Personal Data

Information on the processing of personal data

We do not take lightly the protection of your personal data. In accordance with Regulation No. 2016/679 of the European Parliament and of the Council (known also as the “General Data Protection Regulation (GDPR)”, hereinafter referred to as the “Regulation”), Act No. 110/2019 Coll., on the processing of personal data and other regulations applicable to the holding and processing of “personal data”, the Prague Public Transit Company (DPP) would like to explain to you how the processing of personal data takes place at our company.

What is the function of the Personal Data Administrator and what do they do?

The Personal Data Administrator is a person who alone, or together with others, determines the purposes for which your personal data needs to be processed and the manner in which this processing of your personal data will take place.
The Prague Public Transit Company (DPP), business ID (IČ): 00005886, with its registered office in Prague 9 at Sokolovská 42/217, postal code 190 00 (hereinafter referred to as “DPP”) is the Personal Data Administrator.

What is “personal data”? 

“Personal data” is information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified directly or indirectly by reference to an identifier, such as a name, identification number, location information (address), online identifier or one or more other factors specific to the physical, physiological, genetic, mental, financial, cultural or social identity of that natural person. DPP does do not consider the following to be personal information or data: information that has been anonymized or collected in such a way that it can no longer be used to identify a specific individual, either in combination with other information or in any other way.

With respect to all information it collects, DPP makes a determination as to whether such information should be classified as “personal data”. For example, the first name of a person living in a large city would not be considered personal data; however, if it was the first name of a person living in a small village, where a first name could lead to the identification of a specific individual, then such information would be considered personal data.

What are the basic criteria applicable to the processing of my personal data?

The legal conditions which are applicable to DPP’s processing of your personal data are the following:

  • Contractual Relationships - in accordance with the provisions of Article 6, Section 1 (b) of the Regulation, in which the processing of your personal data is necessary for the fulfillment of a contract to which you are a contracting party or for the steps taking place (or required) in anticipation of the conclusion of such a contract and for which contract you are the requesting (or initiating) party, then such personal data is being acquired for purposes which are described as being contractually related (hereinafter referred to using the keyword (title) “contract").
  • Legal Obligation - in accordance with the provisions of Article 6, Section 1 (c) of the Regulation, where the processing of your personal data is necessary for the fulfillment of a legal obligation that involves DPP, then such personal data is being acquired for purposes which are described as being related to such a legal obligation (hereinafter referred to using the keyword (title) “law").
  • Legitimate Interests - in accordance with the provisions of Article 6, Section 1 (f) of the Regulation, when the processing is necessary to serve the legitimate interests of DPP, then such personal data is being acquired for purposes which are described as being related to the user’s legitimate interests (hereinafter referred to using the keyword (title) “legitimate interest").

Overview of reasons for the processing of your personal data by DPP;

There has to be a legitimate purpose, in accordance with the Regulation, for DPP to process your personal data. It is not legally permitted to process your personal data without having such a legitimate purpose. The purposes for which your personal data can be processed by DPP include the requirements to provide the following basic services and meet the related requirements and obligations:

  • Provision of Transport Services
  • Assure the Operation of DPP Vehicles
  • Human Resources Management (including the selection and recruitment of personnel)
  • Legal Matter Management 
  • Contract Management
  • Tender Management
  • Receivables Accounting and Record Keeping
  • Information Requests under Act No 106/1999 Coll
  • Litigation Records
  • Records of Website Public Contact Forms
  • Solicitation and Purchase Orders
  • DPP Asset Management
  • DPP Budget and Accounting Records
  • Security and Protection of DPP Property (including facility access)
  • Operation of CCTV Systems

What is your legal relationship to DPP?