Information on the Processing of Personal Data

Personal Data

Whenever a relationship is established with the Institute of Information Theory and Automation of the Czech Academy of Sciences, Public Research Institution, with its registered office at Pod Vodárenskou věží 1143/4, 180 00 Prague 8, Czech Republic (hereinafter referred to as the "Institute"), under which your personal data are processed, The Institute acts as the controller of such personal data (hereinafter referred to as the "personal data").

How Can You Contact the Controller Regarding the Processing of Your Personal Data?

Employees of The Institute are governed by the Institute's internal policies and procedures concerning the processing of their personal data, which are available on the Institute's intranet.

All other data subjects may contact the Institute at gdpr@utia.cas.cz to inquire whether The Institute processes their personal data and, if so, to what extent. This email address may also be used to exercise the rights of data subjects under the GDPR and to submit any other inquiries relating to the protection of personal data.

For What Purposes Are Personal Data Processed?

The Institute processes personal data primarily for the following purposes:

• Compliance with the Institute's legal obligations;

• Entering into and performing contracts;

• Administration of human resources and payroll;

• Managing operational, financial, and administrative activities;

• Conducting research, project, publication, and educational activities;

• Communicating with collaborators, institutions, suppliers, and other partners;

• Protecting the Institute's rights and legitimate interests.

What Is the Legal Basis for Processing Personal Data?

Personal data are processed primarily on the basis of:

• Compliance with a legal obligation applicable to the controller;

• Performance of a contract or implementation of measures taken prior to entering into a contract;

• The legitimate interests of the controller or a third party;

• Performance of a task carried out in the public interest, where applicable;

• The data subject's consent, where processing is based on consent.

Where processing is based on consent, the data subject has the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

What Personal Data May Be Processed?

The categories of personal data processed depend on the specific relationship between the data subject and the Institute. Such data may include, in particular:

• Identification data;

• Contact information;

• Data relating to contractual or employment relationships;

• Data necessary for compliance with legal obligations;

• Data relating to participation in projects, research, professional, or organizational activities;

• Information contained in communications with the controller.

To Whom May Personal Data Be Disclosed?

Personal data may be disclosed or transferred, to the extent necessary, in particular to:

• Public authorities, where required by law;

• The Institute's founder or funding providers, where necessary;

• Contractual partners and service providers;

• Data processors providing professional, administrative, technical, or other services on behalf of the Institute;

• Other persons where necessary to fulfill the purpose of processing or to protect the controller's rights.

Are Personal Data Transferred to Third Countries?

Personal data are not transferred to third countries or international organizations unless such transfer is necessary for a specific processing purpose and the conditions laid down by the GDPR have been satisfied.

How Long Are Personal Data Retained?

Personal data are retained only for as long as necessary to fulfill the purposes for which they were collected, and thereafter for the period required by applicable law or for as long as necessary to protect the rights and legitimate interests of the controller.

What Are Your Rights?

Subject to the conditions set forth in the GDPR, data subjects have the right to:

• Obtain access to their personal data;

• Request correction of inaccurate or incomplete personal data;

• Request erasure of personal data;

• Request restriction of processing;

• Object to processing;

• Request data portability, where the conditions of the GDPR are met;

• Not be subject to a decision based solely on automated processing, including profiling;

• Withdraw consent where processing is based on consent.

Right to Lodge a Complaint

If a data subject believes that the processing of their personal data violates the GDPR, they have the right to lodge a complaint with the Czech Office for Personal Data Protection.

Automated Decision-Making

The Institute does not carry out automated individual decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects them, unless the data subject is informed otherwise in a specific case.