Your Rights

The Prague Public Transit Company (DPP) is pleased to inform physical persons whose personal data it processes about the following rights:

Right to Information (pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR))

You have the right to information about how your personal data is being processed. You will find this information in this document.

Right of Access (pursuant to Article 15 of the General Data Protection Regulation (GDPR))

You have the right to obtain confirmation from the Prague Public Transit Company (DPP) as to whether they are processing your personal data; and, if they are processing your personal data, you have the right to access (get a copy of) it.
You have the right to obtain a copy of the categories of your personal data, which are being processed by the Prague Public Transit Company (DPP). DPP may charge you a reasonable fee for multiple copies based on the related administrative costs.

Right of Correction (pursuant to Article 16 of the General Data Protection Regulation (GDPR))

You have the right to have the Prague Public Transit Company (DPP) correct any inaccuracies which are discovered in your personal data and to have the company do so without any undue delay. In relation to the purpose for which such personal data is being processed, you have the right to supplement incomplete personal information.

Right of Deletion – also, the Right-to-be-Forgotten (pursuant to Article 17 of the General Data Protection Regulation (GDPR))

You have the right to have the Prague Public Transit Company (DPP) delete your personal data without undue delay if one of the following situations exists:

a)     your personal data is no longer needed for the purposes for which it was collected or otherwise processed;
b)     you have raised an objection to the processing, pursuant to Article 21 (1) of the General Data Protection Regulation (GDPR) and there are no overriding legitimate reasons for the processing; or, you have objected to the processing pursuant to Article 21 (2) of the General Data Protection Regulation (GDPR);
c)     your personal data has been processed illegally; and,
d)     your personal data must be deleted in order to comply with a legal obligation laid down in the law of the European Union or laid down by one of its Member States, which then applies to the Prague Public Transit Company (DPP).

Your rights, which have been identified above in this paragraph, do not apply if the processing of your personal data is necessary for any of the following:

a)     the exercise of the right to freedom of expression and information;
b)     to fulfill a legal obligation requiring its processing under a law of the European Union or of one of its Member States, which then applies to the Prague Public Transit Company (DPP); or, to fulfill a task being carried out in the public interest or in the exercise of official authority and if the Prague Public Transit Company (DPP) is entrusted with such an obligation;
c)     for reasons of public interest in the field of public health;
d)     for archival purposes, which are in the public interest, for scientific or historical research purposes or for statistical purposes, in accordance with Article 89 (1) of the General Data Protection Regulation (GDPR);
e)     for the determination, exercise or defense of legal claims.

Right to Object (pursuant to Article 21 of the General Data Protection Regulation (GDPR))

For reasons related to your specific situation, you have the right at any time to object to the processing of your personal data by the Prague Public Transit Company (DPP), if such data is being processed on the basis of Article 6 (1) (e) or (f) of the General Data Protection Regulation (GDPR), including any profiling being done on the basis of these provisions. In such a situation, the Prague Public Transit Company (DPP) will have to halt any further processing of your personal data unless it can provide serious and legitimate reasons for such processing and if such reasons outweigh your interests, your rights and freedoms or if such information is needed for the determination, exercise or defense of legal claims.
If your personal data is being processed for direct marketing purposes, your personal data will no longer be processed for this purpose.

Right to Lodge a Complaint (pursuant to Article 77 of the General Data Protection Regulation (GDPR))

You have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Processing, located at the address: Pplk. Sochora 27, 170 00 Prague 7.

Notifications of a Security Breach 

(pursuant to Article 34 of the General Data Protection Regulation (GDPR))
 If it is probable or likely that a breach of the security of your personal data represents a significant risk of violating your rights and freedoms, the Prague Public Transit Company (DPP) shall be obligated, with a few exceptions, to notify you about this breach without any undue delay.

The Prague Public Transit Company (DPP) has appointed a Data Protection Officer (DPO) to oversee compliance with its legal obligations and these data protection principles. You can contact the Prague Public Transit Company (DPP)’s Data Protection Officer in the following ways.

Mgr. Jan Slezák

Applications submitted other than by data box or in person must include your date of birth in order to properly identify you (so that your personal data is not provided to any unauthorized party). An example might be a situation in which someone with your same name is asking the Prague Public Transit Company (DPP) to access their personal data. If the Prague Public Transit Company (DPP) fails to verify the information in the personal data (such as date of birth, etc.), there could be confusion. The obligation to identify the applicant is in accordance with the provisions of Article 12 (6) of the General Data Protection Regulation (GDPR).

Changes to this Information

Please note that despite the Prague Public Transit Company (DPP)’s striving to maintain a consistently high level of protection in their processing of your personal data, it is possible that your information may be updated or changed in the future. In such a situation, the processing of personal data will always be governed by the latest information on the processing of personal data. Please keep yourself informed of the processing procedures. Thank you.