INFORMATION ON THE PROCESSING OF PERSONAL DATA
provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
I. Personal data controller
Czech Accreditation Institute, a public benefit corporation, with its registered office at Hájkova 2747/22, Žižkov, 130 00 Prague 3, Company ID: 25677675, registered in the Public Register under file number O 47 at the Municipal Court in Prague, email: mail@cai.cz, data mailbox identifier: c4cnq5k (hereinafter referred to as the "CAI").
CAI is a public benefit corporation founded by the Czech Republic, represented by the Ministry of Industry and Trade, whose main activities are:
- assessment and certification of professional competence for testing, calibration, inspection, certification of management systems, certification of persons, certification of products (including services), or other activities to which accreditation criteria set out in internationally recognised normative documents apply;
- accreditation of entities providing the following conformity assessment services: testing, calibration, inspection, certification of management systems, certification of persons, certification of products (including services), or other services covered by accreditation criteria set out in internationally recognised normative documents (including supervision of the continuous fulfilment of accreditation requirements by accredited entities), in accordance with the requirements of normative documents relating to accreditation (in particular ČSN EN ISO/IEC 17011) and documents of international organisations dealing with accreditation, namely the National Accreditation Body of the Czech Republic;
- accreditation of conformity assessment bodies based on the authorization to carry out accreditation pursuant to Section 15(1) of Act No. 22/1997 Coll., on technical requirements for products, as amended, within the meaning of this Act and Regulation (EC) No. 765/2008 of the European Parliament and of the Council, or any legal regulations referring to them;
- accreditation of environmental verifiers under the EMAS programme;
- providing information related to the public benefit services provided;
ensuring the tasks of creating Czech technical standards regulating criteria for conformity assessment bodies and related standards.
II. Categories of data subjects
The purpose of processing personal data is to carry out the accreditation of conformity assessment bodies - an activity of a public authority, the implementation of which is entrusted to the CAI[I]In addition to the data necessary for the implementation of accreditation, CAI processes personal data for the purpose of fulfilling the obligations of the accreditation body - a public authority, keeping records of negotiations on the conclusion of contracts and their performance, providing information related to accreditation and handling correspondence. After the above primary reasons for processing cease to exist, CAI records personal data for the purpose of protecting its legitimate interests, in particular for the purpose of providing evidence in any judicial, administrative or other proceedings.
III. Purpose of processing
CAI processes personal data relating to conformity assessment bodies that are accredited or seeking accreditation and their activities, if this is data necessary for the implementation of accreditation within the meaning of Section 15 et seq. of Act No. 22/1997 Coll., on technical requirements for products, as amended. For the purpose of providing information and handling correspondence, CAI processes personal data of the parties to whom information is to be provided and with whom communication is made. For applicants for employment or other cooperation, CAI also processes other data necessary for assessing the suitability of the candidate for a given position or role.
IV. Scope of processing
CAI processes basic identification and contact data of data subjects. In the event that the processing of other personal data is necessary to achieve the purpose contained in Article II., CAI will carry it out.
V. Legal basis for processing personal data
The legal basis and purpose of the processing of personal data referred to in Article III. is:
a) compliance with the CAI's legal obligation;
b) fulfillment of obligations arising from the contract (the contract does not have to be concluded in writing);
c) the performance of a task carried out in the public interest or in the exercise of official authority entrusted to the CAI;
d) the legitimate interest of CAI or a third party (except where interests or fundamental rights override and
freedom of the data subject which requires the protection of personal data);
e) the data subject's consent to the processing.
VI. Recipients of personal data
Personal data are processed by CAI exclusively for its own purposes – in particular for the proper implementation of accreditation and accreditation-related activities, as well as for the achievement of other purposes listed in Article II. CAI will make personal data available to third parties only if it is required to do so by applicable legislation. CAI does not intend to transfer personal data of data subjects to a third country or international organization.
VII. Period of processing of personal data
CAI processes your personal data only for the period necessary to achieve the purposes set out in Article II, which is no more than ten years from the year in which the accreditation cycle in which the personal data was collected ended, the negotiation of a contract, the negotiation with a public authority or other communication or exchange of information ended. After the primary purpose of processing personal data ceases, CAI records the data to the extent necessary for a period of 10 years in order to protect its legitimate interests, in particular for the purpose of providing evidence in any judicial, administrative or other proceedings. In the case of applicants for employment or other cooperation, this period is 5 years from the end of the selection procedure.
VIII. Rights of the data subject
When processing personal data by CAI, you have the following rights regarding the protection of your personal data:
a) The right to request access to your personal data from CAI.
b) The right to correct your personal data that CAI processes.
c) The right to restriction of processing, meaning that CAI must mark your personal data for which processing has been restricted, and CAI may not further process them for the duration of the restriction, except for their storage.
You have the right to restrict processing when:
– if you dispute the accuracy of the personal data, for the period necessary for CAI to verify the accuracy of the personal data;
– if the processing is unlawful and you refuse the erasure of personal data and instead request the restriction of their use;
– if CAI no longer needs your personal data for the listed processing purposes, but you require them for the establishment, exercise or defense of legal claims;
– if you object to the processing referred to in Article IX below, until it is verified whether CAI's legitimate grounds for the processing override your interests or rights and freedoms.
d) The right to erasure of personal data, unless there is a legal obligation to retain such personal data.
e) Right to data portability. You may request that CAI provide you with your personal data for the purpose of transferring them to another personal data controller, or that CAI itself transfers them to another personal data controller at your request. However, you have this right only with regard to data that CAI processes automatically based on your consent or a contract with you.
f) The right to file a complaint with a supervisory authority if you believe that the processing of personal data violates the legal regulations on the protection of personal data. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
IX. Right to object to processing
If CAI processes your personal data for the purposes of its own or third parties' legitimate interests (i.e. on the legal basis referred to in Article V. letter d), you have the right to object to such processing at any time. You can lodge an objection in person, in writing, electronically via the data mailbox information system or by e-mail with a recognised electronic signature to the relevant CAI address referred to in Article I. If you lodge such an objection, CAI will be entitled to continue the contested processing of personal data only if it demonstrates compelling legitimate grounds for the processing which override your interests or rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims.
X. Data Protection Officer
CAI has appointed a Data Protection Officer pursuant to Article 37 of the GDPR, namely Mgr. Kamila Prokopcová, attorney-at-law, Czech Bar Association registration number 11592, with registered office at Karlovo náměstí 19, Prague 2, 120 00.
[I] For more information about the processing of personal data related to accreditation, please see the FAQ section. Accreditation process and GDPR.
CONTINUE:
Official desk >
Compulsory disclosure information Accessibility Statement Information provided pursuant to Act No. 106/1999 Coll. Terms of use of cookies
About us >
Statutory documents CAI bodies CAI Advisory Bodies Annual reports Legislative Publications CTN Job offers Public hearing
Peer review Whistleblower protection Internal anti-corruption program Policy of impartiality Links