GDPR

INFORMATION ON THE PROCESSING OF PERSONAL DATA AND NOTICE REGARDING RIGHTS RELATED TO THE PROTECTION OF PERSONAL DATA

1. Introductory Information

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, also known as the GDPR (General Data Protection Regulation), is a comprehensive set of rules for data protection in the EU. It takes effect on May 25, 2018. In the Czech Republic, selected provisions of this Regulation are contained in Act No. 110/2019 Coll. on the Protection of Personal Data, which took effect on April 24, 2019.

Overview of other legal norms governing the area of personal data protection:

Constitutional basis for personal data protection

Council of Europe Convention No. 108 of 1981
Article 8 of the Charter of Fundamental Rights of the EU
Article 16 of the Treaty on the Functioning of the European Union
Articles 7, 10(3), and 13 of the Charter of Fundamental Rights and Freedoms

General Personal Data Protection Regulations

Act No. 89/2012 Coll., the Civil Code

2. Identity and contact details of the controller and its representative:

Dopravní podnik Karlovy Vary, a.s. (hereinafter “DPKV”)

Registered office: Sportovní 656/1, Drahovice, 360 01 Karlovy Vary
Company ID No.: 48364282
Tax ID No.: CZ48364282
registered in the Commercial Register maintained by the Regional Court in Plzeň under file number B 341

Data Protection Officer:

Mgr. Petr Šindelář, LL.M.

Email: sindelar@sikosy.legal
Rules and scope of personal data processing at the company

DPKV processes your personal data to the extent necessary to provide the specific service you are using from DPKV. All processing is always carried out in accordance with the GDPR and applicable legislation, and only for a predetermined purpose and based on a relevant legal basis. The most common purposes of processing include, but are not limited to:

In doing so, DPKV ensures compliance with the fundamental principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, limited storage, integrity, confidentiality, and controller accountability. The rules for the processing of personal data are defined in the company’s internal guidelines.

DPKV processes personal data that falls into the following categories:

identification data;
address data;
descriptive data;
data on the use of services;
data on third parties (e.g., legal guardians in the case of minors).
DPKV does not process special categories of personal data, such as data on ethnic origin, political affiliation, religious affiliation, etc.

maintaining a registry of users of the Karlovy Vary Card system;
maintaining a registry of “fare evaders”;
issuing newsletters.

DPKV retains your personal data only for as long as strictly necessary and archives it in accordance with the statutory retention periods prescribed by law. DPKV processes data for the duration of the contractual relationship or other legal basis. Once the legal basis no longer applies, personal data is destroyed or anonymized. DPKV has strict internal rules in place to verify the lawfulness of holding personal data, and data is not retained longer than necessary for the purpose of processing.

DPKV also processes your personal data to safeguard DPKV’s legitimate interests, and such processing does not require the consent of data subjects. The existence of a legitimate interest is always carefully assessed.

3. Recipients and Processors

The personal data you have provided to DPKV is processed and stored primarily within DPKV. When processing certain data, DPKV also cooperates with external processors. Entities that cooperate with DPKV are carefully selected based on guarantees that ensure the technical and organizational protection of the personal data being transferred. Processors may process personal data for DPKV exclusively on the basis of a personal data processing agreement. Your data is transferred, for example, to the following processors:

Recipients of personal data may also include courts, bailiffs, public authorities, the Czech Police, etc. DPKV does not transfer data to third countries.

4. Information on the Rights of Data Subjects

If the processing of personal data is based on your consent to the processing of personal data, you have the right to withdraw this consent at any time.

You have the right to access personal data concerning you—you have the right to request information regarding whether and to what extent your personal data is being processed by DPKV. The company will provide you with copies or an extract of the personal data being processed.

You have the right to have DPKV correct inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

You have the right to have the data you provided to DPKV deleted based on your consent to the processing of personal data.

You have the right to have DPKV restrict the processing of personal data in the cases specified by the General Data Protection Regulation. You have the right to object to the processing of personal data concerning you if DPKV processes personal data for the following reasons:

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in DPKV,
processing is necessary for the purposes of the legitimate interests of DPKV or a third party,
for direct marketing purposes,
for the purposes of scientific or historical research or for statistical purposes.

The rights described above are processed upon your written request and upon verification of the provided identification data to prevent the disclosure of another person’s data. The aforementioned request may be submitted in person at the DPKV customer service center.

partners of the Karlovy Vary Card system (electronic money acceptors);
the operator of the Karlovy Vary Card Clearing Center;
the operator of the city computer network.

If you suspect that your personal data is not being handled in accordance with applicable legislation, you have the right to report this to a DPKV representative at the address listed above. If the situation is not remedied even after that, you are entitled to file a complaint with the supervisory authority, which is

Office for Personal Data Protection: Pplk. Sochora 27
170 00 Prague 7
phone: +420 234 665 111

Cookie Policy

What Are Cookies?

Cookies are very small text files that are stored on your device when you visit websites. We use cookies for various purposes and to improve your online experience on the website (for example, to remember your account login details).

While browsing our website, you can change your preferences and refuse certain types of cookies from being stored on your computer. You can also delete all cookies that are already stored on your computer, but please note that deleting cookies may prevent you from using parts of our website.

The cookies we use allow us to improve our website.