Privacy Policy

Information on Personal Data Processing and Protection at the UHK


The University of Hradec Králové (hereinafter the UHK) would like to inform the data subjects on conditions under which personal data provided by them are processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter GDPR).

 
1. Personal data controller

University of Hradec Králové (hereinafter the UHK)
Registered office Rokitanského 62, 500 03 Hradec Králové
Company identification number: 62690094, tax identification number: CZ62690094
Data box ID: k3xj9dz
The UHK is a public higher education institution of university type under Act No. 111/1998 Sb., on higher education institutions and on change and amendment of other laws (hereinafter the Higher Education Act). Within its main mission specified by the UHK Constitution, the UHK performs freely and independently educational and related scientific and research, developmental and innovative, artistic or other creative activities and activities related to them.
 

2. Data protection officer

Proper performance of data protection activities at the UHK is supervised by the UHK data protection officer who can be contacted through an e-mail address: gdpr@uhk.cz.
 

3. Principles of personal data processing at the UHK

Personal data processing at the UHK is based on basic GDPR principles and the UHK as the data controller is responsible for adherence to them and should be able to evidence their adherence to the said principles.
  1. Lawfulness, fairness and transparency. The UHK shall always process the personal data in accordance with legal regulations and on the basis of at least one legal title. The UHK shall process such data in an open and transparent way and provide data subjects with information on the way of data processing and to whom the data will further be provided. The UHK shall inform of any serious breach of safety or data leakage.
  2. Purpose restriction. Personal data must be collected for specific and lawful purposes and may not be processed in a way inconsistent with these purposes.
  3. Data minimization. Personal data must be reasonable and relevant for the purpose for which they are processed.
  4. Accuracy. Personal data must be accurate. The UHK, therefore, shall adopt all reasonable measures allowing regular data update or rectification.
  5. Restriction of storing. Personal data should be stored in form allowing data subject identification for a period required for the specific purpose and no longer.
  6. Integrity and confidentiality. This means technical and organizational protection of personal data against unauthorized or unlawful processing, loss or destruction.

4. Purposes of personal data processing and legal grounds of processing

 At meeting their mission specified by the UHK Constitution, the UHK process personal data for, in particular, the following purposes:
Educational activities
  • Study
  • Instruction
  • Admission procedure
  • Exchange stays
  • Lifelong Learning
  • Library services
Scientific and research, developmental and creative activities
  • Project solving
  • Organization of professional conferences
  • Publishing and editorial activities
  • Habilitation and full professor’s nomination procedure
Administration and University operation
  • Human resources and wages
  • Finances and accounting
  • Property administration
  • Operation agendas
  • E-infrastructure (computing and storing systems, computer network, electronic mail)
Protection of property and safety
  • Camera systems
  • Access to secured premises
  • Safety monitoring of computer network operation
Commercial activities
  • Boarding and lodging services
  • Contractual commercial activities
Information and promotional activities
  • Webs
  • Marketing and promotion
  • Alumni
  • Summer city camps
 
Personal data processing in the above mentioned areas is based on at least one of the following legal grounds:
  1. Data subject consent. Consent given for one or more specific purposes.
  2. Contract performance. Processing is required for performance of a contract to which the data subject is a contracting party, or for implementation of measures adopted before the contract making on the subject’s request.
  3. Fulfilment of legal obligations. Processing is required to fulfil legal obligations applied to the controller. Duties applied to the UHK include, in particular, duties resulting from act No. 111/1998 Sb., on higher education institutions, act No. 130/2002 Sb., on support of research and development from public means, act No. 262/2006 Sb-, the Labour Code, act No. 563/1991 Sb., on accounting, act No. 127/2005 Sb., on electronic communication, act No.480/2004 Sb., on some information society services, and other acts.
  4. Controller’s legitimate interest which consists, in particular, in:
    • Property protection and fraud prevention;
    • Transfer of personal data within the University for purposes of internal administration and operation;
    • Safeguarding of computer network and in formation safety.
  5. Protection of data subject’s interests. Processing is required to protect essential interests of the data subject or any other natural person.
  6. Task fulfilment in public interest/at performance of public authority. Processing is required to fulfil tasks performed in public interest or at performance of public authority with which the UHK is charged.

5. Categories of data subjects
  1. The UHK employees;
  2. The UHK students;
  3. Participants of lifelong learning at the UHK;
  4. Applicants for study (those participating in admission procedure for studies at the UHK);
  5. Alumni (those who studied at the UHK in the past);
  6. External collaborators (those who are not UHK employees but are involved in educational, research, contractual and other UHK activities);
  7. Research participants (those involved in research activities and projects as study subjects).

6. Categories of processed data

The UHK processes both personal data provided by the data subjects (whether upon their approval or any other legal grounds) and other personal data created by processing and required for the data safeguarding. The following personal data categories may be included:
  1. Address and identification data (name, surname, date and place of birth, marital status, birth number, title, citizenship, address (including e-mail), telephone number, identity card number, digital identifier, signature etc.);
  2. Descriptive data (education, knowledge of foreign languages, professional qualification, knowledge and skills, number of children, portrait photographs, subject-related video-/audio-records, military service, previous employment, health insurance company, membership in organizations, (no) criminal records etc.);
  3. Study data (records about studies and study activities, study results, study awards);
  4. Economic data (bank connection, wage, benefits, fees and charges, obligations and claims, orders, purchases, taxes etc.);
  5. Employment-related data (records on employment and related activities, superiors, worksite, kind of job performed and position, job evaluation, job rewards etc.);
  6. Operational and location data (typically data from electronic systems relating the given data subject, for example, data about the use of information systems, about data operation and electronic communication, the use of telephone, access to various premises, camera system records etc.);
  7. Subject activity data (publication activity, data about professional activities, participation in conferences, involvement in projects, data about business or study trips etc.);
  8. Other person’s data (address and identification data related to family members, wife/husband, child, partner etc.);
  9. Special category of personal data (sensitive personal data relating health condition, trade union membership etc.).

7. Transfer of personal data

The UHK may transfer some data to specified entities (e.g. to public authorities) in order to fulfil statutory duties. This shall also be applied to cases when the data subject gives his/her individual consent to the transfer of personal data.


8. Period of personal data retention

The data shall be retained only for a period required for the given activity of personal data processing. After that, they are either discarded or archived in accordance with the valid shredding regulation. Those personal data that are processed by the UHK with the data subject’s approval are retained only for the duration of the purpose for which the approval was granted.


9. Rights of the data subject at personal data processing

The data subject has, on the basis of GDPR, the following rights that can be applied at the UHK:
  1. Right of access to personal data. It is the subject’s right to ask the UHK for confirmation whether or not personal data concerning him/her are being processed, and, where that is the case, the subject shall have the right of access to the personal data and the following information:
  • The purposes of the processing;
  • The categories of personal data concerned;
  • The recipients to whom the personal data have been or will be disclosed;
  • Period of personal data retention;
  • The existence of the right to request from the controller rectification or erasure of personal data;
  • The right to lodge a complaint with a supervisory authority;
  • Any available information as to the personal data source;
  • The information whether or not the data are processed or profiled in an automated way.
  1. Right to rectification. The data subject may ask for rectification of inaccurate or incomplete personal data.
  2. Right of erasure (right to be forgotten). It is the subject’s right to ask the controller to erase his/her personal data without any undue delay. This right can be restricted if the UHK must process the personal data in order to fulfil their tasks properly (fulfilment of statutory obligations).
  3. Right to restriction of processing. It is the subject’s right to ask the controller to restrict the data processing.
  4. Right to data portability. The data subject shall have the right to receive the personal data in a structured, commonly used and machine-readable format, if it is technically possible, and have the right to ask the UHK to transmit those data (if there is no statutory hindrance) to another specified controller.
  5. Right to object and automated individual decision-making. The data subject shall have the right to object if he/she considers that the UHK process personal data without authorisation; automated decision-making and profiling can also be objected directly.
  6. Right to lodge a complaint with the Office for Personal Data Protection. The data subject may at any time lodge a request, initiative, or complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, web site https://www.uoou.cz.

10. Exercise of data subject’s rights

The data subject may exercise his/her rights towards the personal data controller through the UHK data box (k3xj9dz), e-mail (gdpr@uhk.cz), in a documentary form sent to the UHK postal address, or through personal delivery to the UHK filing office. Before the UHK processes the request, they may and must check the applicant’s identity. More detailed rules of exercise of rights are here.
 
This information is available in Czech and English version. In case of any discrepancies between the two versions, the Czech one prevails.




Documents


SelectTypeTitleCreatedSize
Veřejné dokumenty
25/05/2018 
Interní dokumenty
25/05/2018 

If you have no records in this section, you don´t have sufficient permission or your not logged in, please log in above to access this page.

Last modified:  Administrator, 5.6.2018 12:30