GDPR and Personal Data
In accordance with operating an information system for the electronic vignette (known from here as “IS EDAZ”), the State Fund for Transport Infrastructure processes personal data and thus is subject to regulations in the European Parliament and European Council’s (EU) rule 2016/679 from April 27, 2016 about the protection of personal data in the processing of personal data, the free movement of this data, and the voiding of directive 95/46/ES (general regulations about protection of personal data) in law #110/2019 about the processing of personal data.
This page provides information about what personal data is collected by the State Fund for Transport Infrastructure and its uses, as well as the sources for the personal data, how it is handled, and how it is processed.
This webpage also includes contacts where you can receive more information about the processing of personal data and utilize your rights in the area of personal data protection.
Your Personal Data Administrator
The State Fund for Transport Infrastructure (from here on referred to only as SFDI) is the administrator of your personal data
Headquarters: Sokolovská 1955/278, 190 00, Praha 9
Tel.: +420 266 097 110
Data box ID: e5qaihb
The SFDI was created by law #104/2000 Col., about the State Fund for Transport Infrastructure in its valid form.
The SFDI’s representative for personal data protection
- Ing. Jakub Voneš
- +420 266 097 309
Headquarters: nábřeží Ludvíka Svobody 1222/12, 110 00, Praha 1
Tel.: +420 225 131 367
Basic Information About Personal Data Processing
1. Administrator and Personal Data Processors
The State Fund for Transport Infrastructure is the administrator of your personal data. It is headquartered at Sokolovská 1955/278, 190 00 Praha 9, ID#: 70856508, email: email@example.com, firstname.lastname@example.org, tel: +420 266 097 110, Data box ID number: e5qaihb. The SFDI is created by law # 104/2000 Col., about the State Fund for Transport Infrastructure in its valid form, which is available here.
The SFDI’s representative for personal data protection is Ing. Jakub Voneš, email: email@example.com; tel: +420 266 097 309.
As the processor of personal data, the SFDI determines what personal data are processed, and it is responsible for upholding all requirements for the protection of personal data.
2. The Purpose and Scope of Processing Personal Data
Personal data is only processed to the necessary extent and SFDI guarantees the security of said data. The SFDI, in cooperation with the processor of personal data, set processes within the IS EDAZ so that the risk of unauthorized access, loss, destruction, unauthorized transfers, unauthorized processing, or any other abuse is eliminated.
The SFDI and the processor process your personal data manually and automatically. In automated processing, there is no automatic decision-making or profiling. All your personal data is processed by SFDI employees or employees of the processor who are bound to silence and by important internal regulations, possibly by a contractual relationship between the SFDI and the processor about personal data protection.
a) Registry of vehicles in the toll payment system
The SFDI or the processor can process the following personal data: the car’s license plate, the country where the vehicle is registered, the beginning and end of the vignette’s validity, information whether the car is powered by natural gas or biomethane, the date and time of payment, and an contact e-mail or phone number if they were provided. If the above-listed personal data is not provided, the vehicle cannot be added to the toll system (EDAZ).
This personal data is acquired by the SFDI directly from you (users) or from processors that registered the vehicle in IS EDAZ for you, or from a third party that registered the vehicle in the IS EDAZ on your behalf.
Toward this aim, the SFDI processes your personal data on the basis of fulfilling tasks in the public interest or while performing public administration.
b) Recording vehicles exempt from tolls, including the end of the reason for the exemption
In fulfilling these tasks, the SFDI processes the following personal data: the vehicle’s license plate, the country where the vehicle is registered, personal data about the vehicle’s operator: name, surname, date of birth, home address, notarized signatures, and a list of reasons for the vehicle’s exemption, possibly a power of attorney issued by the operator of the vehicle with a notarized signature if the operator of the vehicle is represented on the basis of a power of attorney and a copy of the vehicle’s registration, the vehicle’s technical permit or a certificate proving the reasons for the exemption. If the above-listed personal date is not submitted, the vehicle’s exemption cannot be registered for the toll exemption in the IS EDAZ.
The SFDI acquires this persona data from you (users or vehicle operators) or from third parties that requested the exemption of the vehicle from tolls in your name.
For this purpose, the SFDI will process your personal data on the basis of fulfilling tasks in the public interest or while performing public administration.
3. Transfer of Personal Data and its Recipients
Your personal data can be transferred to state bodies that the SFDI is obligated to transfer the data according to legal regulations, especially law # 13/1997 Col. about roads.
Your personal data will be provided to CENDIS, s.p. which built and operates the EDAZ system and also provides call centre services, but it is not authorized to provide your personal data to third parties, to be used for its own purposes, or to be included in services provided to third parties.
Personal data is not provided by the SFDI to third countries nor is it provided to international organizations.
4. Period of Processing and Maintaining Personal Data
Your personal data is processed by the SFDI only for the period necessary for processing in case of:
- Registering the vehicle in the EDAZ for the length of the vignette’s validity and then for a period of two years from the vignette’s expiration;
- Recording a vehicle’s exemption for as long as the reasons for the vehicle’s toll exemption exist (EDAZ) and for a period of two years after the reasons for the exemption have passed.
5. The Rights of the Subject of the Data
a) The right to revoke consent
If the SFDI processes your personal data on the basis of consent from the subject of the data (this does not happen as part of the IS EDAZ), you have the right to revoke this consent without effects on the function of the vehicle’s registry in the toll system and the vehicle’s exemption from tolls.
Revoking consent to process personal data is possible on the basis of the above-listed SFDI contact data or the SFDI representative at the e-mail address: firstname.lastname@example.org.
b) The right to access personal data
As the owner of the personal data, you have the right to acquire confirmation from the SFDI whether your data has been processed or not. If your personal data is processed, you continue to have access to it and the following information:
- Reason for of processing;
- The category of personal data processed;
- Recipients or category of recipients that have or will have access to your data;
- The planned period the data will be stored, or if it’s not able to be determined, the criteria used to set this period;
- The existence of the right to demand corrections or deletion of personal data, limiting their processing, or the right to file a complaint against this processing;
- The right to file a complaint with the Office for Personal Data Protection;
- All available information about the source of the personal data;
- Whether automated decision-making is performed, including profiling, the procedure used, and the significance and expected results of this processing.
The SFDI provides free copies of the processed information. The SFDI can levy an appropriate fee according to the price list posted here only in cases where requests are clearly baseless or inappropriate, especially in the case they are repeated. If the request is filed electronically, the SFDI will provide information in electronic form that is regularly used unless you request another form.
c) The right to corrections
If you uncover inaccuracies in your personal data, you as the owner have the right for the SFDI to correct your inaccurate personal data without any delay. You also have the right to add incomplete personal data by submitting a supplementary notice in terms of the reasons for the processing.
d) The right to deletion
As the owner of the personal data, you have the right for the SFDI to erase your personal data provided at least one of the following conditions are fulfilled:
- The personal data are not needed for the purposes they were collected or processed for;
- The consent to processing personal data was rescinded and there is no further legal reason to process the data;
- Objections to processing were filed and there is no further legal reason to process the data;
- The personal data was processed illegally;
- The personal data must be deleted to fulfil legal obligations.
The right to deletion is not exercised if there is a legal exception, especially because the processing of personal data is necessary for:
- The execution of the right to free speech and information;
- Fulfilling legal obligations that demand processing according to European Union or Czech regulations or to fulfil a task performed in the public interest or as an act of public administration ordered by the SFDI;
- Archiving in the public interest, for scientific and historical research, or for statistical purposes if it is probable that the right to deletion would prevent or seriously limit fulfilling the goals of the processing in question;
- In order to determine, execute, or defend legal rights.
e) The right to limited processing
As the owner of the personal data, you have the right for the SFDI to limit the processing of your personal data in any of the following cases:
- To negate the accuracy of the personal data – the SFDI will limit the processing for a period necessary to confirm the accuracy of the personal data;
- The processing is illegal, and you refuse the deletion of your personal data, instead demanding its limited use;
- The SFDI no long needs the personal data for processing, but you request determination, execution, or defence of your legal rights;
- Filing objections until it’s confirmed the SFDI’s reasoning prevails over your reasoning.
If the processing has been limited, your personal data, with the exception of its storage, is only processed with your consent or for the determination, execution, or defence of legal rights, in order to protect the rights of other physical or legal entities, or an important legal interest on the part of the European Union or the Czech Republic.
f) The right to transfer data
As the owner of the personal data, you have the right to acquire the personal data that is related to you in a structured, regularly-used, and machine-readable format and you have the right to request the transfer of this data to another administrator without the SFDI preventing it even in the case that:
- Personal data is processed on the basis of consent from the subject of the data;
- Processing is automated.
The SFDI, provided it is technically possible, will transfer the data to another administrator at the request of the subject of the data. This right is not exercised if the processing is necessary to fulfil tasks performed in the public interest or as part of public administration that the processors is tasked with performing.
g) The right to file an objection
As the owner of the personal data, you have the right to whenever file an objection to the processing of your personal data if the legal right to processing fulfils tasks performed in the public interest or when performing public administration, or when processing is necessary for the purposes of the processor’s valid interests or from a third party, including profiling based on these provisions. The objection is filed to the SFDI’s above-listed contact data. The SFDI will no longer process the personal data if there are not significant valid reasons for processing that outweigh your interests, rights, and freedoms or for the determination, execution, or defence of legal rights.
h) The right to not be the subject of automated decision-making, including profiling
As the owner of the personal data, you have the right to not be the subject of any decision based solely on automated processing, including profiling that has legal ramifications or touches the individual in a similar way.
i) The right to submit complaints
As the owner of the personal data, you have the right to file a complaint with the Office for Personal Data Protection headquartered at pplk. Sochora 27, 170 00 Praha 7, tel: +420 234 665 111, website: www.uoou.cz, if you believe the processing of your personal data by the SFDI violates general regulations about the protection of personal data.