Pribram.eu About the town Data Protection

O městě Ochrana osobních úda.

Data Protection

Information on the processing of personal data and guidance on the rights of data
subjects INFORMATION MEMORANDUM

Town of Příbram
Town Hall address: Tyršova 108, 261 19 Příbram
Company registration number: 002 43 132

The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) of the Treaty on the Functioning of the European Union recognise the right of every person to the protection of personal data concerning them. The processing of personal data of natural persons (‘data subjects’) by the Data Controller is carried out for the benefit of those persons. However, the right to the protection of personal data is not an absolute right; it must be assessed in the context of its function in society and, in accordance with the principle of proportionality, must be balanced against other fundamental rights.

The Data Controller processes personal data and other information relating to citizens and other data subjects within the scope of its independent and delegated powers. Most of the data subjects’ personal data is therefore processed on the basis of obligations imposed on the Municipal Authority by specific laws or, where applicable, by contracts. Such processing of personal data relating to data subjects is not subject to the requirement to obtain the consent of those individuals. Where certain personal data are processed outside the scope of a statutory obligation, such processing is subject to the consent of the citizens. However, the District Office carries out such processing only in exceptional cases (e.g. when organising events where prior registration is required).

The protection of personal data applies to both automated and manual processing of personal data. In the principles and rules for the protection of natural persons which the Municipal Authority applies in connection with the processing of a data subject’s personal data, the Municipal Authority respects their fundamental rights and freedoms, in particular the right to the protection of personal data. The Data Controller respects the rights of citizens as guaranteed by law, such as the right to know and be informed, in particular regarding the purpose for which personal data are processed and, where applicable, the period for which they will be retained. The principles of personal data protection apply to all information relating to an identified or identifiable natural person. The Data Controller lawfully processes personal data because such processing is necessary for the performance of tasks carried out in the public interest or in the exercise of official authority vested in the Data Controller, or on the grounds of the legitimate interests of the Data Controller or a third party. The Municipal Authority processes citizens’ personal data in accordance with the purposes of processing and in compliance with the applicable legislation on the protection of personal data, in particular Act No. 110/2019 Coll., on the Protection of Personal Data, as amended, and EU Regulation 2016/679 (General Data Protection Regulation – GDPR). Nevertheless, every data subject has the right to object to the processing of personal data relating to their specific situation. The Data Controller will then demonstrate to the data subject the seriousness and legitimacy of the Data Controller’s interests, which do not interfere with the interests or fundamental rights and freedoms of the data subject.

How we process personal data

The processing of personal data by the Data Controller is carried out in a lawful and fair manner; it is transparent to data subjects; and information and all communications relating to the processing of such personal data are easily accessible, comprehensible and provided in clear and simple language. When processing personal data on the basis of a natural person’s consent, those individuals are made aware of any risks arising from the processing, as well as the rules, safeguards and rights that exist in connection with the processing of their personal data. The purposes for which personal data are processed are unambiguous and legitimate, and are specified at the time the personal data are collected. The scope of the personal data collected is always proportionate, relevant and limited to the data necessary to fulfil the specified purpose. Likewise, the period for which personal data is retained is limited to the strict minimum. In all processing of personal data, measures are applied to ensure the appropriate security and confidentiality of such data (e.g. measures to prevent unauthorised access to personal data and to the equipment used for its processing).

The OÚ controller, as the data controller within the meaning of Article 4(7) of Regulation (EU) (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), is responsible for any processing of personal data and, based on an assessment of the likely and significant risks associated with such processing, has implemented appropriate and effective technical and organisational measures to ensure the protection of personal data. The measures for safeguarding personal data also include regular training for staff who process personal data. Staff at all levels are required to adopt a responsible, proactive and creative approach and to comply with the rules governing personal data security systems.

In connection with the transition to the new EU data protection legislation, i.e. EU Regulation 2016/679 (GDPR), the Data Controller carried out a new data protection impact assessment of all processing activities, with the aim of assessing the specific likelihood and severity of risks. In carrying out this assessment, the Data Controller took into account the nature, scope, context and purposes of the processing, as well as the sources of risk. The measures to secure systems, information, data and personal data, and the specific technical, organisational and security measures which the Data Controller has adopted and is continually refining to ensure compliance with the EU Regulation have been further elaborated in this context in the Data Controller’s internal documents and guidelines. These measures also include the appointment of a Data Protection Officer.

What personal data do we process?

Verification of signatures and documents in accordance with Act No. 21/2006 Coll., on verification, as amended

• Purpose of processing: signature verification procedures • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

CzechPOINT

• Purpose of processing: issuing extracts in accordance with Act No. 365/2000 Coll., on public administration information systems, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Provision of information pursuant to Act No. 106/1999 Coll., on Free Access to Information, as amended

• Purpose of processing: provision of information to members of the public pursuant to Act No. 106/1999 Coll., on Free Access to Information, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Citizens’ complaints

• Purpose of processing: receipt and handling of complaints, in accordance with Section 102(2)(n) of Act No. 128/2000 Coll., on municipalities • Categories of personal data: address and identification data • Categories of data subjects: customers (clients) of the data controller • Categories of data recipients: the data controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Recruitment procedures for job vacancies

• Purpose of processing: keeping a register of applicants for recruitment procedures, in accordance with Act No. 312/2002 Coll., on officials of local government units and amending certain acts, as amended, and Act No. 553/1991 Coll., on the municipal police, as amended, and for job vacancies where the District Authority has the competence and authority to fill the post • Categories of personal data: address and identification data; special categories of data – criminal history, good character and other data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Personnel, salary and payroll administration

• Purpose of processing: to ensure the management of employment relationships and other similar legal relationships, and all associated obligations in accordance with the Labour Code and other related or supplementary legislation (in particular taxes, social security and health insurance, Act No. 128/2000 Coll., the Act on Municipalities (Municipal Organisation), Act No. 586/1992 Coll., on Income Tax, Act No. 187/2006 Coll., on Sickness Insurance, Act No. 120/2001 Coll., the Enforcement Code, Act No. 182/2006 Coll., the Insolvency Act, Act No. 582/1991 Coll., on the Organisation and Implementation of Social Security, Act No. 148/1997 Coll., on public health insurance, Act No. 589/1992 Coll., on social security contributions and contributions to state employment policy, Act No. 155/1995 Coll., on pension insurance, Act No. 592/1992 Coll., on general health insurance contributions • Categories of personal data: address and identification data; special categories of data – state of health • Categories of data subjects: the controller’s employees, workers on DPP/DPČ contracts + persons with other relationships to the controller • Categories of data recipients: the controller + authorised natural and legal persons, public authorities • Retention period: for the duration of the legal relationship and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Conflict of interest – register of notifications

• Purpose of processing: maintenance of a register of notifications in accordance with Act No. 159/2006 Coll., on conflicts of interest, as amended • Categories of personal data: address, identification and financial data • Categories of data subjects: the controller’s employees + persons with another relationship to the controller (public officials) • Categories of data recipients: the controller, persons with no relationship to the controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Crisis and defence planning

• Purpose of processing: documentation serving to protect the population in the event of a state of emergency, obligations under Act No. 240/2000 Coll., as amended, and Act No. 222/1999 Coll., as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s employees, persons with other relationships to the controller, persons with no relationship to the controller • Categories of data recipients: the controller + authorised natural and legal persons, public authorities within the framework of • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Access to classified information

• Purpose of processing: to demonstrate compliance with the conditions for access to classified information; an obligation under Act No. 412/2005 Coll. on the Protection of Classified Information, as amended • Categories of personal data: contact and identification details; special categories of data – criminal offences • Categories of data subjects: the controller’s employees • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Lay judges

• Purpose of processing: the election of lay judges, Section 64(1) of Act No. 6/2002 Coll., on courts, judges, lay judges and the state administration of courts, and amending certain acts • Categories of personal data: address and identification data; special categories of data – criminal offences • Categories of data subjects: persons with no relationship to the controller • Categories of data recipients: the controller + authorised natural and legal persons, public authorities • Retention period: 5 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Petitions

• Purpose of processing: receipt and handling of petitions, in accordance with Section 102(2)(n) of Act No. 128/2000 Coll., on municipalities • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Honorary citizenship

• Purpose of processing: keeping a record of nominations for the award, pursuant to Section 84(2)(s) of Act No. 128/2000 Coll., on municipalities, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) + persons with no relationship to the controller • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Awards

• Purpose of processing: record-keeping of nominations for awards, record-keeping of nominations for awards, pursuant to Section 84(2)(s) of Act No. 128/2000 Coll., on municipalities, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) + persons with no relationship to the controller • Categories of data recipients: the controller • Retention period: 5 years

Administrative offence proceedings

• Purpose of processing: conducting administrative offence proceedings, in particular pursuant to Act No. 250/2016 Coll., the Act on Liability for Administrative Offences and Proceedings Therein • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: authorised natural and legal persons (parties to the proceedings), public authorities within the scope of their powers • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Reports on reputation and reliability

• Purpose of processing: reputation reports for the purposes of criminal proceedings and background checks on natural persons and firearms licence holders (Act No. 141/1961 Coll., the Code of Criminal Procedure, Act No. 415/2005 Coll., on the Protection of Classified Information, Act No. 119/2002 Coll., on Firearms and Ammunition, as amended) • Categories of personal data: address and identification data; special categories of data – data on administrative penalties • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: authorised natural and legal persons (parties to proceedings), public authorities within the scope of their powers • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Local referendum

• Purpose of processing: conducting a local referendum in accordance with Act No. 22/2004 Coll., on local referendums and amending certain acts, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) + persons with no relationship to the controller • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Records of local charges

• Purpose of processing: records of taxes and charges pursuant to Act No. 565/1990 on local charges and Act No. 280/2009 Coll., the Tax Code, as amended • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: for the entire duration of the fee liability, plus 10 years; in the case of debt recovery for arrears, 20 years; and further in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Asset records, insurance

• Purpose of processing: record-keeping of the municipality’s assets and their insurance in accordance with Act No. 128/2000 Coll., the Municipalities Act; Act No. 89/2012 Coll., the Civil Code; Act No. 563/1991 Coll., the Accounting Act; Act No. 250/2000 Coll., the Act on Budgetary Rules for Local Authority Budgets, Decree No. 270/2010 Coll. on the inventory of assets and liabilities, as amended, Act No. 262/2006 Coll., Labour Code • Categories of personal data: address and identification details, first name, surname, date of birth, title, permanent address, place of residence, email address, telephone number, data box ID, bank account number, insurance policy number, identity card – copy, vehicle registration certificate – copy, insurance claim reference number, signature • Categories of data subjects: the controller’s customers (clients), members of the public, the controller’s employees, workers on a contract for work or a contract for specific work, persons performing public functions in accordance with Section 201 of the Labour Code • Categories of data recipients: the controller • Retention period: 10 years, and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Debt recovery

• Purpose of processing: recording and managing the municipality’s financial assets in accordance with Act No. 128/2000 Coll., the Municipalities Act; Act No. 89/2012 Coll., the Civil Code; Act No. 280/2009 Coll., the Tax Code, as amended, Act No. 235/2004 Coll., the Value Added Tax Act, Act No. 220/2013 Coll., the Decree on the requirements for the approval of financial statements of certain selected accounting entities • Categories of personal data: address and identification data, special categories of personal data • Categories of data subjects: the controller’s customers (clients), members of the public, the controller’s employees, workers on a DPP/DPČ contract, persons performing public functions in accordance with Section 201 of the Labour Code, members of the public, sole traders, legal entities • Categories of data recipients: the controller, persons performing public functions in accordance with Section 201 of the Labour Code, public authorities and other authorised persons • Retention period: 10 years, and further in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Accounting and budget • Purpose of processing: keeping the municipality’s accounts in accordance with Act No. 128/2000 Coll., the Municipalities Act, Act No. 89/2012 Coll., the Civil Code, Act No. 563/1991 Coll., the Accounting Act, and Act No. 250/2000 Coll., the Act on Budgetary Rules for Local Authority Budgets • Categories of personal data: address and identification data, special categories of data • Categories of data subjects: the controller’s customers (clients), the controller’s employees, workers on a contract for work (DPP) or a contract for specific work (DPČ), persons performing public functions in accordance with the provisions of Section 201 of the Labour Code • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Gambling administration

• Purpose of processing: authorisation to establish a gaming venue and the calculation of fee obligations pursuant to Act No. 186/2016 Coll. on Gambling • Categories of personal data: address and identification data, special categories of personal data • Categories of data subjects: natural and legal persons • Categories of data recipients: the controller, members of the public, public authorities and other authorised persons • Retention period: 5 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Public procurement • Purpose of processing: execution of contracts, conclusion of agreements and placing of orders • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Issuing identity cards

• Purpose of processing: issuing identity cards • Categories of personal data: address and identification data • Data subject category: customers (clients) of the controller • Categories of data recipients: the controller + authorised natural and legal persons, public authorities within the scope of their powers • Retention period: 20 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Travel documents

• Purpose of processing: issuing travel documents • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons, public authorities within the scope of • Retention period: 15 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Driving licences and certificates of professional competence for drivers

• Purpose of processing: the issue of driving licences and certificates of professional competence for drivers, examinations of professional competence to drive motor vehicles, and driving school operators • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients), applicants, driving school operators • Categories of data recipients: the controller + authorised natural and legal persons + public authorities within the scope of their powers • Retention period: for the duration of the driver’s life plus one year following their death, and further in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Motor vehicle register

• Purpose of processing: motor vehicle register • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons (parties to proceedings), public authorities within the scope of their powers • Retention period: 5 years after the vehicle is decommissioned and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Licences for the operation of vehicle emissions testing stations

• Purpose of processing: the issuing of licences for the operation of vehicle emissions testing stations in accordance with Act No. 56/2001 Coll., on the conditions for the operation of vehicles on public roads, as amended • Categories of personal data: address and identification details of licence applicants and station operators • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons (parties to the proceedings), public authorities within the scope of their powers • Retention period: 5 years from the closure of the station and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Procedure under the Air Protection Act

• Purpose of processing: procedure in accordance with Act No. 201/2012 Coll., on Air Protection, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 254/2001 Coll., on Water and on Amendments to Certain Acts (the Water Act), as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 254/2001 Coll., on Water and amending certain acts (the Water Act), as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 to 50 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Water law records

• Purpose of processing: processing of data in accordance with Act No. 254/2001 Coll. on Water and on Amendments to Certain Acts (the Water Act), as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 50 years after the file is closed and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Asset and operational records of water supply and sewerage systems

• Purpose of processing: procedure in accordance with Act No. 274/2001 Coll., on water supply and sewerage systems, as amended • Categories of personal data: address and identification data • Categories of data subjects: owners and operators of water supply and sewerage systems • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 114/1992 Coll., on the Protection of Nature and the Landscape, as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 114/1992 Coll., on the Protection of Nature and the Landscape, as amended • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 185/2001 Coll., on Waste, as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 185/2001 Coll., on waste, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Provision of information pursuant to Act No. 123/1998 Coll., on free access to information on the environment, as amended

• Purpose of processing: provision of information to members of the public pursuant to Act No. 123/1998 Coll., on Free Access to Information on the Environment, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years

Procedure pursuant to Act No. 334/1992 Coll., on the Protection of the Agricultural Land Fund, as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 334/1992 Coll., on the Protection of the Agricultural Land Fund, as amended • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 15 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 246/1992 Coll., on the Protection of Animals against Cruelty, as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 246/1992 Coll., on the Protection of Animals against Cruelty, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 to 10 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 326/2004 Coll., on Plant Health Care and amending certain related acts, as amended:

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 326/2004 Coll., as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 99/2004 Coll., on fish farming, the exercise of fishing rights, the fisheries guard, the protection of marine and fishery resources, and amending certain acts (the Fisheries Act), as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 99/2004 Coll., on Fisheries, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 to 10 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 289/1995 Coll., on forests, as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 289/1995 Coll., on Forests, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 to 10 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Procedure pursuant to Act No. 149/2003 Coll., on the trade in forest reproductive material, as amended

Procedure pursuant to Act No. 449/2001 Coll., on Game Management, as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 449/2001 Coll., on Game Management, as amended. • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 to 10 years after the closure of the file and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Proceedings conducted in accordance with Act No. 183/2006 Coll., the Act on Spatial Planning and Building Regulations (the Building Act), as amended

• Purpose of processing: regulation of building activities – conducting administrative proceedings under Act No. 183/2006 Coll., the Act on Spatial Planning and Building Regulations (the Building Act), as amended, with both natural and legal persons • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: indefinitely – for the duration of the building’s existence and for 20 years following its demolition, and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Allocation of descriptive and registration numbers

• Purpose of processing: numbering of buildings in accordance with Act No. 128/2000 Coll., on municipalities (municipal organisation), as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: for the duration of the building’s existence

Municipal Trade Licensing Office

• Purpose of processing: procedures in matters under Act No. 455/1991 Coll., on Trade Licensing, as amended • Categories of personal data: address and identification data • Categories of data subjects: persons with other relationships to the controller, the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Register of Agricultural Entrepreneurs

• Purpose of processing: issuing certificates of registration in the register of agricultural entrepreneurs or removal from the register of agricultural entrepreneurs in accordance with Act No. 252/1997 Coll., on Agriculture, as amended • Categories of personal data: address and identification data • Categories of data subjects: persons with other relationships to the controller; the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Markets and Market Sales

• Purpose of processing: for the organisation and management of markets and market events • Categories of personal data: address and identification data • Categories of data subjects: persons with other relationships to the controller, the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Social care

• Purpose of processing: care for persons at risk of social exclusion due to previous institutional or protective care or the serving of a prison sentence; persons whose rights and interests are threatened by the criminal activity of another person; and persons whose lifestyle may lead to conflict with society Act No. 108/2006 Coll., on social services; Act No. 111/2006 Coll., on assistance in material need; Act No. 110/2006 Coll., on the subsistence minimum; Act No. 169/1999 Coll., on the enforcement of custodial sentences; Act No. 345/1999 Coll., Regulations on the Enforcement of Custodial Sentences; Act No. 293/1993 Coll., on the execution of pre-trial detention; Act No. 109/1999 Coll., on the rules governing the execution of pre-trial detention; Act No. 129/2008 Coll., on the execution of preventive detention; as amended • Categories of personal data: address and identification data (special categories of data: criminal activity, information relating to placement in institutional care – institutional and protective care, the execution of pre-trial detention and imprisonment, the execution of preventive detention, other personal data), other personal data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller, the reporting party, authorised natural and legal persons, public authorities within the framework of • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Social and legal protection of children

• Purpose of processing: records maintained in accordance with Act No. 359/1999 Coll., on the social and legal protection of children, as amended • Categories of personal data: address and identification data, special categories of data, other personal data • Categories of data subjects: the controller’s customers (clients), persons with another relationship to the data subject, persons with no relationship to the data subject • Categories of data recipients: the controller, the reporting body, authorised natural and legal persons, public authorities within the framework of • Retention period: 15 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Social work

• Purpose of processing: records kept in accordance with Act No. 111/2006 Coll., on assistance in material need, as amended, and Act No. 108/2006 Coll., on social services, as amended • Categories of personal data: address and identification data, sensitive personal data • Categories of data subjects: customers (clients) of the data controller • Categories of data recipients: the data controller, the reporting party, authorised natural and legal persons, public authorities within the scope of • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Special recipients of pension insurance benefits

• Purpose of processing: records maintained in accordance with Act No. 582/1991 Coll., on the organisation and implementation of social security, as amended • Categories of personal data: identification and address details • Categories of data subjects: the controller’s customers (clients), persons with other relationships to the data controller • Categories of data recipients: the data controller, authorised natural and legal persons, public authorities within the scope of • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Parking permits

• Purpose of processing: records maintained in accordance with Act No. 361/2000 Coll., on Road Traffic, as amended • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller, the notifying party • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Public guardianship

• Purpose of processing: administration of public guardianship for persons with restricted legal capacity, conducted in accordance with Act No. 89/2012 Coll., the Civil Code, as amended • Categories of personal data: address and identification data, special categories of data, other personal data • Categories of data subjects: the controller’s customers (clients), persons with other relationships to the data controller • Categories of data recipients: the controller, the data controller, other recipients (legal entities and natural persons in the Czech Republic) • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Representation when concluding contracts for the provision of social services

• Purpose of processing: records kept in accordance with Act No. 108/2006 Coll., on social services, as amended • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller, the notifying party, other recipients (legal and natural persons in the Czech Republic) • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Social funerals

• Purpose of processing: records maintained pursuant to Act No. 256/2001 Coll., on Funeral Services, as amended • Categories of personal data: contact and identification details • Categories of data subjects: persons with other relationships to the notifier • Categories of data recipients: the controller, other recipients (legal entities in the Czech Republic, natural persons in the Czech Republic) • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Determination of fees for meals and care

• Purpose of processing: records kept pursuant to Act No. 108/2006 Coll., on social services, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients), members of the notifying party • Categories of data recipients: the controller, the controller’s clients, legal or natural persons in the Czech Republic • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Found property and animals

• Purpose of processing: recording and reporting the discovery of lost property or animals in accordance with Act No. 89/2012 Coll., the Civil Code, as amended • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 3 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Processing of cases of unlawful conduct

• Purpose of processing: handling administrative offences and preparing documentation for the relevant authorities, in accordance with Act No. 250/2016 Coll. the Act on Liability for Administrative Offences and Proceedings Therein, Act No. 251/2016 Coll. on Certain Administrative Offences, and Act No. 553/1991 Coll. on the Municipal Police, as amended • Categories of personal data: address and identification data; special categories of data – administrative offences, data on administrative penalties • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller, authorised natural and legal persons, public authorities within the scope of • Retention period: 3 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Recording of video and audio footage from public spaces and during interventions

• Purpose of processing: to document unlawful conduct, for prevention and identification of persons, in accordance with Section 24b of Act No. 553/1991 Coll., on the municipal police, as amended • Categories of personal data: address and identification data; special categories of data – administrative offences, data on administrative penalties • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons, public authorities within the scope of • Retention period: 1 month and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Reports from citizens (the public)

• Purpose of processing: recording of reports (complaints) from members of the public, in accordance with Act No. 553/1991 Coll., on the municipal police, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons, public authorities within the scope of • Retention period: 3 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Verification of a person’s identity where another citizen has a legal interest

• Purpose of processing: to provide a person’s identity where another person has a legal interest, in accordance with Section 12(2)(e) and (f) of Act No. 553/1991 Coll., on the Municipal Police, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller, natural persons in the Czech Republic and abroad • Retention period: 3 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Requests for an explanation from a member of the public

• Purpose of processing: exercise of the right to request an explanation, pursuant to Section 12(2)(c) of Act No. 553/1991 Coll., on the Municipal Police, as amended • Categories of personal data: address and identification data; special categories of data – criminal offences • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons, public authorities within the framework of • Retention period: 3 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Residents’ registration

• Purpose of processing: registration, notification, changes to and cancellation of permanent residence • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons, public authorities within the scope of • Retention period: 50 years; for data provided from the EO information system, 5 years, and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Registry

• Purpose of processing: maintenance of registers, changes to first names and surnames • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons, public authorities, and • Retention period: birth – 100 years; marriage and death – 75 years; change of first name and surname – 10 years; and further in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Electoral agenda – electoral rolls

• Purpose of processing: permanent electoral roll, special electoral roll, registration of candidates in the event of local and Senate elections • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: electoral roll: indefinitely – the roll is continuously updated; registration of candidates: 10 years and thereafter in accordance with the Filing and Disposal Regulations, including the Filing and Disposal Plan

Electoral agenda – Polling station committees

• Purpose of processing: to organise elections • Categories of personal data: address and identification data • Categories of data subjects: persons with other relationships to the data controller • Categories of data recipients: the data controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Electoral administration – Issuing voter registration cards

• Purpose of processing: organising elections – issuing voter cards • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Procedure pursuant to Act No. 111/1994 Coll., on Road Transport, as amended

• Purpose of processing: procedure in accordance with Act No. 111/1994 Coll., on Road Transport, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 to 15 years after the closure of the file and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Central Register of Carriers (CRD)

• Purpose of processing: processing of data in accordance with Act No. 111/1994 Coll., on Road Transport, as amended • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: for the duration of the business licence

Procedure pursuant to Act No. 361/2000 Coll., on Road Traffic, as amended

• Purpose of processing: conducting administrative proceedings and other procedures in accordance with Act No. 361/2000 Coll., on Road Traffic, as amended, including the granting of exemptions from traffic signage and the establishment of both temporary and local traffic regulations • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: for the duration of the structure’s existence and for twenty years following its removal, and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Legal proceedings

• Purpose of processing: contentious and non-contentious proceedings before the courts, applications, claims, enforcement proceedings, appeals • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller + authorised natural and legal persons, public authorities • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Contracts for cultural performances, cooperation, work for hire, and the creation of a work

• Purpose of processing: contracts for cultural performances, cooperation agreements, contracts for services, contracts for the creation of a work and its further use, Act No. 121/2000 Coll., the Copyright Act, as amended • Categories of personal data: address and identification details • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years

Contracts concerning the disposal of the municipality’s property – tenancy, leasehold, sale, donation, exchange, loan and other contracts

• Purpose of processing: to carry out property transactions involving the municipality’s assets in accordance with specific legal requirements; to administer applications for the conclusion of contracts • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller, authorised natural and legal persons, public authorities • Retention period: 10 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Exercise of the right of assembly

• Purpose of processing: to ensure the possibility of exercising the right of assembly in accordance with Act No. 84/1990 Coll. on the Right of Assembly, and to maintain a register of organisers of assemblies • Categories of personal data: address and identification data • Categories of data subjects: organisers of assemblies • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Records Management

• Purpose of processing: to ensure the performance of record-keeping services in accordance with Act No. 499/2004 Coll., on Archiving and Record-keeping and on Amendments to Certain Acts, as amended • Categories of personal data: address and identification data • Categories of data subjects: natural and legal persons • Categories of data recipients: the data controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Public-law contract for the provision of a specific-purpose grant from the budget of the town of Příbram

• Purpose of processing: public-law contract for the provision of a specific-purpose grant from the budget of the town of Příbram pursuant to Act No. 250/2000 Coll., on budgetary rules for local authority budgets and in accordance with Act No. 89/2012 Coll., the Civil Code • Categories of personal data: address and identification data • Categories of data subjects: the controller’s customers (clients) • Categories of data recipients: the controller • Retention period: 5 years and thereafter in accordance with the Records Management and Disposal Regulations, including the Records Management and Disposal Plan

Transitional housing scheme (social housing)

• Purpose of processing: applications and their administration in accordance with ‘Directive of the City of Příbram No. 1/2018/Municipal Office Rules for the letting and exchange of flats owned by the City of Příbram’ pursuant to Act No. 128/2000 Coll., on municipalities • Categories of personal data: address and identification data, special categories of data, other personal data • Categories of data subjects: customers (clients) of the controller • Categories of data recipients: the controller • Retention period: 10 years and

Special-purpose residential buildings (DPS, KoDuS)

Recording and reporting of workplace accidents

• Purpose of processing: the procedure laid down under Act No. 262/2006 Coll., the Labour Code, as amended, and Government Regulation No. 201/2010 Coll., as amended • Categories of personal data: address and identification data, special categories of data – state of health, medical reports • Categories of data subjects: the controller’s employees and persons with other relationships to the controller • Categories of data recipients: the controller and authorised authorities • Retention period: 10 years and thereafter in accordance with the records management and disposal policy

Fire protection units

• Purpose of processing: established procedure in accordance with Act No. 262/2006 Coll., the Labour Code, as amended, to ensure compliance with labour law • Categories of personal data: address and identification data, special categories of data – health and professional fitness • Categories of data subjects: employees • Categories of data recipients: the controller, the Fire and Rescue Service of the Czech Republic • Retention period: 5 years and thereafter in accordance with the records management and disposal policy

Data Protection Officer (DPO)

The Data Controller has established the role of Data Protection Officer (hereinafter referred to as the ‘Data Protection Officer’/‘DPO’). The Data Protection Officer’s contact details are published at www.pribram.eu.

Updates

We review this information memorandum on an ongoing basis and may amend it from time to time (primarily to ensure compliance with legal regulations and personal data protection procedures).

The last amendment was made on 26 September 2018 at 15:32.

Updated: 31. 5. 2026 v 22:01:36

Data Protection

Information on the processing of personal data and guidance on the rights of datasubjects INFORMATION MEMORANDUM

How we process personal data

What personal data do we process?

Information on the processing of personal data and guidance on the rights of data
subjects INFORMATION MEMORANDUM