Personal Data

Information about the processing of personal data

We do not take the protection of your personal data lightly. In accordance with Regulation No. 2016/679 of the European Parliament and of the Council (known also as the “General Data Protection Regulation (GDPR)”, hereinafter referred to as the “Regulation”), Act No. 110/2019 Sb., on the processing of personal data and other regulations applicable to the processing of “personal data”, the Prague Public Transit Company (DPP) would like to inform you about the processing of personal data.

What is the function of the Personal Data Controller and what do they do?

The Controller is a person who alone, or together with others, determines the purposes for which your personal data needs to be processed and the manner in which the processing of your personal data will take place.
Information about controller:
The Prague Public Transit Company (DPP), business ID (IČ): 00005886, with its registered office in Prague 9 at Sokolovská 42/217, postal code 190 00 (hereinafter referred to as “DPP”).

What are “personal data”?

“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. DPP does not consider the following data to be personal information or data: data and/or information that has been anonymized or collected in such a way that it can no longer be used to identify a specific individual, either in combination with other information or in any other way.

With respect to all processed information, DPP makes a determination as to whether such information should be classified as “personal data”. For example, the first name of a person living in a large city would not be considered personal data; however, if it was the first name of a person living in a small village, where a first name could lead to the identification of a specific individual, then such information would be considered personal data.

What are the basic criteria applicable to the processing of my personal data?

The legal conditions which are applicable to DPP’s processing of your personal data are generally following:

Contractual Relationships - in accordance with the provisions of Article 6, Section 1 (b) of the Regulation, in which the processing of your personal data is necessary for the performance of a contract to which you are a contracting party or in order to take steps at the request of the data subject prior to entering into a contract, then such personal data are being acquired for purposes which are described as being contractually related (hereinafter referred to using the keyword (title) “contract").
Legal Obligation - in accordance with the provisions of Article 6, Section 1 (c) of the Regulation, where the processing is necessary for compliance with a legal obligation to which the DPP is subject, then such personal data are being acquired for purposes which are described as being related to such a legal obligation (hereinafter referred to using the keyword (title) “law").
Legitimate Interests - in accordance with the provisions of Article 6, Section 1 (f) of the Regulation, when the processing is necessary for the purposes of the legitimate interests pursued by the controller (DPP) or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, then such personal data are being acquired for purposes which are described as being related to the user’s legitimate interests (hereinafter referred to using the keyword (title) “legitimate interest").

Overview of purposes for the processing of your personal data by DPP;

There has to be a legitimate purpose, in accordance with the Regulation, for DPP to process your personal data. It is not legally permitted to process your personal data without such a legitimate purpose. The purposes for which your personal data can be processed by DPP include the requirements to provide the following basic services and meet the related requirements and obligations:

Provision of Transport Services includingOperation of DPP Vehicles
Human Resources Management (including the selection and recruitment of personnel)
Legal Matter Management
Contract Management
Tender Management
Receivables Accounting and Record Keeping
Information Requests under Act No 106/1999 Sb.
Litigation Records
Records of Website Public Contact Forms
Solicitation and Purchase Orders
DPP Asset Management
DPP Budget and Accounting Records
Security and Protection of DPP Property
Operation of CCTV Systems