We process personal data solely on the basis of, and in the extent permitted by, Regulation of the European Parliament and Council No. 2016/679, on personal data protection and related regulations. This also applies to all processors that process personal data in accordance with our instructions.
You will find all the information concerning personal data processed by ČD, as well as updates to these terms and conditions, on www.cd.cz/pravasubjektu.
PERSONAL DATA CONTROLLER – ČD
The controller of personal data processed in connection with TELETIKET – telephone sales of eTiket documents – is the company České dráhy, a.s.ID No. 709 94 226, with Registered Office at Nábřeží L. Svobody 1222, 110 15 Praha 1, Czech Republic, registered in the Commercial Registry maintained by the Municipal Court in Prague, Section B, rider 8039.
DATA PROTECTION OFFICER
Regarding matters related to the processing of personal data, you can contact the personal data protection officer at ČD on tel. 221 111 122 or by e-mail on dpo@cd.cz.
PURPOSES OF PROCESSING AND THEIR LEGAL BASIS
The data about yourself that you provided about in the telephone order, i.e. name, surname, e-mail address, payment card number, payment card expiration date, audio recording of the telephone conversation (without information about the payment card)
together with the data about the person for whom the eTiket was purchased, i.e. name, surname, e-mail address
are processed exclusively for these purposes:
- securing and providing telephone sales of eTiket documents
- fulfilment of the transport contract and inspections of the legitimacy of the use of transport products (under the relevant Tariff and the ČD Contractual and Transport Terms for Public Passenger Railway Transport (SPPO))
- sending information about extraordinary events on the track by means of e-mail, telephone conversations and text messages (follows from the ČD Contractual and Transport Terms for Public Passenger Railway Transport (SPPO))
… in order to fulfil our responsibilities under the Contract on the Use of the TELETIKET Service and the transport contract
- exercising rights under the transport contract, in particular collecting information for control purposes and making possible an objective assessment of the legitimacy of any non-use (partial non-use) of a service on the part of the customer
- preserving tax receipts for the needs of the tax administrator
… in order to fulfil our responsibilities under legislation
- improving the provided services selling eTiket documents
- conducting market surveys and related research and analysis for the purpose of using the obtained data to determine subsequent marketing and business strategies
- sending commercial offers, in particular in the form of discounts, seasonal events or special events such as news about our services, etc., by means of e-mail (direct marketing)
For marketing purposes, we use profiling, i.e. a method of automatically processing personal data which evaluates aspects of the customer and enables us to create offerings of products or services tailored to specific customers, in particular their age and purchase history. You can elect not to receive commercial offers at any time and free of charge, however, by using a link found in every e-mail.
… in order to be able to always provide you with the most amiable telephone sales experience
… in order to be able to adjust our offering of train connections according to their popularity, etc.
… in order to be able to send tailored commercial offers and discounts to specific customers, e.g. summer holiday events for students, etc.
(under legislation, we have a legitimate interest in such processing and can conduct it even without your explicit consent)
RECIPIENTS OF PERSONAL DATA
We provide personal data exclusively to:
- the administrators of our information systems where personal data are processed, and
- contractual partners in the areas of inland and international transport, municipal mass transport and ČD travel document sales.
A list of all processors is available on https://www.cd.cz/assets/info/cim-se-ridime/zpracovatele-osobnich-udaju.pdf.
Personal data can also be provided to public authorities, should this be required by legislation, if doing so is essential to protect against unjustified harm to another’s freedom, life, health or ownership.
DURATION OF STORAGE
We will terminate personal data processing no later than after 12 months have passed from the date of use of the travel document purchased through ČD Central Customer Service. Tax receipts for transactions made with a payment card are archived for a period of 2 years. We will terminate the archiving of data specified on travel documents (tax receipts) after 10 years have passed since their date of issue. In the event that the purpose of the processing lapses earlier, then we will terminate the processing of your personal data for this defunct purpose prior to the termination of the contractual relationship.
CUSTOMERS’ RIGHTS
You have the following rights vis-à-vis us concerning your personal data:
Access to personal data
You have the right to know whether we are processing your personal data, as well as the right to receive a copy of your personal data and the details of such processing. In addition, you have the right to access a catalogue of your rights – to correction, erasure, limitations on processing, to raise an objection, to lodge a complaint with a supervisory authority.
Correction of personal data
You have the right to correct inaccurate personal data and to supplement incomplete personal data. This means, for example, that whenever you change your e-mail address or telephone number we will always update it immediately so as to ensure problem-free communication. Therefore, please always inform us of changes to your personal information.
Objection to processing
If you believe that our legitimate interest in processing your personal data in cases where we may do so even without your consent is not well-founded, in particular for marketing purposes, then you have the right to raise an objection to the processing of your personal data, including profiling. We will assess your request and if we determine that our interest in further processing does not outweigh your interest in the termination of such processing, then we will terminate the processing of your personal data. In the event of an objection to marketing, we will terminate such processing immediately.
Limitation of processing
You have the right to have us limit the processing of personal data to its storage and evident differentiation from other processed personal data if you believe that:
- the personal data are not accurate
- the processing of the personal data is illegal, but you do not wish to erase them
- you need your personal data for the establishment, exercise or defence of legal claims, even though ČD no longer needs them
- you object to the legitimacy of our interest in processing such data, for the duration of the period in which ČD will analyse the legitimacy of such interest
Erasure of personal data
You have the right to “be forgotten”, i.e. the right to have us erase all your personal data once they are no longer necessary for the purposes for which they were processed and there is no legal basis for further processing, and of course also if your personal data were processed illegally. We will also erase your personal data if they are being processed on the basis of consent and you revoke such consent. They will further be erased if you raise an objection to such processing and we conclude that our legitimate interest does not outweigh your interest in terminating such processing (in cases where your personal data are processed on the basis of our legitimate interest), or if you raise an objection to such processing for purposes of direct marketing. We will also erase your personal information if we are ordered to do so in accordance with the law.
Your personal data cannot be erased, however, if there exist reasons for which it is possible to continue processing despite your request, in particular the need for further processing for the establishment, exercise or defence of our legal claims, the fulfilment of our legal responsibilities or the exercise of rights to the freedoms of speech and information, as well as for scientific or historical research or for statistical or archiving purposes in the public interest. Unless further processing is essential, however, we will grant your request immediately.
Portability
You have the right to “take away” your personal data from us and give them to a different controller. In this manner, it is possible to transfer all the personal data that we process by automated means on the basis of your consent or a contract. We will make available all data to you or to a new controller in a structured, commonly used and machine-readable format. Completing the transfer process is the responsibility of your new controller and its technical facilities, however. Simply put, we cannot guarantee that the new controller will be able to read and work with your personal data.
Lodging a complaint with a supervisory authority
If you are convinced that your rights under legislation have been violated, you can address a complaint directly to the supervisory authority in certain EU member states, in particular in the member state of your normal residence, your place of employment, or the place where the alleged violation occurred. The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).
EXERCISING CUSTOMERS’ RIGHTS
Customers’ rights concerning personal data, including the revocation of consent, can be exercised at any time in the manners specified below, which ensure that your request is handled as quickly as possible:
- on www.cd.cz/kontaktni-formular
- data message sent to ID: e52cdsf
- written letter sent to České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic
- e-mail sent to dpo@cd.cz
- in person at the address České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic
For exercising your rights, we have prepared the Form for Exercising Customer’s Rights Concerning Personal Data, but you can also send us your request in your own format. In order to grant your requests, however, we must first and foremost verify that the person submitting the request is really you. This is the only way to prevent the abuse of your personal data by a third party, an irreversible change to your personal data, or even their loss. Documents uploaded to our website or sent by e-mail must therefore be accompanied by your guaranteed electronic signature. If you are an In Karta cardholder, you can upload documents to the Portal without this signature. You can also send documents as letters sent by post, to which you affix your officially certified signature. On the e-mail subject line or envelope, please always write “GDPR”.
If you exercise your rights in person in the filing room (“Podatelna”) at our headquarters at České dráhy, a.s., Generální ředitelství, Nábřeží Ludvíka Svobody 1222, 101 15 Praha 1, Czech Republic, only an identification document issued by a state administrative body will be required to verify your identity.
Although we want to make it as easy as possible for you to exercise your rights, we must eliminate the risk of illegitimate interventions into the processing of your personal data. Therefore, if we have doubts as to whether such a request is being submitted by you, we will ask you to provide additional information.
NOTICE CONCERNING THE CONSEQUENCES OF SUCCESSFULLY EXERCISING CUSTOMERS’ RIGHTS
In order for us to discharge our legal responsibilities or to fulfil a contract that we are to conclude with you, it is essential that you provide most of the personal data we process. It is therefore your responsibility to provide these personal data to us. If you do not do so, we will be unable to make the requested service available to you.
If a request to erase all personal data for all specified purposes is granted, this will result in the termination of the contractual relationship between the customer and ČD established by the Contract on the Use of the TELETIKET Service (agreement to the Rules for Telephone Sales of eTiket Documents through ČD Central Customer Service – the TELETIKET Service), as well as the termination of contractual relationships conditioned by this contract.