The CzechInvest Business and Investment Promotion Agency, with its registered office at Štěpánská 15, 120 00 Prague 2, ID No.: 71377999 (hereinafter referred to as the “Administrator”), as the administrator of personal data, hereby takes the liberty to inform the subjects with whom it comes into contact about the manner and scope of processing of personal data by the Administrator, including the scope of data rights related to the processing of their personal data.
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as GDPR), as well as in accordance with the relevant national data protection legislation. As a personal data controller, based on the obligation imposed by specific laws, the right to the protection of the private and personal life of the subject is respected when processing personal data.
Competence of the Data Controller and the resulting areas of purpose of the processing of personal data
On the basis of special legal regulations, the controller processes personal data necessary to identify the subject and to fulfil the legal obligations set out in the legislation within the areas of its competence, which are:
support for small and medium-sized entrepreneurs pursuant to Act No. 47/2002 Coll., on the support of small and medium-sized enterprises and on the amendment of Act No. 2/1969 Coll., on the establishment of ministries and other central bodies of state administration of the Czech Republic, as amended
support for entrepreneurs on the basis of programmes approved by the Government of the Czech Republic under a special law (e.g. Act No 218/2000 Coll. or the Programme for the Support of Business Real Estate and Infrastructure, etc.)
the functions of the designated organisation in the provision of investment incentives pursuant to Special Act No 72/2000 Coll., on investment incentives and on amendments to certain acts (Act on investment incentives), as amended
support for entrepreneurship, such as start-ups, in their growth on the domestic and foreign market, support for domestic subcontractors, cooperation with domestic and foreign entities and linking the private and public sectors, etc.
Legal titles for processing personal data
The Controller primarily uses legal titles to process personal data for the performance of a legal obligation, for the performance of tasks in the public interest or in the exercise of official authority and for the performance necessary for the performance of a contract. It may also use other legal titles such as consent to the processing of personal data provided by the subject, for the protection of the subject’s vital interests and for the legitimate interests of the Controller.
Categories of personal data:
Identification data (e.g. name, surname, title, date of birth, registration number, tax identification number, birth number)
contact data (e.g. permanent address, delivery address, email address, telephone number, data box)
payment details (e.g. bank account number)
other data necessary for the performance of the contract,
data provided in excess of the relevant laws and processed under the subject’s consent or on the basis of another legal title
The processing of personal data is carried out by the Administrator. The processing takes place by means of computer technology or manually for personal data in paper form, in compliance with all security principles for the management and processing of personal data.
The Controller obtains personal data mainly from subjects, from basic registers, from public administration information systems and from freely accessible public registers.
The processing period for personal data is derived from the time limits specified in the relevant contracts, in the Agency’s Records and Shredding Code or in the relevant legislation. It is the time necessary to ensure the rights and obligations arising from the contractual relationship and from the relevant legislation.
On the basis of the above, the personal data of the subject may only be transferred or disclosed to persons, authorities or institutions to whom such right derives from the above-mentioned regulation, law or public interest. There is no automated decision-making in the processing of personal data.
The controller shall process the data with the consent of the subject, except in the cases provided for by law where the processing of personal data does not require the consent of the subject.
Exercise of the subject’s rights
The rights of the subject are set out in particular in Chapter III of the GDPR and Article 81 and subsequently in Act No. 89/2012 Coll:
the right of access to personal data
the right to rectification, completion or erasure
the right to restriction
the right to data portability
the right to object
the right not to be subject to automated individual decision-making with legal or similar effects, including profiling
The above rights can be exercised by the subject, for example, using the form provided here .
The completed form can be delivered in the following ways:
in person or in writing to the Personal Data Protection Officer, CzechInvest Business and Investment Promotion Agency, Štěpánská 15, 120 00 Prague 2, ID No.: 71377999
electronically signed with a valid qualified signature to poverenec@mpo.cz
via data box – to ID: cyrj9gf
The subject also has the right to address his/her complaint to the supervisory authority at any time, which is: the Office for Personal Data Protection (pplk. Sochora 727/27, 170 00 Prague 7 – Holešovice).
Data Protection Officer (DPO)
In the event of a personal data breach, you can directly contact the Data Protection Officer of the Data Controller.
A request to exercise the rights of the subject can be submitted in the above manner or by directly contacting the Data Protection Officer (DPO). Jarmila Marta Šmardová (poverenec@mpo.cz).
This Personal Data Processing Declaration is publicly available on the Controller’s website and will be updated as necessary.
