We process personal data solely on the basis of, and in the extent permitted by, Regulation of the European Parliament and Council No. 2016/679, on personal data protection and related regulations. This also applies to all processors that process personal data in accordance with our instructions.
You will find all the information concerning personal data processed by ČD, as well as updates to these terms and conditions, on www.cd.cz/pravasubjektu.
PERSONAL DATA CONTROLLER – ČD
The controller of personal data processed in connection with ČD Credit – a payment means connected with the Portal (a set of webpages, mobile applications and services located on the web address www.cd.cz) – is the company České dráhy, a.s., ID No. 709 94 226, with Registered Office at Nábřeží L. Svobody 1222, 110 15 Praha 1, Czech Republic, registered in the Commercial Registry maintained by the Municipal Court in Prague, Section B, rider 8039.
DATA PROTECTION OFFICER
Regarding matters related to the processing of personal data, you can contact the personal data protection officer at ČD on tel. 221 111 122 or by e-mail on dpo@cd.cz.
PURPOSES OF PROCESSING AND THEIR LEGAL BASIS
The data which you already provided during registration in the Portal – name, surname, e-mail address, password, travel document purchase data, their type, purchase frequency, discounts used, and
possibly other data depending on your service and application settings in the Portal, i.e. mobile telephone number, identification card number, registered In Karta card number, customer’s company data (name, address, telephone number), place and time preferences for track closures
– are processed together with your PIN for payment verification, your answers to control questions to unblock your ČD Credit account, your ČD Credit customer account number, your ČD Credit account available balance, and your ČD Credit account transaction overview, exclusively for these purposes:
- rendering deposits (of prepaid credit) for future purchases of ČD products and services and for their realisation
- exercising customers’ rights under the transport contract, in particular collecting information for control purposes and making possible an objective assessment of the legitimacy of any non-use (partial non-use) of a service on the part of the customer
… in order to fulfil our responsibilities under the Contract on the Establishment and Use of a ČD Credit Account
- exercising rights under the transport contract, in particular collecting information for control purposes and making possible an objective assessment of the legitimacy of any non-use (partial non-use) of a service on the part of the customer
- preservation of tax receipts for the needs of the tax administrator
- preservation of accounting documents of a non-tax character
… in order to fulfil our responsibilities under legislation
RECIPIENTS OF PERSONAL DATA
Osobní údaje poskytujeme výhradně:
- the administrators of our information systems where personal data are processed.
A list of all processors is available on https://www.cd.cz/assets/info/cim-se-ridime/zpracovatele-osobnich-udaju.pdf.
Personal data can also be provided to public authorities, should this be required by legislation, if doing so is essential to protect against unjustified harm to another’s freedom, life, health or ownership.
DURATION OF STORAGE
We will terminate the processing of personal data as soon as your contractual relationship with ČD based on the Contract on the Establishment and Use of a ČD Credit Account ends. We will terminate the archiving of data specified on travel documents (tax receipts) after 10 years have passed since their date of issue. We will terminate the archiving of data specified in an affidavit possibly granted on the occasion of the unblocking of the service and accounting documents after 5 years have passed. In the event that the purpose of the processing lapses earlier, then we will terminate the processing of your personal data for this defunct purpose prior to the termination of the contractual relationship.
CUSTOMERS’ RIGHTS
You have the following rights vis-à-vis us concerning your personal data:
Access to personal data
You have the right to know whether we are processing your personal data, as well as the right to receive a copy of your personal data and the details of such processing. In addition, you have the right to access a catalogue of your rights – to correction, erasure, limitations on processing, to raise an objection, to lodge a complaint with a supervisory authority.
Correction of personal data
You have the right to correct inaccurate personal data and to supplement incomplete personal data. This means, for example, that whenever you change your e-mail address or telephone number we will always update it immediately so as to ensure problem-free communication. Therefore, please always inform us of changes to your personal information.
Limitation of processing
You have the right to have us limit the processing of personal data to its storage and evident differentiation from other processed personal data if you believe that:
- the personal data are not accurate
- the processing of the personal data is illegal, but you do not wish to erase them
- you need your personal data for the establishment, exercise or defence of legal claims, even though ČD no longer needs them
- you object to the legitimacy of our interest in processing such data, for the duration of the period in which ČD will analyse the legitimacy of such interest
Erasure of personal data
You have the right to “be forgotten”, i.e. the right to have us erase all your personal data once they are no longer necessary for the purposes for which they were processed and there is no legal basis for further processing, and of course also if your personal data were processed illegally. We will also erase your personal data if they are being processed on the basis of consent and you revoke such consent. They will further be erased if you raise an objection to such processing and we conclude that our legitimate interest does not outweigh your interest in terminating such processing (in cases where your personal data are processed on the basis of our legitimate interest), or if you raise an objection to such processing for purposes of direct marketing. We will also erase your personal information if we are ordered to do so in accordance with the law.
Your personal data cannot be erased, however, if there exist reasons for which it is possible to continue processing despite your request, in particular the need for further processing for the establishment, exercise or defence of our legal claims, the fulfilment of our legal responsibilities or the exercise of rights to the freedoms of speech and information, as well as for scientific or historical research or for statistical or archiving purposes in the public interest. Unless further processing is essential, however, we will grant your request immediately.
Portability
You have the right to “take away” your personal data from us and give them to a different controller. In this manner, it is possible to transfer all the personal data that we process by automated means on the basis of your consent or a contract. We will make available all data to you or to a new controller in a structured, commonly used and machine-readable format. Completing the transfer process is the responsibility of your new controller and its technical facilities, however. Simply put, we cannot guarantee that the new controller will be able to read and work with your personal data.
Lodging a complaint with a supervisory authority
If you are convinced that your rights under legislation have been violated, you can address a complaint directly to the supervisory authority in certain EU member states, in particular in the member state of your normal residence, your place of employment, or the place where the alleged violation occurred. The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).
EXERCISING CUSTOMERS’ RIGHTS
Customers’ rights concerning personal data can be exercised at any time in the manners specified below, which will ensure that your request is handled as quickly as possible:
- www.cd.cz/kontaktni-formular
- data message sent to ID: e52cdsf
- written letter sent to České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic
- e-mail sent to dpo@cd.cz
- in person at the address České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic
For exercising your rights, we have prepared the Form for Exercising Customer’s Rights Concerning Personal Data, but you can also send us your request in your own format. In order to grant your requests, however, we must first and foremost verify that the person submitting the request is really you. This is the only way to prevent the abuse of your personal data by a third party, an irreversible change to your personal data, or even their loss. Documents uploaded to our website or sent by e-mail must therefore be accompanied by your guaranteed electronic signature. If you are an In Karta cardholder, you can upload documents to the Portal without this signature. You can also send documents as letters sent by post, to which you affix your officially certified signature. On the e-mail subject line or envelope, please always write “GDPR”.
If you exercise your rights in person in the filing room (“Podatelna”) at our headquarters at České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic, only an identification document issued by a state administrative body will be required to verify your identity.
Although we want to make it as easy as possible for you to exercise your rights, we must eliminate the risk of illegitimate interventions into the processing of your personal data. Therefore, if we have doubts as to whether such a request is being submitted by you, we will ask you to provide additional information.
NOTICE CONCERNING THE CONSEQUENCES OF SUCCESSFULLY EXERCISING CUSTOMERS’ RIGHTS
In order for us to discharge our legal responsibilities or to fulfil a contract that we are to conclude with you, it is essential that you provide most of the personal data we process. It is therefore your responsibility to provide these personal data to us. If you do not do so, we will be unable to make the requested service available to you.
If a request to erase all personal data for all specified purposes is granted, this will result in the termination of the contractual relationship between the customer and ČD established by the Contract on the Establishment and Use of a ČD Credit Account, as well as the termination of contractual relationships conditioned by this contract. Thus, we will no longer be able to provide you with the ČD Credit service.