Mandatory disclosures

GDPR

Information on the processing of personal data

1. Introductory information

The Statutory City of Karlovy Vary – municipal police (hereinafter the "MPKV"), as the controller of personal data, hereby wishes to inform you, for the purpose of instructing data subjects and fulfilling the principle of transparency within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the "GDPR"), about the basic aspects of the processing of personal data that takes place within the activity of the controller, as well as about your rights as a data subject and the ways of exercising them.

2. Why do we process your personal data?

Within the activity of the organisation, personal data are processed above all for the following purposes: 
- fulfilment of the duties of the MPKV laid down by Act No. 553/1991 Sb., o obecní policii (on the municipal police), as amended, and by other generally binding legal regulations; 
- fulfilment of the statutory duties of the controller as an employer; 
- for the purposes of concluding and performing contracts; 
- protection of the property of the MPKV as a legitimate interest of the organisation; 
- marketing promotion of the MPKV; 
- provision of guarding and entry regimes for designated premises of the Statutory City of Karlovy Vary.

3. Consent to processing and how to withdraw it

Processing for the purposes of selected preventive activities, of the fulfilment of the statutory duties of the controller as an employer and of the marketing promotion of the MPKV is based on the consent of the data subject. If your consent was required when your data were obtained, you provide these data voluntarily for the purpose defined in the consent granted. 
You may withdraw the consent granted at any time. 
The withdrawal of consent does not, however, affect the lawfulness of the processing of personal data carried out before its withdrawal. You may withdraw consent in the same way in which it was granted – in writing, by delivery to the MPKV via the data box assigned to you, via a postal service provider or in person at the registry of Karlovy Vary City Hall (Moskevská 21, 360 01 Karlovy Vary), stating the data needed to identify the particular person and the consent being withdrawn.

4. How did we obtain your personal data?

Personal data are obtained by the MPKV as a rule directly from the data subject or their legal representative in the performance of tasks laid down by the relevant legal regulations, upon conclusion of a contract or upon a request for services. The MPKV also obtains some personal data from public registers, from state administration bodies or on the basis of special legal regulations. 
The MPKV also processes photographs taken at events organised by the MPKV. To a limited extent, these photographs may be published on the websites of the MPKV and of the Statutory City of Karlovy Vary and may be made available to a limited extent, having regard to their content, to media representatives (periodical press, television stations, Radniční listy). Photographs from events are taken and published on the basis of the consent or permission of the photographed persons, or under the news licence for reporting on the activity of the MPKV. 
The camera system operated by the MPKV is used for the purpose of supervising public order and for crime prevention. The image is recorded and the recording is retained for 20 days. The retained recordings are handed over only to courts and to bodies active in administrative or criminal proceedings, and that on the basis of a written request. The MPKV does not carry out any evaluation of the retained recordings.

5. To whom do we pass your personal data and why?

In order to secure the stated purposes, personal data may be processed, in addition to the MPKV and its employees, also by other persons – processors – on the basis of personal data processing agreements. 
On the basis of legal regulations, your personal data may also be passed on to other persons who may require them under generally binding legal regulations, or to whom the MPKV is obliged to pass these data in order to fulfil its legal duties arising from generally binding legal regulations. 
On the basis of the legitimate interest of the MPKV, some personal data may also be passed on to other persons as recipients of personal data, namely for the purposes of drawing a subsidy or of evidencing compliance with the conditions of a subsidy programme in respect of a subsidy already drawn.

6. Scope of the processing of personal data

In connection with the statutory tasks and activities of the MPKV, personal data are processed in accordance with the GDPR only to the extent necessary to fulfil the individual processing purposes, as a rule to the extent in which they were obtained from the data subjects. Once the stated purpose has been fulfilled, the personal data are stored in accordance with the generally binding legal regulations. For data obtained from third parties or from other sources, the scope of the data is stated in part 3. of this information.

7. How long do we retain your data?

In accordance with the principles of the GDPR, personal data in a form which permits your identification are retained for the period necessary to fulfil the stated purposes, in accordance with the time limits set out in the relevant generally binding legal regulations, contracts, internal regulations concerning the MPKV or in the consent granted (if it is granted only for a limited period). Once the purpose of processing has been fulfilled, the processing of personal data is terminated; documents subject to archiving are, however, further retained for archiving purposes in accordance with the relevant generally binding legal regulations and the current Filing and Shredding Rules of the MMKV. Some data may also be retained further for the strictly necessary period for the purposes of protecting the legitimate interests of the MPKV, above all for the purposes of asserting or enforcing legal claims of the MPKV.

8. Your rights

As a data subject you have, in addition to the general right to information about processing, the following rights, the exercise of which the controller fully respects:

  • The right to rectification or completion of inaccurate or incomplete personal data concerning you. 
  • The right to erasure of the personal data processed, that is the "right to be forgotten". This right means the obligation of the controller to destroy your personal data if at least one of the following conditions is met:
    • the personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
    • the data subject withdraws consent and there is no other legal ground for the processing,
    • the data subject objects to the processing and there are no overriding legitimate grounds for the processing,
    • the personal data have been unlawfully processed,
    • the personal data must be erased in order to comply with a legal obligation,
    • the personal data have been collected in relation to the offer of information society services (on the internet) on the basis of the consent of a child.

The right to erasure is not, however, an absolute right, and the GDPR regulates a number of circumstances in which erasure will not take place despite the facts stated above. 
The right to erasure will not be applied in cases where the processing is necessary:

  • for exercising the right of freedom of expression and information,
  • for compliance with a legal obligation, or for the performance of tasks carried out in the public interest or in the exercise of official authority,
  • for reasons of public interest in the area of public health,
  • for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes,
  • for the establishment, exercise or defence of legal claims.

In the case of a request for erasure, you will always be informed whether erasure has taken place and, if not, for what reason.

• The right of access to personal data; the right of access means the entitlement of the data subject to obtain from the controller, upon request, information (confirmation) as to whether or not their personal data are being processed and, if they are being processed, the data subject has the right to obtain those personal data and at the same time has the right to obtain the following information:

  • the purposes of the processing,
  • the categories of personal data concerned,
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed,
  • the envisaged period for which the personal data will be stored,
  • the existence of the right to request from the controller rectification or erasure of personal data, as well as of the right to restrict the processing of personal data and of the right to object to the processing of personal data,
  • the right to lodge a complaint with a supervisory authority,
  • all available information as to the source of the personal data where they are not collected from the data subject,
  • the fact that automated decision-making, including profiling, takes place.

• The right to portability of personal data; the essence of this right is the possibility, under certain conditions, of obtaining the personal data concerning you which you have provided to the controller, in a structured, commonly used and machine-readable format, and the right to request that these data be transmitted to another controller. The conditions for applying this right are as follows:

  • the processing must be based on your consent or be for the purpose of performing a contract, and
  • the processing is carried out by automated means.

Within the activity of the MPKV there is no processing that would allow this right to be applied.

The right to object to the processing of personal data with the controller on grounds relating to the particular situation of the data subject; you may object to the processing of personal data that takes place on the following legal grounds:

  • the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
  • the processing is necessary for the purposes of the legitimate interests of the controller concerned or of a third party.

Where an objection is raised, the controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

The right to request restriction of the processing of personal data; restriction of processing is a situation in which your stored personal data are marked with the aim of limiting their processing in the future; data in respect of which processing has been restricted may be processed by the controller, apart from their storage, only with your consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. You have the right to restriction of processing in the following cases:

  • if you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
  • you have objected to the processing, for the period until it is verified whether the legitimate grounds of the controller override your legitimate grounds.
  • the processing is unlawful and you oppose the erasure of the personal data and request instead the restriction of their use;
  • the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims.

• The right to withdraw consent at any time, if your personal data are processed on the basis of your consent. 
• The right to be informed of a personal data breach in cases where a breach of security has occurred and it is likely that such a personal data breach will result in a high risk to the rights and freedoms of natural persons. 
• The right to lodge a complaint; in the event of a breach of the statutory duties relating to the protection of personal data, you have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů). 
• The right not to be subject to any decision based solely on automated decision-making; this right ensures that, as a data subject, you will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, with the exceptions set out in Article 22(2) of the GDPR.

In its activity the MPKV does not use processing of personal data based on automated decision-making or profiling.

9. How can you exercise your rights?

You may exercise your rights by means of a request which may be submitted:

• via a data box; 
• by e-mail, whereby, in order to prove your identity, the request must bear a recognised electronic signature; 
• in paper form; 
• in person at the MPKV (Moskevská 34, 360 01 Karlovy Vary), where, in order to confirm your identity, you may be asked to present your identity document,

Confirmation of your identity is required in order to ensure that the rights are not misused by other persons, and also so that personal data are not provided to another person without authorisation. 
In the case of a request for the exercise of your rights under the preceding article, the information on the measures taken will be provided to you without undue delay, in any event within one month of receipt of the request. That period may, however, be extended by a further two months where necessary and taking into account the complexity and number of requests. You will be informed of the extension of the period and of the reasons for such extension within one month of the submission of the request. Should the controller not take the measures you request, you will be informed of that fact without delay and at the latest within one month of receipt of the request, including the reasons for not taking the measures. In such a case you have the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy. 
All requests for the exercise of rights under the preceding article will be handled free of charge.

10. How to contact us?

Contact details of the controller of personal data: 
Statutární město Karlovy Vary – městská policie (Statutory City of Karlovy Vary – municipal police) 
Moskevská 2035/21 
360 01 Karlovy Vary 
IČ (company identification number): 00254657 
Data box ID: a89bwi8

The person responsible for the MPKV is Mgr. Stanislav Makovička.

Contact details of the data protection officer: 
Luděk Nezmar, e-mail:  nezmar@!zilch!acresia.com , Acresia Consulting s.r.o., Praha 1, Kaprova 42/14, data box ID: 33kj4zr  

 

 

GENERAL INFORMATION ON THE PROCESSING OF PERSONAL DATA

The controller of your personal data is the Karlovy Vary Municipal Police. We process personal data in accordance with the requirements of Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the "General Data Protection Regulation" or "GDPR"), and we hereby inform you that:

The contact address of the controller is:

Statutory City of Karlovy Vary, Karlovy Vary Municipal Police (Statutární město Karlovy Vary, Městská policie Karlovy Vary)

Registered office: Karlovy Vary, Moskevská 913/34, telephone: +420 353 153 911, e-mail: posta@!zilch!mpkv.cz, Data box ID: a89bwi8

The contact address of the data protection officer is:

Luděk Nezmar, nezmar@!zilch!acresia.com, Acresia Consulting s.r.o., Praha 1, Kaprova 42/14, data box ID: 33kj4zr

As the controller, we process your personal data for the purpose of securing local public order matters and performing further tasks within the Statutory City of Karlovy Vary under Act No. 553/1991 Sb., o obecní policii (on the municipal police, hereinafter the "ZOP"), as amended, or under a special act; these consist in particular of the following activities:

a) contributing to the protection and safety of persons and property,

b) supervising compliance with the rules of civic coexistence,

c) supervising compliance with the generally binding by-laws and regulations of the municipality,

d) participating – to the extent laid down by the ZOP or by a special act – in the supervision of the safety and smoothness of traffic on roads,

e) participating in compliance with the legal regulations on the protection of public order and, within the scope of its duties and powers laid down by the ZOP or by a special act, taking measures to restore it,

f) participating in crime prevention in the municipality,

g) supervising compliance with cleanliness in public spaces in the municipality,

h) detecting minor offences the handling of which falls within the competence of the municipality,

i) processing data for the purpose of providing statistical information to the Ministry of the Interior at its request under the ZOP.

On the basis of a contractual arrangement or another legal act, we also participate in the processing of personal data of other controllers. In this activity we always follow the instructions given to us by the controller and comply with all further requirements imposed on processors by the applicable legal regulations. The activities in which we act in the role of processor are listed below.

We collect the personal data necessary for processing for the individual processing purposes and process them further in particular because they are necessary for compliance with a legal obligation to which we are subject, or for the performance of tasks carried out in the public interest or in the exercise of official authority vested in us.

In order to ensure the above obligations, in particular the preventive ones, we operate and use technical means, including camera systems with recording.

In our legitimate interest we keep a record of visitors entering our premises; furthermore, in selected premises marked at the entrance with a pictogram and supplementary information, the protection of property and persons is ensured by means of a local camera system with recording operated by us.

We pass your personal data on to the Police of the Czech Republic, to the bodies of the municipality and to other public authorities, but only in cases where this is necessary for the performance of their tasks in accordance with Section 24a of the ZOP. We do not pass personal data on to other persons unless the obligation to do so is imposed on us by a special legal regulation or unless the data subject has given consent to it.

When processing personal data we do not use any automated decision-making system on the basis of which acts or decisions would be taken that would interfere with your rights or legitimate interests.

We process your personal data only for the period necessary, which follows from special legal regulations. Once that period has expired, the personal data are destroyed or retained for the period laid down by the applicable Filing and Shredding Rules of the Statutory City of Karlovy Vary, issued in accordance with Act No. 499/2004 Sb., o archivnictví a spisové službě (on archiving and records management), as amended.

In connection with the processing of your personal data you have the right of access to your personal data, to their rectification or erasure, or to restriction of processing, the right to object to their processing, where applicable the right to data portability and further rights under the General Data Protection Regulation.

You may exercise your rights with the Karlovy Vary Municipal Police in the following ways:

1. in electronic form via the data box of the applicant,

2. in electronic form by e-mail bearing a qualified or advanced electronic signature of the applicant, sent to the electronic registry of the Statutory City of Karlovy Vary,

3. by handing over a written request in person at the registry of the Statutory City of Karlovy Vary in the city hall building, Moskevská 2035/21, subject to identification of the applicant by an identity document (identity card or travel document) verified by an authorised employee of Karlovy Vary City Hall.

4. in writing to the address of the Karlovy Vary Municipal Police

In the case of a submission made in person or in writing, please note that the reply must be collected in person at the registry of the Karlovy Vary Municipal Police, subject to identification of the applicant.

We will always duly assess and settle your requests in accordance with the relevant provisions of the GDPR. Should you disagree with the way your requests and applications have been settled, you have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

Date of publication: in Karlovy Vary on 14 June 2022