: Information on personal data processing

  • Introduction

    Dear Customers, Business Partners, Visitors and Users of information systems or applications,

    By this document, we would like to inform you of the terms and conditions of processing your personal data in our company and of the manner and scope of our personal data processing within the ČEZ Group. We also inform you in this way of the protection of personal data and of your rights related to their processing.

    ČEZ, a. s., together with other companies, is a member of the ČEZ Group and control it as a managing entity.

    When processing your personal data in the ČEZ Group, we act in compliance with European Union legislation, particularly compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), which comes into force on May 25, 2018 as a direct effective legal regulation also in the legal order of the Czech Republic, and also compliance with the relevant intrastate legal regulations, particularly the Personal Data Protection Act.

    Privacy and personal data protection is important for us. This information about personal data processing (hereinafter “Information”) specifies the personal data collected by the ČEZ Group member companies from you or about you through communication with you in connection with use of the products and services they provide to you or in connection with other business relations between you. And, if applicable, which personal data they obtain from other entities or sources and how they use these data.

    Besides this summary information, you will also find some details of the processing of your personal data in the documents, which we provide to you within the scope of mutual communication, or which will be displayed for you on the websites used by the ČEZ Group companies to simplify and speed up communication with you.

  • Personal data controller

    The controller of your data is always the ČEZ Group company, to which you provided or that obtained them from you for fulfillment of one or more purposes. The company that provides you with products or services or your business partner usually controls your data. If you are a customer of several ČEZ Group companies, each of these companies controls your personal data related to its product, service or other business relationship.

    If the Controller of your personal data is company ČEZ, a. s., ID No: 45274649, having its registered office at Duhová 2/1444, 140 53 Prague 4, incorporated in the Commercial Register at the Municipal Court in Prague under File No. B 1581 (hereinafter “ČEZ, a. s.” or “Our company”), you will find more detailed information about processing of your personal data below.”

  • The personal data, which we process

    We process your personal data only to the extent that enables us to provide you with the products and services that you are interested in, respectively only the data necessary for our correct mutual business cooperation. And also to enable us to fulfill our legal obligations and ensure protection of our justified interests related to our mutual relationships.

    For this reason, we collect and process your data mainly as users of our products and services, and our business partners, including potential future customers and business partners who are interested in our products and services or in business cooperation with us, or who we have contacted with our offer. According to the specific situation, we also process the data of, for instance, the participants of professional, social and other events organized by us or the representatives of legal entities, including the members of the statutory and other bodies.

    For these purposes, our company mainly processes the following categories of personal data:

  • Additional data

    We also process data, which are closely related to the way in which you use our products or services, or the data that are related to the nature of our business cooperation or the type of event we organize and you are participating in. Or other information you provide to us during the above-mentioned types of relationships. We consider such data to be particularly:

    • bank account number,
    • customer number, EAN, business partner number, signature
    • supplier's identification number,
    • access ID card number (if assigned)
    • access ID and password to the user's personal account (if created)
    • video recordings from CCTV systems,
    • IP address, cookies and other personal data arising from fulfilment of a concrete contract or relevant legal regulation.

    We also process data that is closely related to the realization of the exercise of rights and obligations under our contracts, your status as an employee of another company that is a business partner of ČEZ, your use or access to our objects or objects managed by us and the way you use our products and services. We process the data you provide to us during the use of the services or the performance of the above activities, or any data that arise from the nature of our business cooperation or cooperation with your employer, as well as data from the ČEZ Information Systems, CCTV systems, publicly available sources, and other personal data resulting from the performance of a particular agreement or applicable law.

  • You are negotiating our product or service

    When you negotiate a product or service with us or you are only interested in it, you provide us with basic data or additional data necessary for us to jointly conclude a contract, or for us to be able to assess if we can provide you with the product or service and if so, which one.

  • You are cooperating with us as a business partner

    When you negotiate a cooperation as a business partner with us or you are only interested in this cooperation, you provide us with basic data or additional data necessary for us to jointly conclude the contract, respectively for us to be able to assess if we are interested in your offer of cooperation.

  • You are communicating with us

    We also obtain your personal data when you communicate with us. There is no difference in whether you communicate with us electronically, by post, by phone, during a personal visit, or perhaps via a data box. If the personal data obtained in this manner apply to the product or service provided by us, the realization of the exercise of rights and obligations of our contracts, the performance of our business, our company is the controller of the provided data.

  • CCTV recordings

    If CCTV recordings are made in our buildings or in the buildings of other ČEZ Group companies, your personal data, if any, are controlled by the ČEZ Group company, which operates these CCTV systems.

  • Websites and applications

    When using our websites and applications, your data are processed by our company. If we, in some cases, commissioned another company to run our website, or we operate it together with another company, that is indicated in the given part of the electronic channel (for instance, the foot of the website).

  • You are an employee of our business partner

    If you are an employee of our business partner who provides us with products or services, your potential personal data is controlled by the above-mentioned business partner - your employer who is obliged to provide you with the basic information on the processing of personal data that he gives us in connection with the agreed performance under the negotiated contract. If our business cooperation with your employer is related to the operation of nuclear power plants, we will inform you separately about selected details of further processing of your personal data, depending on the nature of your job.

  • Purposes of personal data use

    We use your personal data, depending on the nature of our relationship with you, particularly for the following purposes:

    • provision of services of operators of transmission system and operators of market,
    • provision of trading with commodities and provision of related services,
    • documentation of transactions on the wholesale energy market,
    • provision of evidence for billing of production from small renewable sources,
    • conclusion of purchase and sales contracts for materials, services and investment,
    • records and management of business contracts,
    • registration of persons entering the areas with radiation activities and personal doses of radiation,
    • verification of psychological capability for independent access to the guarded area of nuclear power plants,
    • evidence of surface contamination in the area of radiation protection
    • investigation of events and violation of radiation protection rules
    • ensuring the protection of the life and health of persons, and tangible and intangible property,
    • ensuring cyber security,
    • use of biometric data to ensure access to secured areas to protect classified information,
    • communications to inform business partners and the public,
    • registration of participation in activities organized by ČEZ Group,
    • fulfillment of accounting and tax obligations,
    • realization of the exercise of rights and obligations under the contracts.

    In practice, you will most frequently encounter the following situations:

  • Cooperation with customers and business partners

    Identification and authentication

    For us to be able to conclude a contract with you and provide our products or services to you, respectively use your products or services, we must know your basic data. We require your identification and authentication also in a case where you exercise your rights in matters of personal data protection.

    Our reason for processing your data:

    • to conclude and fulfill your contract
    • to fulfill legal obligations
  • Preparation of a contract at your request

    We collect and process only the data that are required and necessary for drafting your contract. For us to be able to conclude the contract with you, we require your name, date of birth or your ID and contact data. A further data area depends on the type of product or service, or type of business cooperation, which is the scope of contract.

    Our reason for processing your data:

    • for preparation of your contract
    • to fulfill legal obligations
  • Use of websites and the on-line environment

    For this purpose, we process information about which devices you use to electronically access our services, your preferred service settings and the data, which you enter on our websites, because we want to ensure that you can comfortably use our websites. We store the data on your devices in the form of, so-called, cookies. Using these cookies, we can respect your choice of language, and also keep the data you have entered into the web forms in case you would like to return to them later. We shall separately notify you of processing of the cookies.

    Our reason for processing your data:

    • to conclude and fulfill your contract
    • based on your consent (in the case of cookies)
  • Cookies

    We use cookies for personalization of the content and advertising, provision of the functions of the social media and analysis of the traffic on our corporate website. We share the information about how you use our website with our partners for the social media, advertising and analysis. The partners may combine these data with other information, which you provided to them or obtained in connection with your use of their services. Detailed information about the cookie files is available here.

  • Use of products and services

    Your selection of our products and use of our services results in our processing your data. This mainly concerns your basic data, information about the products and services or business cooperation. We register, control and keep them up-to-date in cooperation with you. On the electronic portals, which you use to operate the products, we display the basic information about you and our products and we control this information in order to ease the operation of the products and services for you.

    Our reason for processing your data:

    • to fulfill your contract
  • Consent to processing of personal data

    During our business or other relationship there may be situations associated with the possible processing of some of your personal data that we will not be able to use for a particular purpose without your consent. For example, some of your photos that you are uniquely identified with, voice or image recordings of your person, and more detailed information about your person. Our company may be interested to use them especially for communication, promotional or training activities.

    We will inform you of such situations separately and offer you the opportunity to give our company the consent to use your precisely defined personal data for the specific purpose described and for the proposed period.

    It will be at your sole discretion whether you will grant us the proposed consent or you will oppose it. Neither the conclusion nor the duration of our business relationship is conditional upon any such consent for the above purposes and no one will be forced to do so in any way.

    Such consent given according to the GDPR may replace your initial consent regarding the same processing purposes, supplement your further consents, if applicable, regarding data processing and does not void or restrict the right of other ČEZ Group member companies to process your data, if such use is made possible for us directly by the legal regulation.

    Of course, you can change or withdraw your consent at any time. The procedure for withdrawal of consent is given in the part I want to withdraw my consent.

  • Personal data sources

    Our company obtains your personal data mainly from you within the scope of negotiation of a contract and also during its fulfillment, or from third parties as intermediaries.

    Our company will always notify you when it is necessary to provide personal data for provision of a specific service and on the contrary, also when this is voluntary, but provision of such personal data makes mutual communication between you and our company easier and thus significantly increases the efficiency of the rendering of services.

    We can also get your personal data from public records or from the state administration authorities. In specific cases, we can get your personal data also from non-public records on the basis of applicable legal regulations.

    If our company monitors and records communication with you in order to improve the quality of service, objectivity, provability and safety, we will always inform you of this fact in advance, and you can reject this process. Except for special communication lines designed to solve crisis and emergency situations.

     

    The details of sources of your personal data that we process are given in the following examples.

  • Data sources for security and risk management

    For these needs, we use your data that are recorded in the internal databases, which are obtained directly from you or about you on the basis of current or also previous contractual cooperation, which contain information necessary for assessment of security and risk management. The source of this may also be your personal data shared between the ČEZ Group members for this purpose.

  • Personal data in public registers

    In cases in which we assert our legitimate interests, particularly our interest to act prudently, we can obtain your basic data and some other additional data also from the public registers, for instance, the Trades Register, Cadastre, Insolvency Register or Central Register of Executions and similar.

  • Processing and sharing of personal data

    Our company processes your data manually and automatically. During automated processing of your data, we however do not use automated decision-making, which could affect your rights.

     Protection of your data in our company is organizationally and technically safeguarded in compliance with the applicable legal regulations. We require a comparable level of safeguarding of your personal data also from all our personal data processors.

     For the above-stated purposes, besides our companies and their staff, your personal data may also be processed by some other ČEZ Group member companies or other data subjects outside the ČEZ Group as processors. We provide your data to these companies or data subjects only when they fulfill the organizational and technical conditions we have defined for ensuring their appropriate protection. And further that they are bound by written contract to comply with the negotiated conditions for processing of your personal data and ensuring their stipulated protection.

    The reason for transferring of your data to these companies or subjects as processors is usually the fact that they use the knowledge, procedures or technologies with the necessary professional level, which makes it possible for them to more effectively achieve some of the above-stated processing purposes and at the same time also ensure the necessary protection of your personal data.

    Some of our products or services are provided in cooperation with companies outside the ČEZ Group, such as business representatives and suppliers. Or they are accompanied at your request by a product or service other than cooperating companies. In all such cases, sharing or processing of your personal data occurs on the basis of personal data processing contracts concluded in compliance with the applicable legal regulations.

    Your personal data, on the basis of a justified request, may also be handed over to third parties with authority to seek provision of such personal data. These are, in particular, various state authorities.

  • CCTV systems

    For the purpose of ensuring the security of our spaces in which we have our generating facilities, business and other activities, as well as to ensure the security of the provided services, our company has installed and operates CCTV systems with recording devices. We always notify you of the location of these CCTV systems by means of signs and pictograms at the entrances to such premises, stating our company as the controller. We also provide you the reference to website, where more detailed information about processing of the acquired recordings is given.

    The acquired CCTV recordings are in case of security incident provided only to our designated company staff for the purpose of evaluation. They may be provided only to the criminal authorities or administration authorities for handling offense proceedings on the basis of their written request. Our company may also provide these companies with recordings at own discretion if it suspects a crime or offense, which is recorded. The acquired recordings are stored in a secure manner, and if they are not submitted to the authorized state authorities, they are deleted upon the expiry of the 30-day period.

  • Other processors

    Our activities related to the processing of your personal data are provided mainly by our own employees, or through selected ČEZ Group member companies. However, we also utilize the external network of contractual partners.

    Your personal data may be processed if we assign performance of a given activity that is a component of our operations and services to any other party. In some cases, these suppliers or external business representatives simultaneously become processors of personal data. The processor is authorized to handle the data solely for the purposes of performance of an activity that has been delegated to it by our company. In such case, your consent shall not be required for performance of the processing activities because such processing is permitted directly by the legal regulation.

    We mainly use the following categories of processors to process your data outside the ČEZ Group members:

    • providers of selected IT services,
    • providers of archive service,
    • providers of debt management and receivables recovery,
    • providers of printing and postal services, including couriers,
    • providers of physical protection of objects,
    • providers of legal services,
    • marketing agencies,
    • valuators and experts.

    List of other major Processors

  • Recipients of personal data and Demand without consent

    Some public administration authorities and other organizations are authorized to request information about you. This mainly applies to courts, the public prosecutors or the Police of the Czech Republic and also the Energy Regulatory Office, State Office for Nuclear Safety and eventually the Czech National Bank. We provide your data exclusively only when such a duty is stipulated for us by an applicable law.

  • Personal data security

    An important objective of our company is to protect and secure your personal data. We use various technologies, procedures and processes to protect your personal data from unauthorized access, use and publishing. We, for instance, process the provided personal data on computer systems and store them in data storage systems with restricted access, which are located in guarded buildings. For transmission of highly classified personal data (for instance, bank account numbers or passwords) in the Internet environment we use encryption to protect them.

  • Where we store personal data

    The personal data collected by our company are processed and stored almost exclusively in the territory of the Czech Republic. Only in a small number of specific especially business relationships, personal data of the members of the statutory bodies of our business partners, or other persons representing them or participating in these business relationships, are also transferred to institutions and companies abroad, in particular to comply with legal obligations. They are especially transferred to the territory of the Member States of the European Union, in which the GDPR provides the same conditions for their processing and protection.

    For cookies, we use services of Google Inc., US-based company, which is located outside the EU. According to a decision of the European Commission published in the Official Journal of the EU, this country belongs to a group of countries with adequate protection of personal data and a regime of their free transfer.

    Exceptionally, transfers and processing may occur in the territory of other states where the protection provided by the GDPR is not directly effective. In this case, we assess whether the State, institution or company guarantees comparable protection, and that your personal data can be transferred and processed to those states in accordance with GDPR requirements. 

  • How long we store personal data

    Our company stores your personal data for the period necessary to provide the products and services, completion of the required transactions or other necessarily purposes, such as fulfillment of our legal duties, contractual obligations, solution of disputes and legal enforcement of negotiated agreements. These needs differ depending on the type of the product or service provided, or other type of agreed contractual relationship, and for this reason, the real period for which we store the information may vary significantly.

    When handling your personal data for specific purposes, we respect the data minimization rules. We thus collect those of your personal data that we really need for a specific purpose. At the same time, we set strict internal archiving rules, which ensure that we do not store such data for longer period than we are authorized.

    In general, we store the data for 5 years from the date when the purpose for their processing passed. This deadline is based on the statutory limitation period and on the archiving and filing rules of our company.

    Almost for all contractual relationships, we must ensure documentation of the calculation and payment of tax, arising from the legal regulations on VAT and the related tax procedure. According to these legal regulations, we are obliged to keep tax documents and records containing detailed data related to the provision of selected services for a period of 10 years after expiry of the tax period in which the performance was realized. Thus, we are generally obliged to keep most of the basic data and information about the products and services on the basis of these legal regulations.

    In exceptional cases, for instance, during litigation, our company may keep the documents containing your personal data for a longer period in order to protect our legitimate interests. This mainly happens in a case where we would have to present this data as evidence in litigation (with regard to the statutory limitation period according to the current Civil Code, for instance, in connection with provision of warranty).

    Personal data processed in connection with your possible operation in a nuclear power plant environment are required to be retained in accordance with applicable laws throughout their operation and for the next 30 years after their termination.

    Audio records processed in connection with trading on regulated markets we store for the duration of the contractual relationship and 10 years after its termination.

    We keep the data that we process on the basis of your possible consent for the duration of the validity of your consent. To rule out doubts, we keep the actual consent and change or withdrawal of your consent from the title of our legitimate interests for duration of the validity of the consent and no later than 5 years after its termination.

  • Your rights to protection of personal data

    Our company strives for transparency and fair processing of your personal data, and ensuring their proper protection, always in compliance with applicable laws and regulations. For us to be able to reassure you about our responsible approach to handling your data, we are ready to quickly and professionally respond to your legitimate demands, which enable you to verify our responsibility when handling your data and possibly help us rectify deficiencies if they exceptionally occur in this activity.

    If the personal data processing is based on your consent, you have the right to withdraw your consent for future processing at any time;

    • You have the right to request us as the data controller to provide you with access to your personal data and more detailed information about their processing;
    • You have the right to request us to correct your inaccurate or incomplete personal data;
    • You have the right to request us to provide you with your personal data in the commonly used and machine readable format, which allows their handover to another controller, if we obtained them on the basis of your consent or in connection with conclusion and fulfillment of a contract, and they are automatically processed;
    • You have the right to object to processing of some or all your personal data;
    • You have the right to request us to delete your personal data if we no longer have any legal reason for their further processing; and
    • You have the right to lodge a complaint with the Office for personal data protection.

    When processing your personal data, we do so on the basis of appropriate legal titles that allow us to provide you with products and services, to ensure the operation of our company, fulfill our contractual and legal obligations, ensure the protection and security of our systems and our customers, or to fulfill other legitimate interests of our company as described in the above-stated parts of the Information, or we process your personal data based on your consent.

  • I want to know how you are processing my data

    You have the right to access your data and other related information. However, this must not affect third party rights. We shall provide you free-of-charge with this data and information. In a case where your request are clearly unreasonable or inappropriate, especially as they are repeated, we may reject them as unfounded or request you to pay a fee equivalent to the costs of provision of these data and information.

  • I am interested in correction of my data

    It may happen that your data are incorrectly recorded, or not up-to-date. Of course, we shall correct them at your request. And similarly, we shall supplement your incomplete data if you notify us.

  • I do not want you to continue using my personal data

    We fully respect your right to get your personal data deleted. As soon as all the reasons for storing these data will end, we shall delete them even without getting a request from you. If you request us to delete your personal data earlier, we shall notify you of the reason and for how long we must store your data before it is deleted.

  • I think that you are illegally using some of my personal data

    Based on your objections, we shall review and disable the access to or use of your personal data to which the doubts exist on whether they are being used in compliance with the applicable legal regulations, until its resolution.

  • I do not want to provide you with some of my personal data

    You are not obliged to provide us with your personal data. We shall always notify you in concrete situations as to which of your personal data are necessary for conclusion of the given contract and your eventual rejection shall lead us to the conclusion that we shall not be able to provide you with the offered product or service.

  • I want to withdraw my consent

    If you gave us consent to process your personal data, you have the right to withdraw this consent at any time. Withdrawal of this consent has no impact on the processing of your data for the entire validity of your consent. Withdrawal of your consent will have an impact only on the processing of your data for a specific purpose or purposes, for which it was given. However, this has no effect on processing of your personal data for other reasons and the legal reasons if they relate to such personal data (e.g. fulfillment of the duties stipulated by law).

    If you visit our website, you can set or change cookies by following the instructions in their setup on https://www.cezesco.cz/cs/informace-o-webu.

  • I want to restrict marketing

    If you receive our business offers on the basis of our legitimate interest, you can stop sending such offers at any time (Offers unsubscribe) in the following ways:

    • a link for termination of the subscription is included directly in our business messages
    • by canceling your registration in the application on webpage through which you have requested to send such information,
    • via the web form,
    • or write to us at the address ČEZ, a. s., Duhová 2/1444, 140 53 Praha 4, with the code " personal data processing" 

    For correct comprehension, we would like to draw your attention to the fact that restriction of marketing shall not result in ending of communication with you. As required, we shall continue to use your contact data to send you service messages, or other information of non-marketing character, which is related to your product or service that we shall provide to you or to any other type of contractual relationship between us.

  • For us to understand each other better

    In spite of all efforts at maximum comprehension of this document, you have probably found words or terms that you have never encountered before. Or you are not sure that you correctly understand their meaning.

    For your better understanding, based on our experience we provide you with a glossary of terms, which can help us to avoid mutual misunderstanding.

  • Glossary of terms

    Cookies

    A short text file that the visited website sends to your browser. It makes it possible for the website to record information about your visit, for instance, preferred language and other settings. The next visit to the website can thus be easier and more productive. The cookie files are important. Web browsing would be far much more complicated without them.

    ČEZ Group

    The ČEZ Group represents the legal relationship between multiple ČEZ Group companies (controlled companies) subject to a unified control by ČEZ, a. s. (controlling company), with which they form the concern on the basis of the unified control. For more detailed information see www.cez.cz/cs/o-spolecnosti/skupina-cez/o-skupine-cez/profil-skupiny-cez.html

    Legitimate interest

    The interest of the controller or a third party, for instance, in a situation in which the data subject is the controller’s client.

    Personal data

    Information about a specific, identifiable person.

    Product

    For instance, supply of electricity, gas, or services such as mobile phone and data services or other services offered by our companies.

    Recipient

    The person to whom the personal data are provided.

    ČEZ Group Corp.

    The ČEZ Group Corp. is a corporation of companies around the parent company ČEZ, a. s., mainly engaged in the energy sector, linked to this parent company, mainly through equity investments. For more detailed information see www.cez.cz

    Service

    Any service, which a ČEZ Group company offers to you, including our products and services offered on-line and their support.

    Controller

    An entity that determines the purpose and resources for processing of personal data; and may also decide on delegation of their processing to another entity in the role of a processor.

    Data subject

    A live natural person whose personal data are the subject of processing.

    Purpose

    The reason for which the controller uses your personal data.

    Processing

    An activity by which the controller or processor performs when handling the personal data.

    Processor

    An entity that processes personal data for the controller.

  • Potential changes in this information

    Over time, there may be a change in the legislation governing the rules and conditions for the processing and protection of your personal data, or a change in our conditions, procedures and methods of processing and protection of your personal data. We will keep you informed about them at all times by updating this information provided the given change will not require us to notify you also through individual communication (letter or electronic message).

  • Contact us

    If you have a request or complaint relating to the processing of your personal data or a query for the person responsible for processing of personal data our company, please, contact us via our web form. Or write to us at the address: ČEZ, a. s., Duhová 2/1444, 140 53 Praha 4, the password "processing of personal data". We shall respond to your request, queries or complaints as soon as possible, but at the latest within one month of their delivery. If we shall not be able to respond to your request in time because of the complexity of its solution or a large number of requests from other persons, we shall notify you about the necessary extension of the period.

    Our Data Protection Officer is Mgr. Petr Brázda. He can be contacted at the address: ČEZ, a. s., Duhová 2/1444, 140 53 Prague 4, or via the web form. For more details on how to contact the Data Protection Officer, description of his mission and competence to resolve your rights, visit the web site Data Protection Officer.