GDPR

Protection of Personal Data

Information on Personal Data Processing and Exercising Data Subjects' Rights

Provided Information on Personal Data Processing

The General Data Protection Regulation (GDPR) EU 2016/679 requires data controllers to inform individuals (data subjects) about the scope and manner of processing their personal data when acquiring it. At DPMO, a.s., this is documented in the "Records of Personal Data Processing Activities," which describes how personal data (hereinafter referred to as PD) is handled in various agendas and includes the following information:

• Details about the PD controller,
• Details about other PD processors,
• Location of PD storage,
• Location of PD processing,
• Purposes of PD processing,
• Legal basis (legal title, legitimate interests, consent) for PD processing,
• Categories of PD,
• Categories of PD subjects,
• Retention period of PD, or if it cannot be determined, the criteria used to determine this period,
• Recipients or categories of recipients of personal data (if applicable),
• Transfer of PD to a third country or international organization,
• The fact that automated decision-making (including profiling) takes place.

Individuals have the right to be informed about their personal data processed by the controller. The controller is not obliged to provide this information if the data subject already has it, or if the recording or disclosure of PD is expressly required by law, or if providing this information to the data subject is impossible or would require disproportionate effort (e.g., if processing is carried out for archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes).

Rights of Individuals – Data Subjects

During the PD processing by the controller (i.e., DPMO, a.s.), individuals are allowed to exercise their right to:

• Information and access to their PD (even remotely, if technically possible – applies only to pre-sale of tickets via the e-shop),
• Rectification/adjustment of their PD,
• Restriction of PD processing,
• Object
• i.e., place PD in a special regime where it will not be processed until the objection is resolved,
• Disagree with processing,
• Erasure (right to be forgotten),
• Portability
• this right applies exclusively to PD provided by the data subject, based on consent or in accordance with the performance of a contract, processed automatically, i.e., in electronic form.

In these cases, the company as the PD controller is obliged to inform any other processors authorized by it about the individual's request.

Exercising Individual's Rights

Individuals (data subjects) can exercise their rights with the controller (the company) through the "Data Subject Request" form.

The request in the form of a completed form can be delivered to the data controller:

a) In paper form personally to the company's secretariat or by mail to the address:

Dopravní podnik města Olomouce, a. s. Koželužská 563/1 779 00 Olomouc

b) In electronic form to the email address podatelna@dpmo.cz

Requests submitted electronically must be signed with a qualified electronic signature to verify the applicant's identity.

Requests submitted in paper or electronic form other than by filling out the specified form will also be accepted. However, these requests must contain information necessary to verify the applicant's identity, including:

• Name and surname,
• Date of birth,
• Place of birth,
• Date,
• Signature,
• Or electronic signature for electronically submitted requests.

If the data subject requests, the information can be provided orally, provided the identity of the data subject is proven by other means.

The company will assess the legitimacy of any request and provide the data subject with the requested information within 30 days of receiving the request. This period can be extended by another two months if necessary, considering the complexity and number of requests.

Verification of the Applicant

The controller (i.e., DPMO, a.s.) is entitled to use all appropriate measures to verify the identity of the data subject requesting access to information about processed PD or exercising any other aforementioned right. The legitimacy of the request is also assessed.