Principles of personal data processing

Personal data processing related to:

1) Seminars/training

• for the purpose of the performance of a contract (methodical support, seminars, e-learning etc.);
• processed data: name, surname, contact information, address, date of birth;
• other voluntary data (marketing communications, newsletters, invitations etc.).

2) Counselling services

• for the purpose of the performance of a contract (consultations, professional and education counselling, etc.);
• processed data: name, surname, contact information;
• other voluntary data (marketing communications, newsletters, invitations etc.).

3) Counselling services for foreigners

• for the purpose of the performance of a contract (consultations, professional and education counselling, Czech lessons, community interpreters etc.);
• processed data: name, surname, nationality, date of birth, contact information, address, gender, achieved level of education, country of origin;
• other voluntary data (marketing communications, newsletters, invitations etc.).

4) Side events

• for the purpose of the performance of a contract (consultations, professional and education counselling, workshops, volunteer events etc.);
• processed data: name, surname, nationality, contact information;
• other voluntary data (marketing communications, newsletters, invitations etc.).

5) Receiving news or other information-providing materials

• for the purpose of sending an email newsletter or other information-providing materials, invitations to events etc.;
• processed data: name, surname, e-mail address;
• other voluntary data (marketing communications, newsletters, invitations etc.).

6) Selling learning materials

– for the purpose of the performance of a contract, for the protection of our legitimate interests (e-book protection by displaying the name, surname and e-mail address of the buyer in the e-book);

– processed data: name, surname, e-mail address, postal address, phone number.

7) Use of the App for the Czech as a second language course

– once you register to our App, for the purpose of the performance of the contract (user account creation and authorized access via different devices); the user account can be erased per your request at any time by sending an email to info@meta-ops.cz containing your user email address. By closing the account, the user loses all the data saved in the App (settings, achieved level in exercises);

– processed data: e-mail address, connection mode (via Google or Facebook), data concerning your exercises success level.

Period of personal data processing

For the purpose of the conclusion and performance of a contract, data is processed by the data controller for the period necessary for the conclusion and performance of the contract, specifically for the duration of the provided services and compulsory archiving. Within its non-profit activities, META as data controller is the recipient of grants from public funding for each individual project. One of the conditions for receiving grants is archiving the documents pertaining to each project for a period of 10 – 15 years depending on the grantor.

For the purpose of sending commercial communications and for marketing and advertisement purposes, the data controller processes personal data for a maximum duration of one year since its collection.

If the data processing is based on the data subject’s consent, they have the right to withdraw their consent at any time by sending an e-mail to info@meta-ops.cz. The consent withdrawal does not affect the processing of personal data by the data controller on another legal ground, especially the purpose of the performance of a contract, or the lawfulness of the processing based on the consent until its withdrawal.

Recipients of personal data

The data controller does not share the personal data, nor do they disclose it to any third party.

The recipients of our personal data are donors of the completed projects to whom we are obliged to disclose basic information about all project participants. Our donors include the European Union, the Ministry of Interior of the CR, Prague City Hall, the Ministry of Education, Youth and Sport.

Employees and processors are required to keep the personal data as well as the implemented security measures, whose breach would jeopardize the security of your personal data, confidential. Our processors are technology and support providers (we use the ARUM information system from binBoat s.r.o., Microsoft Office 365, SimpleShop, Firebase, administrators of our App Česky levou zadní and our accountants also have access to the necessary personal data). Your personal data will not be disclosed to any third party without your explicit consent.

Means of processing personal data

The data controller and/or his processors process personal data manually (in printed and electronic form) and by electronic automated means.

The data subject has the following rights

• Right of access to personal data

If the data subject requests information about the processing of their personal data, the data controller must provide them with the information about the purpose of the processing of their personal data, the personal data itself, the categories of personal data concerned, including all available information regarding its origin, nature of decision-making automated processing or if there are acts or decisions based on the processing where its content constitutes an interference with the fundamental rights and legitimate interests of the data subject by the recipients or categories of recipients.

The data controller has the right to charge a reasonable fee for providing the information not exceeding the administrative costs.

• Right to rectification and clarification

The data subject who discovers or suspects that the data controller or one of his processors is processing his personal data in such a way that it interferes with the protection of their private and personal life or is unlawful, especially if the data is inaccurate with regards to the purpose of its processing, has the right to have the data controller or processor block, rectify, complete or erase the personal data.

Rights of data subjects since 25th May 2018

On May 25th 2018, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereafter referred to as “Regulation”) has come into effect. Since its entry into force, the subject benefits from the following additional rights:

• Extended right to access personal data

The data subject has the right to obtain confirmation from the data controller of whether or not personal data concerning them is being processed and if it is the case, has the right to access this personal data and the following information:

• personal data are no longer required for the purposes of the processing
• categories of relevant personal data
• recipients or categories of recipients who had or will have access to the personal data, especially recipients in third countries or international organizations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
• the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject, any available information as to their source

Furthermore, the data subject has the right to request a copy of the processed personal data if they do not adversely affect the rights or freedoms of others. If further copies are requested by the data subject, the data controller can charge a reasonable fee based on administrative costs. If the data subject sends an electronical request, the information will be provided in typically used electronic form, unless the data subject requests otherwise.

• Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• Right to erasure (right to „be forgotten“)

The data subject shall have the right to obtain from the controller the erasure of personal data concerning them without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

– the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed

– the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;

– the data subject objects to the processing of personal data for direct marketing purposes

– the personal data was processed unlawfully;

– the personal data must be erased for compliance with a legal obligation of the EU or the Czech Republic

–the personal data was collected in relation to the offer of information society services on the basis of a child´s consent

The right to erasure is not absolute, it does not give right to the data subject to ask for personal data erasure at any time or in any situation. For example, the right to be forgotten does not give the right to the data subject to ask for erasure when changing jobs or financial services, as the data controller has the obligation to archive certain personal data.

• Right to restrict processing

The data subject has the right to restrict the processing of their personal data by the data controller in any of the following cases:

– the data subject contests the accuracy of the personal data for the time it takes the data controller to verify the accuracy of the personal data

– the data has been unlawfully processed and the data subject opposes erasure and requests restriction instead

– the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims

• Right to data portability

The right to portability is an entirely new right of the data subject, by means of which they have the right to receive the personal data they have provided to a data controller in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. The data subject also has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The right to portability applies in the two following conditions:

– the processing is based on an explicit consent or on a contract

– the processing is carried out by automated means

Exercising the right to portability shall not adversely affect the rights and freedoms of others.

• Right to object

The data subject has the right to object, on grounds relating to their particular situation, at any time, to processing of personal data concerning them based on the following legal claims:

– the processing is necessary for the performance of a task carried out for reasons of public interest or the exercise of official authority carried out by the data controller

– the processing is necessary for the purposes of legitimate interests of the data controller or a third party.

The controller shall no longer process the personal data unless they demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

The data subject can object to the processing of their personal data for direct marketing or profiling purposes. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

• Right to object and automated individual decision-making, including profiling

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. In other words, it ensures that legal effects are not being decided solely by automated means without any human involvement, with possible exceptions.

Automated decision-making is acceptable if the decision is necessary to enter into or to perform a contract between the data subject and data controller, or if it has been allowed by a particular EU or national law, or if it is based on the explicit consent of the data subject.

For example, it is impossible for a driver to receive a fine for speeding without the fine being reexamined by a person.

Automated decision-making is prohibited by article 11, paragraph 6 of the Data Protection Act No. 101/2000 Coll currently in place.

• Right to lodge a complaint with a supervisory authority

The data subject shall have the right to lodge a complaint against the processing of their personal data by the data controller with a supervisory authority, specifically the Office for Personal Data Protection located at Pplk. Sochora 727/27, 170 00 Prague 7.

Contact

META, o.p.s. – Supporting educational opportunities

Address: Ječná 17, Prague 2, 120 00

E-mail: info@meta-ops.cz

Phone number: +420 773 304 464