GDPR and Personal Data

Basic information on the processing of personal data

1. Purposes and Scope of Personal Data Processing

Personal data is only processed to the necessary extent, and the SFDI guarantees the security of this data. In cooperation with personal data processors, the SFDI has set up processes within the Electronic Motorway website information system (hereinafter referred to as the “EMWIS”) in order to eliminate the risk of unauthorised or accidental access to personal data, destruction or loss of data, unauthorised transmission or processing of data, or other abuse.

The SFDI and the data processors process your data both manually and automatically. Automated processing shall not involve automated decision-making or profiling.  All your personal data is processed by employees of SFDI or employees of data processors who are bound by confidentiality regulations and binding internal regulations, or to the contractual agreement between the SFDI and the processor with regard to personal data protection.

a)  Registration of Vehicles in the EMWIS

For this purpose, the SFDI or the processor may process the following information: the vehicle licence plate number, information on the country in which the vehicle is registered, the start and end of the validity period of the electronic vignette, data as to whether the vehicle is powered by natural gas or biomethane, the date and time of payment and an email address or telephone number (if provided). If the personal data listed above is not provided, it will not be possible to register a vehicle in the EMWIS.

The SFDI obtains this data directly from users or from data processors.

The data shall be processed if it is essential in order to fulfil a task that is in the public interest or when exercising public powers which are entrusted to the controller under Act No. 13/1997 Coll., on roads (hereinafter referred to the “Roads Act”). If the personal data listed above is not provided, it will not be possible to register payment of electronic vignettes for a vehicle in the EMWIS.

b)  Recording and Processing Data Due to a Change of License Plate Number

For this purpose, the SFDI or processors can process the following personal data: Licence plate number (original and new), information on the country in which the vehicle is registered, and personal data of the informer: name, surname, date of birth, residential address and signature. If necessary, other personal data of the owner or operator of the vehicle, which is contained in the vehicle registration certificate or in another document proving the change of the license plate number.

The SFDI obtains this data directly from the notifiers.

The data shall be processed if it is essential in order to fulfil a task that is in the public interest or when exercising public powers which are entrusted to the controller under the Roads Act. If the personal data listed above is not provided, it will not be possible to register a change in the license plate number in the EMWIS.

c) Registering Exemptions of Vehicles from Electronic Vignettes

This may concern the registration of exemptions of vehicles from electronic vignettes or registration of the expiration of reasons for exemptions of vehicles, and therefore removal from the EMWIS, or verification of the facts provided for exempting vehicles by consulting the Register of Road Vehicles and Basic Registers. When performing these activities, the SFDI or processors may process the following personal data: License plate number, information on the country in which the vehicle is registered, personal data of the notifier: name, surname and date of birth, and personal data of the owner or operator of the vehicle: name, surname and date of birth, residential address, officially authenticated signature or equivalent (data box number, electronic signature or an authorised conversion of an officially authenticated signature), an explanation of the reason for exemption of the vehicle, or alternatively a power of attorney granted by the owner or operator of the vehicle with an officially authenticated signature or equivalent (data box number, electronic signature or an authorised conversion of an officially authenticated signature) if the owner or operator of the vehicle is represented by an agent on the basis of a power of attorney, and a copy of the road vehicle’s certificate of registration, vehicle log book, or a certificate of conformity evidencing the fulfilment of criteria for exemption from paying for electronic vignettes.

The SFDI obtains this data directly from the notifiers.

The data shall be processed if it is essential in order to fulfil a task that is in the public interest or when exercising public powers which are entrusted to the controller under the Roads Act. If the data listed above is not provided, it will not be possible to register exemption or the expiration of grounds for exemption of a vehicle in the EMWIS.

d)  Records of Statements from the Czech National Bank (Confirmation of Payments)

For this purpose, the SFDI or processors can process the following personal data of the user: account number, name and surname. 

This data shall be obtained from statements from the Czech National Bank.

This data will be processed if it is essential for fulfilling a task that is in the public interest or when exercising public powers which are entrusted to the controller under the Roads Act.

e) Refunds of Payments for Electronic Vignettes for Exempt Vehicles

For this purpose, the SFDI or processors can process the following personal data: License plate number, information on the country in which the vehicle is registered, personal data of the notifier: name, surname, date of birth, residential address, an officially authenticated signature of equivalent (data box number, electronic signature or authorised conversion of an officially authenticated signature).

The SFDI obtains this data directly from the notifiers.

This data will be processed if it is essential for fulfilling a task in the public interest or when exercising public powers in connection with the provisions of Act No. 89/2012 Coll., the Civil Code. If the personal data listed above is not provided, it will not be possible to assess a claim and potentially refund a payment for an electronic vignette for an exempt vehicle.

f) Records of Vehicles Registered in the Electronic Toll System

For this purpose, the SFDI or processors can process the following personal data: License plate number and information on the country in which the vehicle is registered.

The SFDI obtains this personal data from the operator of the electronic toll system.

The data will be processed if it is essential for fulfilling a task that is in the public interest or when exercising public powers entrusted to the controller under the Roads Act.

g) Enabling Verification of Valid Electronic Vignettes by Means of a Camera System Located at Control Gates or Mobile Control Stations

For this purpose, the SFDI or processors can process the following personal data: photographs of the vehicle (photos may contain personal data of the driver and passengers), the license plate number and additional data: place and time.

This data is obtained via cameras located on control gates and at mobile control stations.

This data will be processed if it is essential for fulfilling a task that it is in the public interest or when exercising public powers which are entrusted to the controller under the Roads Act.

h)  Checks by the License Plate Number Recognition Algorithm

For this purpose, the SFDI or processors can process the following personal data: License plate number (section of a photograph).

This data is obtained via cameras located on control gates.

The data shall be processed if it is essential in order to fulfil a task that is in the public interest or when exercising public powers which are entrusted to the controller under the Roads Act.

i)   Checks at Self-Service Kiosks Using a Slit Camera

For this purpose, the SFDI or processors can process the following personal data: camera recording (the camera recording contains personal data of the user of the self-service kiosk).

This data is obtained from cameras located in the self-service kiosks.

This data will be processed on the grounds of a legitimate interest of the controller for the purpose of protecting the property of the controller or processors against damage or theft.

j)   Registration and Storage of Records, Reports, Notifications, Applications or Other Submissions in Connection with the EMWIS and Keeping a Register of Names

For this purpose, the SFDI or processors can process the following personal data: name, surname, date of birth, residential address, an officially authenticated signature or equivalent (data box number, electronic signature or authorised conversion of an officially authenticated signature), as well as personal data contained in the recording/request/report/notification/other submission (hereinafter referred to as “submissions”): License plate number and information on the country in which the vehicle is registered. Where appropriate, other personal data contained in annexes to submissions.

The SFDI obtains this personal data from the Notifiers.

The data will be processed if it is essential for fulfilling a task that is in the public interest or when exercising public powers entrusted to the controller under Act No. 499/2004 Coll., on archiving and records management. If the personal data listed above is not provided, it will not be possible to process the submission.

For this purpose, the SFDI or processors can further process the following contact details: email address and phone number. The SFDI obtains this data from the notifiers or processes depending on the type of submission. This data is not mandatory and will not affect the submission if not provided. This data will be processed on the grounds of a legitimate interest of the controller for facilitating communication.

k) Handling Enquiries in the EMWIS

For this purpose the SFDI or processors can process the following personal data: name, surname, date of birth, residential address, signature, data box number, a recognised electronic signature, email address or phone number.

The SFDI obtains this personal data from the enquirers.

The data will be processed if it is essential for fulfilling a task that is in the public interest or when exercising public powers entrusted to the controller under Act No. 499/2004 Coll., on archiving and records management. If this data is not provided, it will not be possible to handle the enquiry.

l)  Keeping User Accounts for Employees of the Controller and Processors and their Authorisation in the EMWIS

For this purpose, the SFDI or processors can process the following personal data: name, surname, identification number, job position, service number, email address or phone number.

 The SFDI obtains this data for its employees from its own records and for employees of processors from their employers.

This data will be processed on the grounds of a legitimate interest of the controller for the purpose of protecting its property against damage or theft.

m)  Use of Technical, Preferential and Analytical Cookies

For this purpose, the SFDI or processors can process the following personal data: IP address.

The SFDI obtains this personal data from cookie files (more on cookies here).

Technical cookies are processed on the grounds of a legitimate interest of the controller for ensuring that its website functions correctly.  Preferential cookies are processed on the grounds of consent provided by the data subject for the purpose of optimising the website during future visits. Analytical cookies are processed on the grounds of consent from the data subject for the purpose of monitoring use of the website and creating statistics.

Analytical cookies are provided by Google LLC, which may process personal data in third countries. This can result in increased risks to privacy rights and freedoms in the area of personal data protection.

2.     Passing On Your Personal Data and Recipients of Your Data

Your personal data may be passed on to state administration bodies to whom the SFDI is obliged to pass on personal data in accordance with legislation, especially the Roads Act.

Your personal data will be made available to CENDIS, s.p., which created the EMWIS and which also provides you with the Call Centre service, but is not entitled to pass on your personal data to third parties, to use your data for its own purposes, or to include your data in services provided to third parties. To allow checks of payment of electronic vignettes, your personal data may be made available or passed on to the Police of the Czech Republic and the Customs Administration of the Czech Republic.  

The SFDI will not pass on personal data other than IP addresses to third countries, nor provide them to international organisations. IP addresses may be processed in data centres of Google LLC (https://www.google.com/about/datacenters/locations/) or in data centres of subprocessors of Google LLC (https://business.safety.google/adssubprocessors/), which may be located in third countries. The SFDI has a data processing agreement with Google LLC, which sets out responsibilities between the exporter (SFDI) and the importer (Google LLC), where Google LLC undertakes to comply with appropriate guarantees and safeguards to ensure a level of protection corresponding to that in the European Union.

3.    Period of Processing and/or Storing Personal Data

Your personal data are processed by the SFDI only for the time strictly necessary for the processing; the periods for inThe SFDI only processes personal data for the absolutely necessary period in the following cases:

1. Records of vehicles in the EMWIS are stored for the validity period of the electronic vignette and for a further 2 years from the end of its validity.
2. Records and data processed due to a change in a license plate number are stored in the EMWIS for the validity period of the electronic vignette and for a further 2 years after the end of its validity.
3. Records and data processed due to a change in a license plate number are stored in the EMWIS for the duration of an exemption from paying for electronic vignettes and for a further 2 years after the grounds for the exemption expire.
4. Records of statements from the Czech National Bank (confirmations of payment) are stored in the program of the record management service for at least 5 years (pursuant to Act No. 563/1991 Coll., on accounting), and their storage and archiving are governed by the Record Management Rules of the SFDI.
5. Records of refunds of payments for electronic vignettes for exempt vehicles are stored in the program of the record management service for at least 3 years, and their storage and archiving are governed by the Record Management Rules of the SFDI.
6. Records of vehicles registered in the electronic toll system are stored in the Register of Vehicles for the entire period that the vehicle is registered in the electronic toll system.
7. Records of allowing checks of payments for electronic vignettes by way of a camera system located on control gates or at mobile control stations are stored in the control gates for 24 hours, after which they may be downloaded to a device of the Police of the Czech Republic / Customs Administration of the Czech Republic, where they may be stored for a further 48 hours.
8. Data from checks by the license plate number recognition system is stored in the EMWIS and in the control gates for 24 hours.
9. Images from slit cameras in self-service kiosks are stored in the self-service kiosk for 5 days after they are captured.
10. Records of submissions in connection with the EMWIS and maintenance of a register of names are stored in the record management system for at least 3 years, and their storage and archiving are governed by the valid Record Management Rules of the SFDI.
    • Documents regarding personal data protection, including the exercise of data subjects’ rights, are stored for at least 5 years.
    • Documents regarding exemptions are stored for at least 3 years.
    • Documents regarding a change of license plate number are stored for at least 3 years.
    • Documents regarding the establishment of access to a distributor’s administration interface are stored for at least 10 years.
11. Data from handled enquiries in the EMWIS is stored in the program of the record management system for at least 3 years, and its storage and archiving are governed by the valid Record Management Rules of the SFDI.
12. Data from maintaining user accounts in the EMWIS for employees of the controller and processors is stored in the EMWIS for the entire validity period of the user account.
13. The period for storing technical, preferential and analytical cookies depends on the individual files; further information on storage periods can be found here.

4.   Rights of the Data Subject

a)     Right to Withdraw Consent

If the SFDI processes your personal data with the data subject’s consent (this does not happen within the Vignette If the SFDI processes personal data on the basis of the data subject’s consent, the data subject shall have the right to withdraw this consent at any time.

b)    Right of Access to Personal Data

Data subjects have the right to request confirmation from the SFDI as to whether or not their personal data is being processed. If the data is being processed, the data subject shall further have the right of access to the data and subsequent information on:

• the purpose of processing;
• categories of the personal data concerned;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed;
• the planned time period for which personal data will be stored or, if this is not possible, the criteria used to determine that time period;
• the existence of the right to require the SFDI to correct or erase personal data or to restrict its processing, or the right to object to such processing;
• the right to lodge a complaint with the Office for Personal Data Protection;
• all available information on the source of personal data;
• whether any automated decision-making is being carried out, including profiling, and information on the procedure used, as well as on the importance and expected consequences of such processing.

The SFDI will provide a copy of processed personal data and information relating to this data free of charge. Only in cases where requests are evidently unfounded or excessive, particularly because they are repeated, may the SFDI impose a reasonable fee according to the Fee Tariff for the provision of information on personal data; the tariff is available here www.sfdi.cz/soubory/gdpr/gdpr_sazebnik_uhrad.pdf. If a request is submitted in electronic format, the SFDI will provide information in the electronic format that is normally used unless the data subject requests a different format.

c)    Right to Rectification

Data subjects who discover an inaccuracy in their personal data have the right to ask the SFDI to correct inaccurate personal data without undue delay. Taking into account the purposes of the processing, they are entitled to have incomplete personal data completed, to which end they can also provide a supplementary statement.

d)    Right to Erasure

Data subjects have the right to request that SFDI delete personal data, if at least one of the following criteria are met:

• the personal data is not necessary for the purposes for which it has been collected or otherwise processed;
• the data subject withdraws consent to the processing of their personal data and there are no other legal reasons for the processing;
• the data subject raises an objection to the data processing and there are no other legal reasons for the processing;
• the personal data has been processed unlawfully;
• the personal data has to be deleted in order to comply with a legal obligation.

• the personal data is not necessary for the purposes for which it has been collected or otherwise processed;
• the data subject withdraws consent to the processing of their personal data and there are no other legal reasons for the processing;
• the data subject raises an objection to the data processing and there are no other legal reasons for the processing;
• the personal data has been processed unlawfully;
• the personal data has to be deleted in order to comply with a legal obligation

The right to erasure shall not apply if there is a legal exception, in particular because personal data processing is necessary:

• for exercising the right to freedom of expression and information;
• for fulfilling a legal obligation that requires processing under European Union law or the law of the Czech Republic, or fulfilling a task that is performed in the public interest or during the exercise of public powers entrusted to the controller;
• for purposes of archiving in the public interest, scientific or historical research purposes, or statistical purposes, where the right to erasure would make it impossible to meet the objectives of the processing or seriously jeopardise these objectives;
• for establishing, exercising or defending legal claims.

e)   Right to Restriction of Processing

Data subjects are entitled to ask the SFDI to restrict processing in any of the following cases:

• the data subject claims that the personal data is inaccurate – the SFDI shall restrict processing for the period necessary to verify the accuracy of the personal data;
• the processing is illegal and the data subject refuses to have the data erased, but asks for its use to be restricted instead;
• the SFDI no longer needs the personal data for processing purposes, but the data subject requests that it be retained for determining, exercising or defending their legal claims;
• the data subject raises an objection to the processing pending verification as to whether the legitimate grounds of the SFDI override those of the data subject.

If processing has been restricted, the personal data may, with the exception of storage of such personal data, only be processed with the data subject’s consent or in order to establish, exercise or defend legal claims, for the purpose of protecting the rights of another natural person or legal entity, or on the grounds of an important public interest of the European Union or the Czech Republic.

f)    Right to Data Portability

Data subjects shall have the right to obtain personal data pertaining to their persons in a structured, commonly used and machine-readable format, and to request the transmission of such data to another controller without hindrance from the SFDI in cases where:

• the personal data is processed on the grounds of the data subject’s consent;
• processing is performed automatically.

If it is technically possible, the SFDI shall hand the data over to a different controller at the data subject’s request. This right shall not apply if the processing is required for performing a task carried out in the public interest or in the exercise of public powers entrusted to the SFDI as the controller.

g)    Right to Object

Data subjects may object to the processing of their personal data at any time if the legal grounds claimed for its processing is to fulfil a task performed in the public interest or in the exercise of public powers, or the processing is necessary for legitimate interests of the controller, including profiling based on these provisions. The SFDI shall not further process the personal data unless it can prove that there are serious legitimate reasons for its processing that override the interests or rights and freedoms of the data subject or that the processing is necessary for establishing, exercising or defending legal claims.

h)   Right not to Be Subject to Automated Individual Decision-Making, Including Profiling

Data subjects have the right not to be subject to any decisions based solely on automated processing, including profiling, which have legal effects for the data subject or significantly affect the data subject in a similar manner.

i)    Right to Lodge a Complaint

Data subjects are entitled to lodge a complaint with the Czech Office for Personal Data Protection, which is based at the address: pplk. Sochora 27, 170 00 Prague 7, Czech Republic; phone: +420 234 665 111; web: http://www.uoou.cz/, if they believe that the SFDI has processed their personal data in violation of the General Data Protection Regulation.

5.       Exercise of the data subject’s rights

To submit a request to exercise your rights, please first fill in the relevant PDF form, which you can send to us by any of the means listed below. In view of the possible risks of abuse and in order to ensure the protection of the personal data of subjects (customers, employees, suppliers, etc.), the SFDI limits the communication channels through which it can receive and respond to your requests to exercise your rights. For unambiguous identification of the data subject, we require the following personal data: name, surname, date of birth and permanent residential address

1. To the data box designated for electronic vignette administration with the identifier ws5mh9w at the website https://www.mojedatovaschranka.cz/.
2. By email to the address epodatelna@edalnice.cz (PDF form filled in electronically or a scanned filled-in PDF form with an electronic signature, with which special legislation combines the effects of a handwritten signature, or you can have a printed and completed form electronically converted at official locations marked with the Czech Point logo);
3. By letter via a postal service provider with an officially authenticated signature to the address: Státní fond dopravní infrastruktury, Sokolovská 1955/278, 190 00 Prague 9, Czech Republic.
4. If you do not have access to the internet, you can write a notification in a free form, stating the particulars required by law and bearing an officially verified signature or a power of attorney, and send it to the address of the SFDI headquarters.

Form for download

Request for exercising rights as a data subject

If you send a request to SFDI contact addresses that are not communication channels for submitting requests to exercise your rights, your request will also be forwarded for processing.

---