GDPR and Personal Data

Basic information on the processing of personal data

1.     Purposes and Scope of Personal Data Processing

SFDI and its processors process your personal data both manually and automatically. Automated decision-making and profiling are involved in obtaining information from the Register of Motor Vehicles.  This automated decision-making and profiling is permitted by Act No. 13/1997 Coll., on roads, as amended (hereinafter referred to as the ‘Roads Act’). This decision allows the client to automatically exempt or determine the price of the electronic vignette (hereinafter referred to as the ‘time fee’). All your personal data is processed by SFDI employees or employees of processors who are bound by confidentiality and binding internal regulations or contractual relationship between SFDI and the processor with regard to the protection of personal data.

a) Vehicle registration in EDPS IS

For this purpose, the following data is processed by SFDI or the processors (CENDIS, s.p. and in the case of payment at a commercial outlet, Česká pošta, s.p. or ČEPRO, a.s.):

• Licence plate number (including the state of registration);
• The beginning and end of the period for which the time fee is paid;
• Information on fuel type (biomethane, natural gas, plug-in hybrid);
• Bank account number or (incomplete) credit card number;
• Date and time of order creation;
• Date, place and time of payment;
• E-mail or phone number
  • E-mail for sending confirmation;
  • E-mail for sending notifications;
  • Phone number for sending notifications.
• Information on:
  • change of the licence plate number (in the case of information from the Register of Motor Vehicles or from a notification);
  • exemption of vehicles from time charging (in case of information from the Register of Motor Vehicles or from a notification);
  • the reason for vehicle exemption from time charging has passed (in the case of information from the Register of Motor Vehicles or from a notification);
  • refund of the time fee paid (from the notification).

SFDI obtains this data directly from users, processors or from the Register of Motor Vehicles of the Czech Republic (hereinafter referred to as ‘RMV’). In the case of failure to provide personal data (licence plate number including the state of registration, the beginning and end of the period of the time fee, information about the vehicle’s fuel type and the e-mail to which the confirmation is sent, in the case of payment on edalnice.cz), the payment of the time fee for the vehicle cannot be recorded in the EDPS IS.

Personal data is stored in the EDPS IS for a period of 2 years from the end of the period for which the time fee was paid. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of official authority pursuant to the PDPA.

b) Change to the licence plate number

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• the original licence plate number (including the country of registration);
• new licence plate number (including the country of registration).

For vehicles registered in the RMV, information on the change of the licence plate number is updated without the need to submit a Notification of a change of licence plate number. For vehicles that are not registered in the RMV, a Notification of a change of licence plate number is required and the following information must be provided:

• personal data of the notifier:
  • Name and surname;
  • Phone number and e-mail (if provided);
  • Mailing address;
• personal data of the owner
  • Personal data contained in a vehicle registration certificate or other document evidencing a change of the licence plate number;

The SFDI obtains this data directly from the notifiers or from the RSV. In the case of failure to provide personal data, the change of the licence plate number cannot be recorded.

In the case of submission of a Notification of a change of licence plate number, the data is stored in the electronic file service (hereinafter referred to as ‘TESS’) or the SFDI file service according to the valid SFDI File Rules. The storage period is a minimum of 10 years. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of public authority, which is entrusted to the administrator pursuant to Act No. 499/2004 Coll., on archiving and filing services, as amended.

In the case of the data contained in the Vehicle Register in the EDPS IS, (the licence plate number and information on the change of the licence plate number), the data is treated according to EDPS IS Vehicle Register paragraph a). 

c) Recording the exemption of vehicles from the time fee

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• the licence plate number (including the country of registration).

For vehicles registered in the RMV, the exemption information is updated without the need to submit a Notification of exemption from the time fee if the information needed for the exemption is available in the RSV. For vehicles that are not registered in an RMV, a Notification of exemption from the time fee is required and the following information must be provided:

• personal data of the notifier:
  • Name and surname;
  • Date of birth;
  • Phone number and e-mail (if provided);
  • Mailing address;
  • A certified signature or its electronic equivalent.
• personal data of the owner
  • Personal data contained in the vehicle registration certificate or other document proving entitlement to the exemption;
  • Power of attorney document (if the notifier is being represented).

The SFDI obtains this data directly from the notifiers or from the RMV. In case of non-provision of personal data, the exemption of the vehicle from the time fee cannot be recorded.

In case of submission of a Notification of exemption from time charging, the data is stored in TESS or the SFDI file service according to the valid SFDI File Rules. The storage period is a minimum of 3 years. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of public authority, which is entrusted to the administrator pursuant to Act No. 499/2004 Coll., on archiving and filing services, as amended.

In the case of data that is in the Vehicle Register in the EDPS IS, (the registration number and the reason for the exemption of vehicles from time charging), the data is treated according to EDPS IS Vehicle Register paragraph a).

d) Recording the lapse of the grounds for exemption of vehicles from the time fee

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• the licence plate number (including the country of registration).

For vehicles registered in an RMV, the information on the lapse of the grounds for exemption shall be updated without the need to submit a notification of the lapse of the grounds for exemption from the time fee if the information necessary for the lapse of the grounds for exemption is available in the RMV. For vehicles that are not registered in the RMV, a notification of the lapse of the grounds for exemption from the time fee is required and the following information must be provided:

• personal data of the notifier:
  • Name and surname;
  • Date of birth;
  • Phone number and e-mail (if provided);
  • Mailing address;
  • A certified signature or its electronic equivalent.
• personal data of the owner or operator:
  • Power of attorney document (if the notifier is being represented).

The SFDI obtains this data directly from the notifiers or from the RMV. In the case of non-provision of personal data, the lapse of the grounds for exempting the vehicle from the time fee cannot be recorded.

In the case of a notification of the lapse of the grounds for exemption of a vehicle from the time fee, the data is stored in TESS or the SFDI file service according to the valid SFDI File Rules. The storage period is a minimum of 3 years. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of public authority, which is entrusted to the administrator pursuant to Act No. 499/2004 Coll., on archiving and filing services, as amended.

In the case of data that is in the EDPS IS Vehicle Register, (licence plate number) the data is treated according to EDPS IS Vehicle Register paragraph a).

e) Refund of the vignette price

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• the licence plate number (including the country of registration).
• personal data of the notifier:
  • Name and surname;
  • Phone number and e-mail (if provided);
  • Mailing address;
  • Bank account number (if provided);

The SFDI obtains this data directly from notifiers. In case of failure to provide personal data, the refund of the time fee paid cannot be realised.

In the event of a refund of the paid time fee, the data is stored in TESS or the SFDI file service according to the valid SFDI File Rules. The storage period is a minimum of 3 years. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of public authority, which is entrusted to the administrator pursuant to Act No. 499/2004 Coll., on archiving and filing services.

In the case of data that is in the IS EDPS Vehicle Register, (state number plate), the data is handled in accordance with Act No. 89/2012 Coll., the Civil Code, as amended.

f) Records of vehicles registered in the electronic toll collection system

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• Licence plate number (including the state of registration);
• Information that the vehicle is registered in the electronic toll collection system.

SFDI obtains this data directly from the electronic toll operator.

In the case of the Register of Vehicles registered in the electronic toll collection system, the data is stored in the EDPS IS. The storage period is for the duration of the vehicle’s registration in the electronic toll collection system.  The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of official authority pursuant to the PDPA.

g) Enabling control of the time fee payment by means of a camera system installed at control gates or mobile control stations

For this purpose, the following data is processed by SFDI or processors (CENDIS, s.p.; Police of the Czech Republic; Customs Administration of the Czech Republic):

• A photograph (may include personal details of the driver or passenger) with the place and time of taking;
• The licence plate number (including the state of registration).

This data is obtained by SFDI through cameras placed at control gates or mobile checkpoints.

For checking of the vignette payment, the data is stored at the control gates or at the facilities of the Police of the Czech Republic / Customs Administration of the Czech Republic. The storage period is 24 hours from the time of acquisition and it can then be downloaded to the facility of the Police of the Czech Republic / Customs Administration of the Czech Republic, where it can be stored for another 48 hours. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of official authority pursuant to the PDPA.

h) Check of the licence plate recognition algorithm

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• the licence plate number (including the state of registration of the vehicle) – a crop of the photograph.

SFDI obtains this data through cameras placed at the control gates.

To enable the check of the licence plate recognition algorithm, the data is stored at the control gates and in the EDPS IS. The storage period is 24 hours from the time of acquisition. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of official authority pursuant to the PDPA.

i) Inspection of self-service kiosks via a slit camera

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• Camera footage (containing personal data of the user of the self-service kiosk) with the place and time of capture.

SFDI obtains this data through cameras placed on self-service kiosks.

In the case of self-service kiosk controls, the data is stored in the kiosks. The storage period is 5 days from the time of acquisition. The purpose for the processing of personal data is the legitimate interest of the controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

j) Handling other submissions, including enquiries, in relation to the electronic vignette

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• personal data of the notifier/enquirer:
  • Name and surname;
  • Date of birth;
  • Address of residence;
  • Phone number and e-mail;
  • A certified signature or its electronic equivalent.

 The SFDI obtains this personal data from notifiers or enquirers.

In the case of handling other submissions, including enquiries, in connection with the electronic vignette, the data is stored in TESS or the SFDI file service according to the valid SFDI File Rules. As a rule, the storage period is at least 5 years, but for requests for the provision of personal data contained in the EDPS IS, the period is at least 5 years. In the case of a request from an authorised person to access the administration interface, for a minimum period of 10 years. The purpose for the processing of personal data is the performance of a task in the public interest or in the exercise of public authority, which is entrusted to the administrator pursuant to Act No. 499/2004 Coll., on archiving and filing services, as amended.

k) Maintenance of user accounts for staff of the administrator and processors and their authorisation in the EDPS IS

For this purpose, the following data is processed by SFDI or the processor (CENDIS, s.p.):

• personal data of the controller’s employees or processors:
  • Name and surname;
  • Phone number and e-mail

SFDI obtains this personal data from processors.

In the case of user accounts, the data is stored in the EDPS IS. The storage period is usually for the duration of the user account. The purpose for the processing of personal data is the legitimate interest of the controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

l) Use of technical, preference and analytics cookies

For this purpose, the following data is processed by SFDI or by processors (CENDIS, s.p.; Google LLC):

• personal data of site visitors:
  • IP address.

This personal data is obtained by SFDI via cookies.

The processing of technical cookies is carried out on the basis of necessity for the purposes of the legitimate interests of the respective controller or third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the data subject. The storage period is indicated by individual cookies here.

The processing of preferential and analytical cookies is based on the data subject’s consent to the processing of their personal data. The storage period is indicated by individual cookies here.

2.     Passing On Your Personal Data and Recipients of Your Data

Your personal data may be passed on to state administration bodies to whom the SFDI is obliged to pass on personal data in accordance with legislation, especially the Roads Act.

Your personal data will be made available to CENDIS, s.p., which created the EMWIS and which also provides you with the Call Centre service, but is not entitled to pass on your personal data to third parties, to use your data for its own purposes, or to include your data in services provided to third parties. To allow checks of payment of electronic vignettes, your personal data may be made available or passed on to the Police of the Czech Republic and the Customs Administration of the Czech Republic.  

The SFDI will not pass on personal data other than IP addresses to third countries, nor provide them to international organisations. IP addresses may be processed in data centres of Google LLC (https://www.google.com/about/datacenters/locations/) or in data centres of subprocessors of Google LLC (https://business.safety.google/adssubprocessors/), which may be located in third countries. The SFDI has a data processing agreement with Google LLC, which sets out responsibilities between the exporter (SFDI) and the importer (Google LLC), where Google LLC undertakes to comply with appropriate guarantees and safeguards to ensure a level of protection corresponding to that in the European Union.

3.   Rights of the Data Subject

a)     Right to Withdraw Consent

If the SFDI processes your personal data with the data subject’s consent (this does not happen within the Vignette If the SFDI processes personal data on the basis of the data subject’s consent, the data subject shall have the right to withdraw this consent at any time.

b)    Right of Access to Personal Data

Data subjects have the right to request confirmation from the SFDI as to whether or not their personal data is being processed. If the data is being processed, the data subject shall further have the right of access to the data and subsequent information on:

• the purpose of processing;
• categories of the personal data concerned;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed;
• the planned time period for which personal data will be stored or, if this is not possible, the criteria used to determine that time period;
• the existence of the right to require the SFDI to correct or erase personal data or to restrict its processing, or the right to object to such processing;
• the right to lodge a complaint with the Office for Personal Data Protection;
• all available information on the source of personal data;
• whether any automated decision-making is being carried out, including profiling, and information on the procedure used, as well as on the importance and expected consequences of such processing.

The SFDI will provide a copy of processed personal data and information relating to this data free of charge. Only in cases where requests are evidently unfounded or excessive, particularly because they are repeated, may the SFDI impose a reasonable fee according to the Fee Tariff for the provision of information on personal data; the tariff is available here www.sfdi.cz/soubory/gdpr/gdpr_sazebnik_uhrad.pdf. If a request is submitted in electronic format, the SFDI will provide information in the electronic format that is normally used unless the data subject requests a different format.

c)    Right to Rectification

Data subjects who discover an inaccuracy in their personal data have the right to ask the SFDI to correct inaccurate personal data without undue delay. Taking into account the purposes of the processing, they are entitled to have incomplete personal data completed, to which end they can also provide a supplementary statement.

d)    Right to Erasure

Data subjects have the right to request that SFDI delete personal data, if at least one of the following criteria are met:

• the personal data is not necessary for the purposes for which it has been collected or otherwise processed;
• the data subject withdraws consent to the processing of their personal data and there are no other legal reasons for the processing;
• the data subject raises an objection to the data processing and there are no other legal reasons for the processing;
• the personal data has been processed unlawfully;
• the personal data has to be deleted in order to comply with a legal obligation.
• the personal data is not necessary for the purposes for which it has been collected or otherwise processed;
• the data subject withdraws consent to the processing of their personal data and there are no other legal reasons for the processing;
• the data subject raises an objection to the data processing and there are no other legal reasons for the processing;
• the personal data has been processed unlawfully;
• the personal data has to be deleted in order to comply with a legal obligation

The right to erasure shall not apply if there is a legal exception, in particular because personal data processing is necessary:

• for exercising the right to freedom of expression and information;
• for fulfilling a legal obligation that requires processing under European Union law or the law of the Czech Republic, or fulfilling a task that is performed in the public interest or during the exercise of public powers entrusted to the controller;
• for purposes of archiving in the public interest, scientific or historical research purposes, or statistical purposes, where the right to erasure would make it impossible to meet the objectives of the processing or seriously jeopardise these objectives;
• for establishing, exercising or defending legal claims.

e)   Right to Restriction of Processing

Data subjects are entitled to ask the SFDI to restrict processing in any of the following cases:

• the data subject claims that the personal data is inaccurate – the SFDI shall restrict processing for the period necessary to verify the accuracy of the personal data;
• the processing is illegal and the data subject refuses to have the data erased, but asks for its use to be restricted instead;
• the SFDI no longer needs the personal data for processing purposes, but the data subject requests that it be retained for determining, exercising or defending their legal claims;
• the data subject raises an objection to the processing pending verification as to whether the legitimate grounds of the SFDI override those of the data subject.

If processing has been restricted, the personal data may, with the exception of storage of such personal data, only be processed with the data subject’s consent or in order to establish, exercise or defend legal claims, for the purpose of protecting the rights of another natural person or legal entity, or on the grounds of an important public interest of the European Union or the Czech Republic.

f)    Right to Data Portability

Data subjects shall have the right to obtain personal data pertaining to their persons in a structured, commonly used and machine-readable format, and to request the transmission of such data to another controller without hindrance from the SFDI in cases where:

• the personal data is processed on the grounds of the data subject’s consent;
• processing is performed automatically.

If it is technically possible, the SFDI shall hand the data over to a different controller at the data subject’s request. This right shall not apply if the processing is required for performing a task carried out in the public interest or in the exercise of public powers entrusted to the SFDI as the controller.

g)    Right to Object

Data subjects may object to the processing of their personal data at any time if the legal grounds claimed for its processing is to fulfil a task performed in the public interest or in the exercise of public powers, or the processing is necessary for legitimate interests of the controller, including profiling based on these provisions. The SFDI shall not further process the personal data unless it can prove that there are serious legitimate reasons for its processing that override the interests or rights and freedoms of the data subject or that the processing is necessary for establishing, exercising or defending legal claims.

h)   Right not to Be Subject to Automated Individual Decision-Making, Including Profiling

Data subjects have the right not to be subject to any decisions based solely on automated processing, including profiling, which have legal effects for the data subject or significantly affect the data subject in a similar manner. This shall not apply where the decision is necessary for the conclusion of a contract or the performance of a contract between the data subject and the controller, is authorised by Union or member state law applicable to the controller and which also provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject or is based on the data subject’s explicit consent.

i)    Right to Lodge a Complaint

Data subjects are entitled to lodge a complaint with the Czech Office for Personal Data Protection, which is based at the address: pplk. Sochora 27, 170 00 Prague 7, Czech Republic; phone: +420 234 665 111; web: http://www.uoou.cz/, if they believe that the SFDI has processed their personal data in violation of the General Data Protection Regulation.

4.       Exercise of the data subject’s rights

To submit a request to exercise your rights, please first fill in the relevant PDF form, which you can send to us by any of the means listed below. In view of the possible risks of abuse and in order to ensure the protection of the personal data of subjects (customers, employees, suppliers, etc.), the SFDI limits the communication channels through which it can receive and respond to your requests to exercise your rights. For unambiguous identification of the data subject, we require the following personal data: name, surname, date of birth and permanent residential address

1. To the data box designated for electronic vignette administration with the identifier ws5mh9w at the website https://www.mojedatovaschranka.cz/.
2. By email to the address epodatelna@edalnice.cz (PDF form filled in electronically or a scanned filled-in PDF form with an electronic signature, with which special legislation combines the effects of a handwritten signature, or you can have a printed and completed form electronically converted at official locations marked with the Czech Point logo);
3. By letter via a postal service provider with an officially authenticated signature to the address: Státní fond dopravní infrastruktury, Sokolovská 1955/278, 190 00 Prague 9, Czech Republic.
4. If you do not have access to the internet, you can write a notification in a free form, stating the particulars required by law and bearing an officially verified signature or a power of attorney, and send it to the address of the SFDI headquarters.

Form for download

Request for exercising rights as a data subject

If you send a request to SFDI contact addresses that are not communication channels for submitting requests to exercise your rights, your request will also be forwarded for processing.

---