1 General Provisions
2 Data Controller and Contact Details
2.1 Identification of your personal data controller
The controller of your personal data is CTP Invest, spol. s r.o., with its registered office at Central Trade Park D1 1571, 396 01 Humpolec, ID: 261 66 453, registered in the Commercial Register maintained by the Regional Court in České Budějovice, file C 15647 (“CTP Invest“).
The CTP Invest is a part of the CTP Group (the “CTP Group”). Contact details and other information about all companies of the CTP Group can be found at https://www.ctp.eu/contact/.
3 Purpose, Legal Basis, Scope and Duration of Processing of Personal Data
3.1 Purposes and legal grounds for personal data processing
We only process your personal data within the scope necessary for the fulfilment of our contractual or statutory obligations and for the exercise of our legitimate interests, or on the basis of consent granted by you for the purposes as set out below:
3.1.1 Administration of the employment relationship – We process your personal data primarily for the purpose of managing our employees and their work activity, including evaluations, career growth, administration of wages, remuneration, bonuses and other paid-out amounts and the review thereof, organization of trainings, administration of leaves, decision-making regarding promotions, transfers to other positions, relocation, internships, disciplinary measures, and termination of employment, organization of business trips or company events, facilitating communication with employees, payment of taxes and compulsory levies, arranging for work-related medical examinations, ensuring safety and protection of health at work, recordkeeping (including records of medical disability, accidents at work and occupational diseases) and fulfilment of notification obligations, conducting audits, and fulfilment of requirements of supervisory authorities or other public authorities.
The legal basis for the processing of personal data for the purposes of the administration of the employment relationship is the fulfilment of our legal obligations as the employer, or the fulfilment of the contract entered into between us and you (for example, employment contracts, agreements on performance of work outside of the employment relationship, agreements on the provision of a benefit). Exceptionally, we can also process your personal data for the purposes of the administration of the employment relationship on grounds of the protection of our legitimate interests (for example, for the purposes of effective communication with you, internal record-keeping, planning and analysis).
3.1.2 Provision of benefits – We process personal data in connection with the provision of individual benefits to employees, i.e. in particular provision of business mobile phones and SIMs.
The legal basis for such processing of personal data is the fulfilment of an agreement entered into between us and you (e.g., your employment contract or, if applicable, an agreement on provision of a benefit) and the fulfilment of our legal obligations as the employer. Exceptionally, we may also process your personal data on grounds of the protection of our legitimate interests (for example, for our defense in any disputes relating to provided benefits).
3.1.3 Operation of company cars and other transport – We also process personal data to ensure efficient fleet management and other means of transports (such as private jets) of the employer.
The legal basis for processing of personal data for the purpose of operating company cars and other transport means is the fulfilment of our legal obligations as an employer (for example, driving records keeping, proper billing or insured events) or the performance of a contract between you and us (e.g., vehicle operation agreements). We also process your personal data to protect our legitimate interests, especially our interest in protecting the property of the employer.
3.1.4 Protection of property by the CCTV systems – We may process recordings from CCTV systems in order to ensure protection of employees’ and employer’s property (such as at the entrance to the building). In no event we use the CCTV systems to monitor your workplace.
The legal basis for such processing is the protection of our legitimate interests.
3.1.5 Ensuring cyber-security and IT administration – The processing of personal data is carried out for the purpose of the protection of our computer networks and the effective administration of utilization of the employer’s IT resources.
The legal basis for such processing is the protection of our legitimate interests, in particular, the interest in ensuring the protection of property and cyber-security, or the fulfilment of legal obligations.
3.1.6 Business relations and communication with third parties (particularly customers, suppliers and public authorities) – The processing of your personal data may be necessary in order to secure our business relations with customers and suppliers, as well as for the purposes of arranging communication with third parties (including public authorities).
The legal basis for such processing is the protection of our legitimate interests (for example, when communication with customers and suppliers, or acting on behalf of the company, signing of company documents), fulfilment of a contract between us and you (in particular your employment contract) or, also, the fulfilment of our legal obligations (particularly when communicating with public authorities in cases of mandatory provision of information).
3.1.7 Provision of insurance and handling insurance claims for employees – In the event that you cause damage to the employer, you will be obliged to compensate this damage or, if you have caused such damage, we may, based on your request, process your personal data for facilitating insurance for you and/or handling the insurance claims and related communication with relevant insurance company, insurance intermediary or insurance broker and for effective and expeditious settlement of damages.
The same applies in case that you have suffered a damage in the workplace and seek damages from us in which case, your personal data may be handed over to an insurance company in order to compensate you for damage and settle any related claims.
The legal basis for such processing is primarily your data subject, and, exceptionally and to a limited extent, our legitimate interest.
3.1.8 Presentation of the employer and documentation of company events – We may also seek your consent to use your personal data for the purposes of our internal and external communication, organization of events for employees, and the company’s marketing purposes.
The legal basis for such processing is the consent of the data subject, and, exceptionally and to a limited extent, our legitimate interest.
3.1.9 Protection of our interests in any disputes – When necessary, we may also process personal data for a potential establishment, exercise or defense of our legal claims in judicial or administrative proceedings.
The legal basis of such processing is our legitimate interest.
3.2 Scope of Processing
We process your personal data within the following scope:
3.2.1 For the purpose of the administration of the employment relationship, we process:
188.8.131.52 data that you provide us with at the beginning of your employment, particularly your name and surname, birth name and all other surnames, title, birth number (rodné číslo), date of birth, permanent residence address, delivery address, phone number, e-mail, date and place of birth, marital status, citizenship, ID details and/or data pertaining to driving license, information relating to health insurance provider (including foreign providers), where necessary information on no criminal record, bank account number, photograph, information on education, name and address of the last previous employer, credit sheet from previous jobs, identification data of your family members (provided for the purpose of proper calculation of wages, levies and deductions);
184.108.40.206 data necessary for wage and accounting agenda, particularly data pertaining to wages, pensions, wage deductions, taxes, social security and health insurance within the scope as required by the relevant legal regulations;
220.127.116.11 data required under immigration regulations, particularly passport data, place of residence, data related to a work and/or residency permit;
18.104.22.168 data necessary for the fulfilment of other labor law obligations, particularly data processed in connection with the assessment of medical fitness, work-related medical examinations, ensuring safety and health protection at workplace, and obligatory training;
22.214.171.124 data on job position and on the course of the employment relationship, including attendance records;
126.96.36.199 data concerning health. We will process such personal data exclusively for the fulfilment of our legal obligations (e.g., in connection with your medical disability – e.g. ZPS certificate, occupational illness or accident at work), or on the basis of your express consent, and only within the scope as permitted by the legal regulations.
3.2.2 For the purpose of the provision of benefits, we process:
188.8.131.52 your identification and contact data and data necessary for billing and record-keeping of drawing of benefits, namely business phones and SIMs, in connection with the provision thereof to you as an employee.
3.2.3 For the purpose of the operation of company cars and other transports, we process:
184.108.40.206 localization and telematics data on the movement of the company cars driven by employees during journeys, not identified by employees as private;
220.127.116.11 information from the MOL cards or, as applicable, from equivalent systems (Shell, CCS cards, etc.) regarding the fuel consumption;
18.104.22.168 the logbook data for journeys not identified by employees as private;
22.214.171.124 data related to the settlement of insurance claims and traffic offences.
3.2.4 For the purpose of the protection of property by the CCTV systems, we process recordings from the surveillance CCTV and your logs to the entrance system (other than attendance records).
3.2.5 For the purpose of the ensuring cyber-security and IT administration, we process the following information pertaining to utilization of the employer’s IT equipment: technology assigned to the employee, assigned software licenses, assigned IP address, access rights, access passwords to all work IT instruments, information on the size of the email inbox and/or size of your outcoming and incoming emails, and billing of telephone calls.
In exceptional cases, when justified (for the purpose of the prevention of a data breach, ensuring of security of networks), we may monitor and process the content of the employees’ email communication. In such cases, the concerned employee will be duly informed prior to the assessment of the email communication.
3.2.6 For the purpose of the company’s business relations and communication with third parties, we process:
126.96.36.199 your name and surname, date of birth, address, email, phone number, job position, employer within the CTP Group and your signature;
188.8.131.52 data on submitted orders, amounts paid, payments made, etc.;
184.108.40.206 if you grant us a consent, we may also process photographs and video recordings capturing you.
3.2.7 For the purposes of the presentation of the employer and the documentation of company events, provided that we obtain your consent, we process your photographs and video recordings (this does not apply to CCTV recordings) in some cases together with your name, surname and job position.
3.2.8 For the purposes of the handling of insurance claims, we process, if you give us your consent, the following information: name, surname, address, date of birth, or other data specified in the insurance contract.
3.3 Duration of processing
We store your personal data for a period of time absolutely necessary and appropriate in view of the relevant purposes of processing, namely, for the following period of time:
3.3.1 personal data processed on the legal basis of the fulfilment of the contract entered into between us and you are stored for the duration of the relevant contract (for example, employment contract, agreement on work performed outside of the employment relationship, wage agreement, agreement on provision of a benefit, agreement on operation of vehicle, etc.);
3.3.2 personal data processed on the legal basis of the fulfilment of legal obligations are stored for the duration of time required by the applicable laws, in particular, in the area of employment, health insurance and social security, accounting, taxes, and archiving;
3.3.3 personal data processed on the legal basis of the protection of our legitimate interests are stored for the duration of time that is absolutely necessary but which shall not exceed a period of three years from the termination of the employment relationship (unless our rights are exercised within judicial or administrative proceedings, or our rights are enforced within such period of time), unless a specific duration of processing is set out below:
220.127.116.11 localization and telematics data on the movement of company cars and other means of transport on journeys not identified as private by employees shall be retained for a maximum of one month following their collection;
18.104.22.168 data necessary in order to provide for the company’s business relations and communication with third parties are processed for the duration of the relationship with the customer or supplier; if your data are also being processed for such purpose under the legal basis of the fulfilment of legal obligations, then the data will be processed for the duration of time as required by applicable laws; if your data are necessary for the protection of our legitimate interest consisting in the enforcement of our receivables and/or the establishment, protection and exercise of legal claims, then we may store your personal data for such purpose for the duration of the limitation period;
22.214.171.124 CCTV recordings are kept for a maximum of 10 days from their collection;
3.3.4 data obtained on the basis of a prior consent (if such consent was granted voluntarily) for the period specified in the consent given to their processing.
4 Sharing and Transfer of Personal Data (Recipients of Personal Data)
4.1 Recipients of personal data
Some categories of the personal data that we collect in the manners set out above may be shared by us with third parties that provide certain services relating to the administration and execution of the employment relationship, utilization of software resources, processing of wage agenda, provision of benefits or protection of our legitimate interests, and also with other companies within the CTP Group. In particular, we may share your personal data:
4.1.1 with the entities of the CTP Group acting as independent controllers for the purposes of internal/external communication, internal administration and organization, marketing of the CTP group;
4.1.2 with wage accountants acting as processors for the purpose of processing of wage agenda;
4.1.3 with providers of employee benefits acting as processors for the purpose of the provision thereof;
4.1.4 with providers of work-related medical services acting as independent personal data controllers for the purpose of the provision thereof;
4.1.5 with providers of training and educational events acting as processors for the purpose of the provision thereof;
4.1.6 with operators of company’s fleet of vehicles and private jets acting as processors;
4.1.7 with providers of CCS cards and Shell card acting as processors;
4.1.8 with entities administering our IT and CCTV systems and providing IT services and telematics utilized in the administration of the employment relationship as processors;
4.1.9 with external legal counsels acting as independent controllers or processors for the protection of our legitimate interests;
4.1.10 with tax and auditing service providers acting as independent controllers or processors for the purpose of the provision thereof;
4.1.11 with insurance brokers or insurance intermediaries acting as independent controllers or processors and with insurance companies acting as independent controllers for the purpose of providing insurance;
4.1.12 with public authorities or other third parties acting as independent controllers or processors for the fulfilment of obligations in accordance with legal regulations.
5 Data Security
We have implemented and maintain appropriate technical and organizational measures, internal controls and information security processes in accordance with legal requirements and market standards corresponding to a possible threat to you as the data subject. We also take into consideration the state of technological development in order to protect your personal data from accidental loss, destruction, alterations, unauthorized disclosure or access. Such measures may, among other things, include taking reasonable steps to ensure the liability of relevant employees who have access to your data, training of employees, regular backups, procedures for data renewal and management of incidents, software protection for devices on which personal data are stored, etc.
6 Your Rights as a Data Subject
If you wish to exercise any of your rights according to this Article or according to applicable legislation, please contact us using the contact information listed in Article 2 above.
6.1 Access to and portability of your personal data
You have the right to request information whether and to what extent we process your personal data. You also have the right to receive personal data which you have provided to us and other personal data related to you (unless we have deleted your data prior to your request).
Should you request so, we can send some of your personal data (namely the data that we process on the basis of performance of a contract and/or your consent, and by automatic means) directly to a third party (to another data controller) whom you state in your request, provided that such request does not affect the rights and freedoms of other persons, and provided that it is technically feasible.
6.2 Withdrawal of consent
You can withdraw your consent (if you have given it to us) at any time without giving reason. In such a case, we will erase your personal data as soon as reasonable and practicable, but no later than 30 days from the withdrawal of your consent.
Please note that the withdrawal of your consent does not affect the lawfulness of processing conducted on the basis of consent prior to its withdrawal.
6.3 Rectification of your personal data
According to applicable legislation, you have the right to rectification of your personal data that we are processing if they are inaccurate or incomplete.
You can at any time request information about whether we still process your personal data or not.
6.4 Erasure of your personal data
You can request erasure of your personal data at any time. If you contact us with such request, we will erase all your personal data that we have without undue delay, unless we need your personal data for the fulfilment of contractual or statutory obligations.
Further, we will also erase all of your personal data (and ensure erasure thereof by the processors that we engage) if you withdraw your consent.
6.5 Objections to processing
If we process some of your personal data on the basis of our legitimate interest, you have the right to object, at any time, to the processing of personal data. If significant legitimate interests for processing – that prevail the interests or rights and freedoms of the data subject – are not proven on our part, or further processing is not necessary for the establishment, exercise or defense of our legal claims, we will no longer process your personal data.
6.6 Restriction of processing
If you request restriction of processing of your personal data, e.g. in the event that you question the accuracy or lawfulness, or our need to process your personal data, we will restrict the processing of your personal data to the necessary minimum (storage), and we may only process them for the establishment, exercise or defense of legal claims, or on grounds of the protection of the rights of another natural person or legal entity, or other limited reasons prescribed by applicable legislation. If a restriction of processing is lifted and we continue to process your personal data, we will inform you without undue delay.
6.7 Complaint to the Office for Personal Data Protection
You have the right to lodge a complaint pertaining to processing of data conducted by us with the competent data protection authority, i.e. in Czech Republic the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7; website: www.uoou.cz.
Sign up to our newsletter
Stay up to date with CTP’s latest developments, industry insights, and exclusive offers by signing up for our newsletter. Join our community and be part of the future of industrial real estate.