Opens in a new tab

GDPR

Information on the Processing of Personal Data

Data Controller

The controller of personal data is:

Česká společnost pro právo životního prostředí (Czech Society for Environmental Law),
an association registered in the Register of Associations maintained by the Municipal Court in Prague, Section L, File No. 11036
Company Identification No. (IČO): 708 50 321
Registered office: náměstí Curieových 901/7, Staré Město, 110 00 Prague 1, Czech Republic
Email: damohors@prf.cuni.cz
Data box ID: 6wn3n53

(hereinafter referred to as the “Controller” or the “Czech Society for Environmental Law”).

Personal Data Protection Policy

In accordance with Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as the “GDPR”), the Controller hereby provides information on the processing of personal data relating to natural persons (hereinafter referred to as “Data Subjects”) and on their rights in connection with the processing of personal data under the GDPR and Act No. 110/2019 Coll., on the Processing of Personal Data, as amended (hereinafter referred to as the “Act”).

1. Purposes and Legal Bases of Personal Data Processing

The Controller processes personal data pursuant to Article 6(1) of the GDPR for the following purposes:

  1. performance of a contract to which the Data Subject is a party, or taking steps at the request of the Data Subject prior to entering into a contract;

  2. compliance with a legal obligation to which the Controller is subject;

  3. purposes of the legitimate interests pursued by the Controller; the Controller’s legitimate interests consist of carrying out its non-profit activities and providing information about those activities in its capacity as a non-governmental organisation operating in the field of environmental law;

  4. processing based on consent given by the Data Subject to the processing of their personal data for one or more specific purposes, for as long as such consent remains valid (e.g. registration for professional events).

Personal data are processed to the extent provided by the Data Subject to the Controller in connection with the establishment of a contractual or other legal relationship with the Controller, or for a specific purpose, or to the extent otherwise collected by the Controller and processed in accordance with applicable legislation or for the purpose of complying with the Controller’s legal obligations.

2. Sources of Personal Data

The Controller obtains personal data directly from Data Subjects, from publicly accessible registers, lists and records, or from third parties that have obtained the personal data in accordance with applicable legislation.

3. Categories of Personal Data

The personal data processed include, in particular:

  1. identification and contact details enabling the clear and unambiguous identification of the Data Subject (in particular, first name, surname, academic or professional titles, date of birth, address and occupation) and communication with the Data Subject (in particular, correspondence address, telephone number, email address and other similar information);

  2. other data necessary for the performance of a contract (information obtained by the Controller in connection with the performance of a contract);

  3. billing and payment details (bank account details).

4. Disclosure and Transfer of Personal Data to Third Parties and Third Countries

The Controller makes personal data available only to its authorised associates to the extent necessary to fulfil the purposes for which the personal data are processed. The Controller transfers certain personal data to third parties (so-called processors) where this is necessary for the Controller’s performance of a contract (in which case the Controller is responsible for ensuring that such third parties provide appropriate safeguards for the protection of personal data) or for compliance with the Controller’s legal obligations. Such third parties include natural and legal persons (in particular, publishers, mailing service providers, IT administrators, providers of information systems and data storage services, courts and public authorities).

Personal data are not transferred to third countries.

5. Duration of Processing and Retention of Personal Data

Personal data are processed only for as long as necessary, i.e. at least for the duration of the contractual relationship between the parties, for as long as consent remains valid, or for the duration of the Controller’s legal obligations or legitimate interests, as applicable.

Once personal data are no longer required for the purposes for which they are processed, they will be deleted without undue delay.

6. Automated Evaluation of Personal Data

Personal data are not subject to automated evaluation.

7. Rights of Data Subjects

The right of access to personal data means that the Data Subject has the right to obtain confirmation from the Controller as to whether or not personal data concerning them are being processed and, where that is the case, to obtain information about the personal data concerned and how they are processed.

The Data Subject also has the right to have inaccurate personal data concerning them rectified by the Controller without undue delay upon request. The Data Subject has the right to have incomplete personal data completed at any time.

The right to erasure of personal data requires the Controller to delete personal data concerning the Data Subject where the applicable conditions are met and the Data Subject requests such erasure.

The Data Subject has the right to object at any time to processing based on the legitimate interests of the Controller or a third party, or processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

The Data Subject has the right to withdraw their consent to the processing of personal data at any time where processing is based on consent.

If the Data Subject is dissatisfied in any way with the processing of their personal data by the Controller, they may raise objections with the Controller by writing to its registered office, sending a message to its data box or emailing damohors@prf.cuni.cz, or lodge a complaint with the supervisory authority, the Czech Office for Personal Data Protection.

The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data where such processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party.

8. Cookies

Information about cookies can be found here.