ČD Points Loyalty Programme Privacy Policy

We process personal data solely on the basis of, and in the extent permitted by, Regulation of the European Parliament and Council No. 2016/679, on personal data protection and related regulations. This also applies to all processors that process personal data in accordance with our instructions.

You will find all the information concerning personal data processed by ČD, as well as updates to these terms and conditions, on www.cd.cz/pravasubjektu.

PERSONAL DATA CONTROLLER – ČD

The controller of personal data processed in connection with ČD Points – a loyalty programme connected with the Portal (a set of webpages, mobile applications and services located on the web address www.cd.cz) – is the company České dráhy, a.s., ID No. 709 94 226, with Registered Office at Nábřeží L. Svobody 1222, 110 15 Praha 1, Czech Republic, registered in the Commercial Registry maintained by the Municipal Court in Prague, Section B, rider 8039.

DATA PROTECTION OFFICER

Regarding matters related to the processing of personal data, you can contact the personal data protection officer at ČD on tel. 221 111 122 or by e-mail on dpo@cd.cz.

PURPOSES OF PROCESSING AND THEIR LEGAL BASIS

The data which you already provided during registration in the Portal – name, surname, e-mail address, password, travel document purchase data, their type, purchase frequency, discounts used, and
possibly other data depending on your service and application settings in the Portal, i.e. mobile telephone number, identification card number, registered In Karta card number, place and time preferences for track closures, data in connection with activation of the ČD Points loyalty programme (age category, date of birth, sociodemographic data, telephone number)
– are processed together with your details concerning drawing ČD Points loyalty programme benefits exclusively for these purposes:

… in order to fulfil our responsibilities under the Contract on Participation in the ČD Points Loyalty Programme

CONSENT

These data – the use of travel documents for a specific train connection, the time and place of such connection, including information about the inspection of the travel document and the selected carriage class – are processed only if you grant us your consent to do so and exclusively for these purposes:

For marketing purposes, we use profiling, i.e. a method of automatically processing personal data which evaluates aspects of the customer and enables us to create offerings of products or services tailored to specific customers by using data about their travel behaviour over and above their basic data. You can elect not to receive commercial offers at any time and free of charge, however, by using a link found in every e-mail.

… so that we can send you only commercial offers and discounts tailored to your previous travel preferences and spare you from receiving offers that most likely are not of any interest to you

The granting of consent is completely voluntary. It is thus completely up to you whether you provide us your personal data in exchange for a discount in the form of collected loyalty points, or whether you will use our services without limitation but also without the ability to take advantage of the benefits offered by this programme. If you do not wish to grant your consent, then you cannot participate in the ČD Points loyalty programme.

Right to revoke consent

You can revoke your consent at any time in the Portal in your user profile. Consent to the processing of personal data is a condition of participation in the ČD Points loyalty programme, however, and thus in the event of full or even partial revocation of your consent we will not be able to provide you with the benefits of this programme.

RECIPIENTS OF PERSONAL DATA

We provide personal data exclusively to:

• the administrators of our information systems where personal data are processed.

A list of all processors is available on https://www.cd.cz/assets/info/cim-se-ridime/zpracovatele-osobnich-udaju.pdf.

Personal data can also be provided to public authorities, should this be required by legislation, if doing so is essential to protect against unjustified harm to another’s freedom, life, health or ownership.

DURATION OF STORAGE

We will terminate the processing of personal data as soon as your contractual relationship with ČD based on the contract (consent to the Rules of the ČD Points Loyalty Programme) ends.

CUSTOMERS’ RIGHTS

You have the following rights vis-à-vis us concerning your personal data:

Access to personal data

You have the right to know whether we are processing your personal data, as well as the right to receive a copy of your personal data and the details of such processing. In addition, you have the right to access a catalogue of your rights – to correction, erasure, limitations on processing, to raise an objection, to lodge a complaint with a supervisory authority.

Correction of personal data

You have the right to correct inaccurate personal data and to supplement incomplete personal data. This means, for example, that whenever you change your e-mail address or telephone number we will always update it immediately so as to ensure problem-free communication. Therefore, please always inform us of changes to your personal information.

Limitation of processing

You have the right to have us limit the processing of personal data to its storage and evident differentiation from other processed personal data if you believe that:

• the personal data are not accurate
• the processing of the personal data is illegal, but you do not wish to erase them
• you need your personal data for the establishment, exercise or defence of legal claims, even though ČD no longer needs them
• you object to the legitimacy of our interest in processing such data, for the duration of the period in which ČD will analyse the legitimacy of such interest

Erasure of personal data

You have the right to “be forgotten”, i.e. the right to have us erase all your personal data once they are no longer necessary for the purposes for which they were processed and there is no legal basis for further processing, and of course also if your personal data were processed illegally. We will also erase your personal data if they are being processed on the basis of consent and you revoke such consent. They will further be erased if you raise an objection to such processing and we conclude that our legitimate interest does not outweigh your interest in terminating such processing (in cases where your personal data are processed on the basis of our legitimate interest), or if you raise an objection to such processing for purposes of direct marketing. We will also erase your personal information if we are ordered to do so in accordance with the law.

Your personal data cannot be erased, however, if there exist reasons for which it is possible to continue processing despite your request, in particular the need for further processing for the establishment, exercise or defence of our legal claims, the fulfilment of our legal responsibilities or the exercise of rights to the freedoms of speech and information, as well as for scientific or historical research or for statistical or archiving purposes in the public interest. Unless further processing is essential, however, we will grant your request immediately.

Portability

You have the right to “take away” your personal data from us and give them to a different controller. In this manner, it is possible to transfer all the personal data that we process by automated means on the basis of your consent or a contract. We will make available all data to you or to a new controller in a structured, commonly used and machine-readable format. Completing the transfer process is the responsibility of your new controller and its technical facilities, however. Simply put, we cannot guarantee that the new controller will be able to read and work with your personal data.

Revocation of consent

If we are processing your personal data on the basis of your consent, you can simply revoke such consent at any time. As soon as we receive your revocation of consent, we will no longer process your personal data for these purposes. For more information, see the chapter on consent. You will find the procedure for revoking consent in the chapter on exercising customers’ rights.

Lodging a complaint with a supervisory authority

If you are convinced that your rights under legislation have been violated, you can address a complaint directly to the supervisory authority in certain EU member states, in particular in the member state of your normal residence, your place of employment, or the place where the alleged violation occurred. The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

EXERCISING CUSTOMERS’ RIGHTS

Customers’ rights concerning personal data can be exercised at any time in the manners specified below, which will ensure that your request is handled as quickly as possible:

1. www.cd.cz/kontaktni-formular
2. data message sent to ID: e52cdsf
3. written letter sent to České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic
4. e-mail sent to dpo@cd.cz
5. in person at the address České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic

For exercising your rights, we have prepared the Form for Exercising Customer’s Rights Concerning Personal Data, but you can also send us your request in your own format. In order to grant your requests, however, we must first and foremost verify that the person submitting the request is really you. This is the only way to prevent the abuse of your personal data by a third party, an irreversible change to your personal data, or even their loss. Documents uploaded to our website or sent by e-mail must therefore be accompanied by your guaranteed electronic signature. If you are an In Karta cardholder, you can upload documents to the Portal without this signature. You can also send documents as letters sent by post, to which you affix your officially certified signature. On the e-mail subject line or envelope, please always write “GDPR”.

If you exercise your rights in person in the filing room (“Podatelna”) at our headquarters at České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic, only an identification document issued by a state administrative body will be required to verify your identity.

Although we want to make it as easy as possible for you to exercise your rights, we must eliminate the risk of illegitimate interventions into the processing of your personal data. Therefore, if we have doubts as to whether such a request is being submitted by you, we will ask you to provide additional information.

NOTICE CONCERNING THE CONSEQUENCES OF SUCCESSFULLY EXERCISING CUSTOMERS’ RIGHTS

In order for us to discharge our legal responsibilities or to fulfil a contract that we are to conclude with you, it is essential that you provide most of the personal data we process. It is therefore your responsibility to provide these personal data to us. If you do not do so, we will be unable to make the requested service available to you.

If a request to erase all personal data for all specified purposes is granted, this will result, like a request to revoke consent, in the termination of the contractual relationship between the customer and ČD established by the Contract on Participation in the ČD Points Loyalty Programme, as well as the termination of contractual relationships conditioned by this contract. Thus, we will no longer be able to provide you with the benefits of this programme.