PRINCIPLES OF PERSONAL DATA PROCESSING

Introduction

By means of these Principles of Personal Data Processing, the company Metrostav a.s. (hereinafter referred to as the „Company“ or „Metrostav“) informs data subjects, i.e., natural persons whose personal data it processes, of the principles for the protection of their privacy and of the processing activities performed (according to the European Union regulation for personal data protection, abbreviated as „GDPR“).


Basic information about processing of personal data

The principles of personal data processing apply to all clients, suppliers and customers of the Company and also to anyone who contacts the Company or in some other way imparts or shares some personal data (unless specified otherwise hereunder) with it. This means all people who utilise the services of the Company or provide services or sub-deliveries for it, or are in some other relationship with the Company.

Personal data is processed in Metrostav manually and automatically in Company information systems. If the personal data of data subjects is processed by information systems, no automated decision-making occurs.


Data Controller

The Personal Data Controller is Metrostav a.s., Business ID No: 00014915, having its registered office at the address Koželužská 2450/4, Libeň, 180 00 Prague 8, entered in the Companies Register maintained by the Municipal Court in Prague, section B, entry 758.

 

What data the Company gathers

The Company gathers these categories of data:

  1. Data which the data subjects themselves provide

Information provided upon these occasions:

  • in the conclusion of a contractual relationship between the data subject and Company or for the purposes of creation of this contractual relationship;
  • data provided for the fulfilment of orders;
  • if a data subject contacts the Company and asks about or offers deliveries of its services or goods; in communications with the Company, either via email or by filling in any contact form on the website www.metrostav.cz;
  • if a data subject contacts the Company for a different reason.
  1. Information from other sources

Such sources include:

  • publicly accessible sources, including public registers and the Internet;
  • information which Metrostav has received from third parties, such as an employer or colleagues
  • of a data subject or its business partners and which it absolutely needs to fulfil an order or perform
  • legal duties.

The Company may combine information gathered from these sources with other information which it gains through its own activity, i.e., by processing and evaluating personal data already gathered.

 

How the Company uses personal data

The Company uses the data gathered, for these purposes:

  1. Protection of assets, safety and other rights of the Company and third parties.
    The Company has a legitimate interest in protecting its assets and rights and the assets and rights of third parties. To this end, the construction sites, offices and premises of the Company may be protected by a CCTV system and visitor registration system.

The Company uses personal data exclusively for the purpose specified, and it keeps camera recordings in compliance with the opinion of the Office for Personal Data Protection generally for three days. The Company keeps records about visits, which contain only essential personal data (most often given name and surname, document number, or data about employer and vehicle licence number), for a maximum of 90 days.

  1. Contacting for cooperation
    The Company may use contact data to enquire about services and products from its suppliers, including potential ones. This constitutes a mutual legitimate interest in business cooperation. If a data subject is not interested in being contacted about business by Metrostav any further, it may use any of the Company‘s contact data to announce this fact to it.
  2. Building aktivity
    Metrostav uses the data for the actual fulfilment and recording of orders, for communication with clients, customers and suppliers, and the performance of all associated contractual and legal duties.
  3. Bookkeeping
    The Company uses the data to issue accounting documents and for bookkeeping according to legal requirements.
  4. Marketing in the sense of the offer of services of our Company
    The Company may use the personal data of its suppliers for the purposes of bidding in tenders and public contracts in which it participates.

The personal data is processed for this purpose due to the mutual legitimate interest in the fulfilment of business purposes and conclusion of the relevant contracts or on the basis of express consent to the pro cessing of personal data in the CED internal information system.

  1. Marketing, advertising and corporate communication

The Company may also use the personal data of data subjects for the purpose of:

  • its publication in promotional printed materials or on the company website, including Company profile on social networks, this being on the basis of the consent granted;
  • sending of information and news, for example, in the form of the sending of Metrostav News, on the basis of the consent granted or due to mutual legitimate interest in the case of existence of a contractual or comparable relationship between the Company and the data subject. If a data subject is not interested in being contacted in this way by Metrostav any further, it may use any of the Company‘s contact data to announce this fact to it.

If Metrostav holds any promotional, educational or other social event, it may take photographs of the event or make audio-visual recordings of it and publish these photographs or recordings on its website, social networks, or in other marketing materials, in order to give information about the event and its course. Recordings are not made with the intention of processing any personal data, and so personal data is not processed here.

  1. Recruitment of new employees

If the Company obtains someone‘s personal data for the purposes of recruiting employees, it uses it only for filling the new position. If one part of this data is professional psychodiagnostics, Metrostav processes the personal data arising therefrom only with the express consent of the data subject. The Company processes personal data for the entire duration of the selection procedure unless the data subject grants consent for the Company to keep his personal data for a longer period and use it for the eventuality of a newly vacant suitable position in the future.

Metrostav may process the personal data of vocational secondary school, professional technical secondary school, and university students, in order to support education and professional development, support and fulfilment in Metrostav, if such is derived from the contract concluded between Metrostav and the student, if the student grants consent to it, or if there is a mutual legitimate interest in the performance of work in Metrostav and in future cooperation. If a student is not interested in the performance of professional work at Metrostav, he may use any of the Company‘s contact data to announce this fact to it.

  1. Court proceedings and defence of legal claims

The Company can use the data collected to enforce claims, resolve disputes, or to protect its rights and legitimate interests according to valid legal regulations.

  1. Prevention and Ethics Line

If a data subject contacts the Ethics Line with a specific suggestion, he thereby expresses his consent to the processing of his personal data for the purposes of the investigation of the suggestion, this being for a period commensurate with the investigation of the suggestion and adoption of remedial measures.

If a third party announces personal data of a data subject to Metrostav on the Ethics Line, Metrostav will only process it to the extent necessary and for the period necessary for investigating the suggestion and ensuring redress, all of this in the context of the legitimate interest of the Company and third parties in adherence to all legal obligations.

 

Sharing and transferring data

The Company can share the data gathered:

  1. With other companies in the Metrostav Group

The Company may provide information or grant access thereto to legal persons – companies – constituting the Metrostav Group. A list of all the members of the Metrostav Group is available at the website https://www.skupinametrostav.cz/cs/. All companies of the Metrostav Group are bound by a non-disclosure duty and adhere to valid legal regulations in the area of personal data protection.

  1. With business partners

The Company may provide information or grant access thereto to its co-workers, clients, suppliers, consultants, software providers, insurance companies, audit companies and other service providers and business partners, if they ensure services for the company including the processing of personal data. In no case will it provide personal data, either for a fee or free of charge, to third parties without there being a legal reason for it.

All contractual partners of the Company are bound by a non-disclosure duty and adhere to valid legal regulations in the area of personal data protection.

  1. For legal reasons or in the case of disputes

The Company may share personal data if required by legal regulations:

  • with Police of the Czech Republic and courts, state authorities, or other third parties if necessary to comply with the legal obligations of Metrostav or for the assertion of its legal claims or for protection of rights or assets of the Company or third parties;
  • with other parties in connection with any merger of companies, sale of assets, consolidation or restructuring, financing or transfer of Company or part thereof to the ownership of another company.
  1. With the consent of the data subject

The Company may share the personal data in other ways and with other subjects if the data subject expressly agrees thereto.

When necessary, Metrostav may transfer personal data outside the EU, in particular in a case where it engages in trading or construction activity abroad. In such a case Metrostav always adheres to the valid legislation concerning the transfer of personal data abroad.

 

What rights does a data subject have in connection with the processing of personal data?

A data subject may, in connection with the processing of his personal data in the Company, assert the rights stated below. For his request, he may use the contact data of the Company given at the end of the information.

  1. Keeping and erasure of data

The Company keeps all personal data always only for the period necessary for adhering to the purpose for which the personal data is processed, in particular for the period:

  • designated by law or other generally binding legal regulations;
  • designated in the consent granted;
  • duration of contractual relationship with the Company, and by default for a further ten (10) years after its end, unless other statutory archiving periods are designated.

The Company erases personal data immediately upon the request of the data subject, unless there is a legal reason for its further processing, such as:

  • statutory archiving periods that have not ended;
  • if the Company is dealing with a problem with the data subject, such as not yet concluded dispute or legal claim;
  • if the Company keeps this data in aggregated or anonymous form; if the Company needs such data for legitimate business purposes.
  1. Access to personal data

The data subject may contact the Company at any time free of charge with a request for informa            tion about whether the Company is processing his personal data, and if so, he may ask for further information about this processing.

  1. Change of personal data or error in data

If, for example, during the contractual relationship between the data subject and Metrostav there should occur any change in personal data, such as change of name, home address or email address or telephone number, or if the data subject finds out that the Company is working with his data that is outdated or incorrect, he has the right to notify the Company of this and ask for correction or change of the personal data.

  1. Limitation of processing

If the data subject feels that:

  • the Company is processing his inaccurate data (and the Company checks whether this is the case);
  • the processing of personal data from the part of the Company is unlawful, and in addition the data subject does not wish that all the data be erased;
  • the Company no longer needs his data for the aforementioned purposes, but the data subject would like to use it for the defence of his legal claims, for example, in court proceedings;
  • there exists no legitimate interest of the Company in a certain processing of personal data (and the Company checks whether this is the case),

the data subject may request that the Company limit the processing of only some of his personal data or for only certain purposes of processing.

  1. Data portability

A data subject can contact the Company at any time to ask that it would convey his personal data that it has available to a third party according to the specification of the data subject.

  1. Objection to processing

If the Company processes personal data due to a legitimate interest of the Controller, the data subject may raise an objection to such processing according to the instructions given directly in the text of these principles.

  1. Withdrawal of consent to processing of personal data.

If processing of personal data is based on the consent of the data subject, this consent can be withdrawn at any time in writing (including email).

  1. Right to lodge a complaint

If a data subject feels that the Company is handling his data in contravention of the law, he may at any time complain to the Special Data Protection Officer and also to the Office for Personal Data Protection.

 

Special Data Protection Officer

The Company has established the institution of Special Data Protection Officer, whose task is, amongst other things, communication towards the Company and externally, resolution of complaints, accepting suggestions and other proposals concerning the processing of personal data in the Company

 

Contact data of Controller:

Metrostav a.s., business ID No: 00014915
registered office: Koželužská 2450/4, Libeň, 180 00 Prague 8
e-mail: poverenec@metrostav.cz