Information on the Processing and Protection of Personal Data

�In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and on repealing Directive 95/46/EC (General Data Protection Regulation) ) (hereinafter referred to as “GDPR”), and with Act No.110/2019 Coll., on the processing of personal data (hereinafter referred to as “ZZOÚ”), the University of Hradec Králové informs the subjects of personal data on the conditions, under which personal data provided by them are processed and protected and what rights they have in the area of processing and protection of personal data (hereinafter referred to as “Information”)

Personal Data Manager

The Personal Data Manager of data subjects, i.e. who determines the purpose and means of processing personal data, carries out processing and is responsible for it, is the University of Hradec Králové, with its registered office at Rokitanského 62/26, 500 03 Hradec Králové (hereinafter referred as to "UHK", “we", “our”).

ID: 62690094, TIN: CZ62690094

ID of the data box: k3xj9dz

UHK is a public higher education institution of the university type pursuant to Act No. 111/1998 Coll., on higher education institutions and on the amendment and supplementation of other acts (the Higher Education Act). Within the framework of its main mission defined by the Statute of the UHK, it freely and independently carries out educational and, in connection with it, scientific and research, development and innovation, artistic or other creative activities and related activities.

Personal Data Protection Officer

The proper performance of activities in accordance with legal regulations in the area of processing and protection of personal data at the UHK is supervised by the UHK Personal Data Protection Officer.

The Personal Data Protection Officer is Mgr. Tomáš Cvrček, e-mail:gdpr@uhk.cz, Phone No. + 420 493 332 534.

Principles of Personal Data Processing at the UHK

In the processing of personal data, the UHK shall be based on the basic rules and principles resulting from the GDPR and the ZZOÚ, the compliance of which the UHK, as the personal data manager, is responsible for and it should be able to demonstrate compliance with the stated principles:

Legality, Fairness and Transparency - UHK is always obliged to process personal data in accordance with legal regulations and on the basis of at least one legal title, it must process such data openly and transparently and provide the data subject with information about the way they are processed together with the information to whom the personal data will be given, in case of serious breach of security or leakage of personal data inform about such fact;
Purpose Limitation - personal data must be collected for certain and legitimate purposes and must not be processed in a way incompatible with those purposes;
Data Minimization - personal data must be adequate and relevant to the purpose, for which it is processed;
Accuracy - personal data must be accurate, therefore the UHK is obliged to take all reasonable measures to ensure regular updating or correction of personal data;
Storage Limitation - personal data should be stored in a form allowing identification of the data subject only for the time necessary for the specific purpose;
Integrity and Confidentiality - technical and organizational security of personal data against unauthorized or unlawful processing, loss or destruction.

Categories of Personal Data Subjects

During the processing of personal data, the UHK processes personal data, in particular of the following data subjects:

University staff (person in employment relationship with the university) or other collaborators (especially supervisor, co-researcher, co-author of the publication);
Job seekers;
Applicants for study;
University students;
Former university students (including graduates);
Participants in the CŽV programme or in the University of the Third Age;
Students of another university or students on short-term student mobility for studies at the UHK;
Business partners (suppliers, purchasers) and customers;
Participants in scientific and research activities;
Visitors or participants of the event organized by the UHK;
Parties to the administrative or judicial proceedings with the UHK;
Other people.

Categories of Processed Personal Data

UHK processes both personal data provided directly by the personal data subjects (whether on the basis of consent or other legal reasons), and other personal data created by the processing activity and necessary for their securing. This may include the following categories of personal data:

Address and identification data (especially name, surname, date and place of birth, marital status, social security number, title, nationality, address (including electronic one), telephone number, personal document number, digital ID, signature)
Descriptive data (in particular education, foreign language skills, professional qualifications, knowledge and skills, number of children, portrait photographs, video/audio record of a person, military service, previous employment, health insurance, membership of interest organizations, criminal integrity);
Study data (in particular records of studies and study activities, study results, study awards);
Economic/transaction data (in particular bank details, wages, rewards, fees, payables and receivables, orders, purchases, taxes);
Work data (especially records of work and work activities, superior worker, workplace, job title and position, work appraisal, work awards);
Operational and location data (in particular data from electronic systems relating to a particular data subject – e.g. data on the use of information systems, data traffic and electronic communication, on the use of the telephone, on access to different areas, camera recordings);
Data on the subject's activities (in particular publications, data on professional activities, participation in conferences, involvement in projects, data on business or study trips);
Information about another person (especially address and identification details of a family member, spouse, child, partner);
Special categories of personal data (in particular sensitive personal data capturing health information, trade union membership);
We only process your personal data to the extent necessary for the relevant purpose listed below.

Purposes of Personal Data Processing

In fulfilling its mission set by the Statute of the UHK, the UHK processes personal data mainly for the following purposes.

Educational activities (in particular study, teaching, admissions, exchanges, lifelong learning, library services);
Scientific, research, development and creative activities (in particular project solving; organization of professional conferences; publishing, habilitation and professorship procedures);
Administration and operation of the organization (especially human resources and wages, economics and accounting, asset management, operational administration, e-infrastructure - computing and storage systems, computer network, electronic mail);
Protection of property and security: (especially camera systems, access to secured areas, security monitoring of computer network operation);
Commercial activities (in particular catering and accommodation services, contractual commercial activities);
Information and promotion activities: (websites; marketing and promotion; graduates; suburban camps).

Legal Reasons for Processing Personal Data

The legal basis for the processing of personal data in the above areas of activity shall always be at least one of the following legal grounds:

Data subject consent – consent given for one or more specific purposes;
Performance of the contract - processing is necessary for the performance of the contract, to which the data subject is a party, or for carrying out measures taken before the contract is made at the request of the data subject;
Fulfilment of the legal obligation – processing is necessary to fulfil the legal obligation that applies to the manager, in case of the UHK these are obligations arising mainly from Act No. 111/1998 Coll., on higher education institutions, Act No. 130/2002 Coll., on support of research and development from public funds, Act No. 262/2006 Coll., Labour Code, Act No. 563/1991 Coll., on accounting, Act No. 127/2005 Coll., on electronic communications, Act No. 480/2004 Coll. on some services of the information society and others;
The legitimate interest of the manager – that consists in particular in: - the protection of property and the prevention of fraud, - the transfer of personal data within the university for internal administrative and operational purposes, - ensuring the security of the computer network and information;
Protection of the data subject's interests – processing is necessary to protect the vital interests of the data subject or any other natural person;
Fulfilment of a task in the public interest/in the exercise of public authority – processing is necessary for fulfilment of tasks performed in the public interest or in the exercise of public authority entrusted to UHK.

Storage Period of Personal Data

Data shall be stored only for the time necessary in relation to the given processing of personal data and in accordance with the valid shredding rules are then disposed of or archived. Personal data processed by UHK with the consent of the data subject shall be kept only for the duration of the purpose, for which the consent was granted.

Transfer of Personal Data

UHK processes the personal data of data subjects itself, as a matter of principle. If UHK entrusts another person with the performance of a certain activity, the relevant personal data may be processed. The persons thus authorized shall become personal data processors.

The processor is authorized to handle the data exclusively for the purpose of performing the activity, for which UHK has authorized him/her. In such a case, the consent of the data subject is not required for the purpose of carrying out the processing activity, as such processing is directly permitted by law.

In order to fulfil its statutory obligations, the UHK may transfer selected data to designated entities (e.g. to public authorities). This shall apply mutatis mutandis to cases where individual consent of the data subject is granted for the transfer of personal data.

Rights of the Data Subject when Processing Personal Data

In the area of personal data protection, the data subject is guaranteed by a number of rights that he/she can apply against the UHK via the UHK data box: k3xj9dz, email gdpr@uhk.cz, telephone number + 420 493 332 534, in paper form at the UHK postal address, i.e. Rokitanského 62/26, 500 03 Hradec Králové or by personal filing at the UHK registrar at the same address. Before processing the application, UHK has the right and the obligation to verify the identity of the applicant. Detailed rules for exercising rights are available in the Procedure for Submitting a Request Concerning the Protection of Personal Data tab.

Right of Access to Personal Data
The data subject shall have the right to request UHK to confirm whether or not the personal data relating to the data subject are processed by the UHK and, if so, the data subject shall have the right to obtain access to his/her personal data and other related information, in particular:
The data subject has the right to request a copy of the processed personal data. However, the UHK may charge a fee for the repeated provision thereof corresponding to the costs of processing and providing information.
Right to Data Portability

Where appropriate for the data subject to facilitate communication with another service provider, the data subject shall have the right to obtain personal data in a structured, commonly used and machine-readable format, if technically possible, and may require UHK (where it is not prevented by a legal impediment) to transmit personal data to a designated manager. The condition is that such processing is based on the consent of the data subject or on the basis of the fulfilment of the contract made by the data subject with the UHK, and at the same time it is carried out automatically.
Right to Correct Personal Data
If the data subject's personal data are incorrect, inaccurate or have been changed, the data subject shall have the right to be corrected. Taking into account the purposes, for which such personal data are processed by UHK, the data subject shall also have the right to supplement them.
Right to Delete Personal Data (Right to be Forgotten)
The data subject shall have the right that the personal data relating to that data subject be deleted by the UHK without undue delay. This right is limited especially if UHK has to process personal data in order to properly perform its tasks (fulfilment of obligations stipulated by law).
Right to Limit the Processing of Personal Data
The data subject shall also have the right to restrict the processing of personal data, in particular if the UHK will engage in an objection to the processing of personal data or notice of the inaccuracy of the data.
Right to Revoke Consent to the Processing of Personal Data
If the data subject gives us consent to the processing of personal data, he/she has the right to revoke it at any time, and the same applies to consent to the use of the personal identification number. Upon revocation of the consent, we will terminate the processing of personal data, for which we have no other legal title than the consent of the data subject.
Right to Object and Automated Individual Decision Making
If the data subject does not wish us to continue processing that we carry out to protect our legitimate interest, it may raise a so-called objection.The objection should be justified. It should explain why the data subject considers that the processing in question adversely affects his/her privacy or the protection of his/her rights and interests protected by law. Then the UHK will evaluate whether the protection of the legitimate interest or the protection of third parties is still stronger than the impact on the data subject. This does not apply to direct marketing processing where processing is terminated automatically upon receipt of an objection. At the same time, the UHK may contact the data subject even after deregistering from the marketing communication for the purpose of operating and fulfilling its rights and obligations.Where our decision-making is fully automated, and in the event that the data subject disagrees with the outcome of the decision, he has the right to human intervention by UHK employees. If the data subject so requests, the UHK employee shall review the decision and inform him/her of the outcome. In the event that the employee evaluates that the decision is not factually or substantively correct, he/she shall ensure its correction.In the context of automated individual decision-making, the data subject shall also have the right to express his or her opinion on the outcome of the decision and the outcome of its possible review.If the data subject disagrees with the decision or the outcome of the review, he/she also has the right to request that the matter be decided by the senior executive of the decision maker or who might decide to review the decision. The senior executive decides on the matter by changing, cancelling or confirming the decision and, if necessary, the outcome of the review. He/she shall inform the data subject of the outcome of its decision without undue delay.
Right to Lodge a Complaint with the ÚOOÚ
If the data subject disagrees with anything regarding the processing of personal data, he/she always has the right to address a request, complaint or suggestion to the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.

If you have not found all the answers to your personal data inquiries above, or you need to explain some of the information in more detail, please contact our Personal Data Protection Officer Mgr. Tomáš Cvrček on the email gdpr@uhk.cz or phone No. +420 493 332 534.

This Information is permanently available in electronic form on the website www.uhk.cz/GDPR or in physical form by the Personal Data Protection Officer.

This Information is of a general nature and it will be used unless other information about processing and personal data within a specific part, workplace, event or administration of the UHK provides otherwise.

This information is available in Czech and English versions. If there is a discrepancy between these versions, the Czech version shall prevail.

Information on the processing of personal data within selected parts of the UHK can be found here:

Information-Counselling and Career UHK

UHK University Library

University Halls of Residence

This Information is effective as of June 3, 2019.