Privacy Policy

Introduction

Through this Privacy Policy, Metrostav DIZ a.s. (hereinafter the “Company”) informs data subjects, i.e. natural persons whose personal data it processes, about the principles for protection of their privacy and about the processing activities carried out (pursuant to the European Union’s data protection regulation, known as the “GDPR”).

 

Basic Information about Personal Data Processing

The Privacy Policy applies to all the Company’s clients, suppliers and customers, and to anyone else who contacts the Company or otherwise provides or discloses any personal data to the Company (unless otherwise stated below). This means all people who use the Company’s services, provide services or subcontracting, or are in any other relationship with the Company.

Personal data processing is carried out both manually and automatically in the Company’s information systems. Where data subjects’ personal data are processed through information systems, no automated decision-making takes place.

 

Data Controller

The personal data controller is Metrostav DIZ a.s., with its registered office at Koželužská 2450/4, Prague 8, post code: 180 00, business ID number: 06339697.

 

What Data Does the Company Collect

The Company collects the following categories of data:

  1. Data provided by data subjects themselves;

Information provided on the following occasions:

  • on the conclusion of a contractual relationship between the data subject and the Company, or for the purposes of the establishment of such contractual relationship;
  • data provided for the implementation of a contract;
  • if the data subject contacts the Company and requests or offers to supply its services or goods;
  • when communicating with the Company via e-mail;
  • if the data subject contacts the Company for another reason.
  1. Information from Other Sources

Such sources include:

  • publicly available sources, including public registers and the internet;
  • information received by the Company from third parties, such as the data subject’s employer, associates or business partners, which is necessary for the performance of the contract or legal duties.

The Company may combine the information collected from such sources with other information it obtains through its own activities, i.e. processing and evaluation of personal data already collected.

 

How the Company Uses Personal Data

The Company uses the data collected for the following purposes:

  1. Protection of Property, Security and Other Rights of the Company and Third Parties

The Company has a legitimate interest in protecting its property and rights, as well as those of third parties. For this purpose, construction sites, office buildings and premises of the Company may be secured by a CCTV system and a system recording visitors.

The Company uses the personal data exclusively for the stated purpose and keeps CCTV recordings for three days, in accordance with the opinion of the Office for Personal Data Protection. Records of visits containing only the necessary personal data (most frequently first name and surname, document number, employer’s details and vehicle registration number) are kept by the Company for a maximum of 90 days.

  1. Reaching Out for Cooperation

The Company may use the contact information to request services and products from its current and potential suppliers. In doing so, it acts in the mutual legitimate interest in business cooperation. In the event that the data subject is no longer interested in being contacted by the Company, he/she may use any of the Company’s contact details and communicate this fact to the Company.

  1. Construction Activity

The Company uses the data for actual implementation and records of orders, for communication with clients, customers and suppliers and for the performance of all related contractual and legal duties.

  1. Bookkeeping

The Company uses the data to issue accounting documents and maintain accounting records pursuant to the statutory requirements.

  1. Marketing in the Sense of Offering Our Company’s Services

The Company may use its suppliers’ personal data for the purpose of submitting bids for the procurement procedures and public contracts for which it competes.

Personal data are processed for this purpose based on the mutual legitimate interest in the performance of business plans and the conclusion of the relevant contracts, or based on explicit consent to the processing of personal data in the CED internal information system.

  1. Marketing in the Sense of Offering the Company’s Services

The Company may use data subjects’ personal data for the following purposes:

  • their publication in promotional printed materials or on the Company’s website, including its social media profile, based on consent granted;
  • sending information and news, e.g. by sending printed materials, either based on consent or based on a mutual legitimate interest in the event of a contractual or similar relationship between the Company and the data subject. In the event the data subject is no longer interested in being contacted in such way, he/she may use any of the Company’s contact details and communicate this fact to the Company.

If the Company organises a promotional, educational or other social event, it may make a photographic or audiovisual record of the event and publish such record on its website, on social media or in other marketing materials, to inform about the event and its proceedings. The records are not made with the intention of processing any personal data and therefore no processing of personal data takes place.

  1. Legal Proceedings and Defence of Legal Claims

The Company may use the data collected to enforce claims, resolve disputes and protect its rights and legitimate interests pursuant to applicable legal regulations.

  1. Legal Proceedings and Defence of Legal Claims

If a data subject contacts the Ethics Hotline with a specific complaint, he/she consents to the processing of his/her personal data for the purpose of investigating the complaint for a period of time appropriate for the investigation of the complaint and the taking of corrective action.

In the event that a data subject’s personal data are disclosed to the Company by a third party on the Ethics Hotline, the Company processes the data only to the extent and for the period of time necessary to investigate the complaint and take corrective action, all in the legitimate interest of the Company and third parties in complying with all legal duties.

 

Sharing and Transferring Data

The Company may share the data collected:

  1. with other companies in the Metrostav Group

The Company may provide information or allow access to it for legal entities—companies forming the Metrostav Group. A list of all Metrostav Group members is available on the website https://www.skupinametrostav.cz/cs/. All companies in the Metrostav Group are bound by the duty of confidentiality and comply with applicable legal regulations on data protection.

  1. with business partners

The Company may provide information or allow access to it to its associates, clients, suppliers, consultants, software providers, insurance companies, audit firms and other service providers or business partners, if they provide services to the Company that involve personal data processing. In no case does it provide personal data, whether or not in return for consideration, to third parties without a statutory reason.

All the Company’s contractual partners are bound by the duty of confidentiality and comply with the applicable legal regulations on personal data protection.

  1. for legal reasons or in case of disputes

The Company may share personal data when required to do so by legal regulations:

  • with the Police of the Czech Republic and courts, government authorities or other third parties, if necessary to comply with the Company’s legal duties, to enforce its legal claims or to protect the rights or property of the Company or third parties;
  • with other parties in connection with any merger, sale of property, consolidation or restructuring, financing or transfer of the Company or any part thereof to the ownership of another company.
  1. with a data subject’s consent

The Company may also share personal data in other ways and with other entities, if the data subject explicitly agrees to this.

The Company may transfer personal data outside the EU where necessary, in particular when it carries out business or construction activities abroad. In such case, the Company always complies with the applicable legal regulations regarding the transfer of personal data abroad.

 

What rights does the data subject have in relation to personal data processing?

The data subject may exercise the rights set out below in relation to the processing of his/her personal data by the Company. He/she may use the Company’s contact details listed at the end of this information to make a request.

  1. Retention and Erasure of Data

All personal data are always kept by the Company for the time necessary to comply with the purpose for which the personal data are processed, in particular for the time:

  • set out by the act or other generally binding legal regulation;
  • set out in the consent granted;
  • of the duration of the contractual relationship with the Company and as standard for ten (10) years after its termination, unless other statutory archiving periods are specified.

The Company will erase personal data as soon as the data subject requests it, unless there is a legitimate reason for further processing, for example:

  • the statutory archiving periods have not expired;
  • the Company is dealing with the data subject in relation to an issue, such as a pending dispute or legal claim;
  • the data are held by the Company in aggregated or anonymous form;
  • the Company needs such data for legitimate business purposes.
  1. Access to Personal Data

The Company may also share personal data in other ways and with other entities, if the data subject explicitly agrees to this.

 

  1. Change to Personal Data or Error in Data

If, for example, during the course of the contractual relationship between the data subject and the Company, there is any change in the personal data, such as a change of name, residence, e-mail address or telephone number, or if the data subject finds that the Company is working with outdated or incorrect data, he/she has the right to notify the Company and request the rectification or modification of the personal data.

  1. Restriction on Processing

If the data subject thinks that:

  • the Company is processing inaccurate data about him/her (and the Company ascertains this is the case);
  • the personal data processing is unlawful on the Company’s part and the data subject does not wish to have all the data erased;
  • the Company no longer needs his/her personal data for the above purposes, but the data subject would like to use them to defend his/her legal claims, for example in court proceedings;
  • the Company does not have a legitimate interest in particular processing of personal data (and the Company ascertains this is the case), the data subject may ask the Company to restrict the processing of only some of his/her personal data or only to process it for certain purposes.
  1. Data Portability

At any time, the data subject may ask the Company to transfer his/her personal data held by the Company to a third party, as specified by the data subject.

  1. Objection to Processing

If the Company processes personal data based on the controller’s legitimate interest, the data subject may object to such processing in accordance with the instructions set out directly in the text of this policy.

  1. Withdrawal of Consent to Personal Data Processing

If personal data processing is based on the data subject’s consent, this consent may be withdrawn in writing (including by e-mail) at any time.

  1. Right to Request

If the data subject thinks that the Company is handling his/her data in conflict with the law, at any time he/she may contact the executive officer for the Company’s administration or, where appropriate, the Office for Personal Data Protection.

 

Controller’s contact details:

Metrostav DIZ a.s.
Koželužská 2450/4, 180 00 Prague 8
e-mail: osobniudaje.DIZ@metrostav.cz