly are processed to the extent of they were provided in connection with the conclusion of a contractual or other legal relationship with the administrator.
    Personal data collected different, for example from public registers, lists and records are processed in accordance with applicable law.

VI. Personal data recipients

• Administrator
• Processor
• State authorities in fulfillment of legal duties established by relevant legal regulations (company doctor, relevant health insurance companies, Czech Social Security Administration, Czech Financial Administration, Czech Labour Office, Czech Statistical Office, Czech National Security Authority)
• Financial Institutions (banking sector, insurance companies, other licensed subjects)
• Other recipients (e.g. transfer of personal data abroad - EU countries)

VII. Personal data processing and protection method
    The processing is carried out at administrator´s or processor´s headquarters by individually authorized administrator´s employees or by authorized processor´s employees. The most processing is carried out by computer technology or in paper form manually. All security policies for personal data managing and processing are kept. The administrator has taken technical and organizational measures to ensure personal data protection, especially measures against unauthorized or accidental access to personal data, change, destruction or loss, unauthorized transmissions or processing or another personal data misuse.
   All subjects, whom personal data may be made available to, are required to comply with applicable laws concerning personal data protection and to respect the right to privacy.

VIII. Personal data retention period
       In accordance with deadlines specified in relevant contracts, the administrator's document, and shredding order or in relevant legislation, that is the time necessary to ensure the rights and obligations arising from both, contractual relationship and applicable law.

IX. Rights of access to personal data
    In accordance with Article 12 of GDPR, a natural person - data subject has upon request the right of access to personal data and the following information about:

• The purpose of processing
• The category of personal data concerned
• The recipients whom personal data have been or will be made available
• The planned time for personal data storage
• All the available information about the personal data source

    Any data subject who finds out or considers that administrator or processor carries out the processing of personal data contrary to the protection of privacy and personal life or against the law, especially if personal data are inaccurate with regard to the purpose of their processing, may:

• Ask the administrator for an explanation.
• Require the administrator to remove the resulting state. That may concern blocking, correction, completion or delete personal data.
• If data subject's request according to Section IX, paragraph 1 is found to be legitimate, the administrator shall immediately remove the defective state.
• If the administrator fails to comply with the request according to Section IX, paragraph 1, the data subject has the right to contact the supervisory authority, i.e. Office for Personal and Data Protection.
• The administrator has the right to require an adequate compensation for providing information not exceeding the costs necessary to provide the information.

X. Processing instructions
    The administrator processes personal data with natural person´s - data subject´s consent, except for cases where personal data processing does not require data subject´s consent.
In accordance with Article 6, paragraph 1 of GDPR, the administrator may, without data subject´s consent, process personal data in following cases:

• Processing is necessary for contract fulfillment where the data subject is the contractor or for the implementation of measures taken prior to contract upon data subject´s request.
• Processing is necessary to meet legal duties applicable to the administrator.
• Processing is necessary to protect data subject´s or other natural person´s vital interests.
• Processing is necessary for task fulfillment carried out in public.
• Processing is necessary for administrator´s or third party´s legitimate interests except for cases of fundamental rights´ and freedom´s protection.

Karel Páral, Managing Director

Stare Hradiste, May 1, 2018