Information on the processing of personal data for student interested in the scholarship programme in the VINCI Construction CS Group

Dear Student,

In connection with the personal data we have obtained from you regarding your interest in long-term internships during your university studies, post-graduation employment (successful completion of university studies), summer work internships, collaboration on bachelor’s/master’s theses, and/or participation in the scholarship program (hereinafter referred to as "collaboration") within the VINCI Construction CS Group, we provide you with the following information in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "Regulation" or "GDPR"):

1.a) Identity and contact details of the controller and their possible representative:

The controller of your personal data for the purposes of recruitment and the fulfillment of rights and obligations arising from the employment relationship, as well as for other purposes listed in section 1.c) below, is the company VINCI Construction CS a.s., Identification no.: 140 80 672, with its registered office at U Michelského lesa 1581/2, Michle, 140 00 Prague 4, or another entity within the VINCI Construction CS Group where you will be involved in the collaboration and which may become your potential employer (hereinafter referred to as the “controller”). A list of business entities that are part of the VINCI Construction CS Group is published on the website: www.vinci-construction.cz/en/our-companies.

1.b) Categories of personal data concerned and the source from which the personal data originates:

The categories of personal data concerned primarily include those we have obtained directly from you. They also include categories of personal data that we have obtained from employment intermediaries, during recruitment, from your educational institution, or possibly from social networks, public authorities, or other publicly available sources. Additionally, if we have not obtained personal data directly from you, the data comes mainly from the following sources:
i) government authorities,
ii) banks,
iii) insurance companies,
iv) publicly available sources, including public registers governed by Act No. 304/2013 Coll., on public registers of legal and natural persons and the register of trust funds, as amended,
v) email and electronic communication,
vi) data messages, Internet networks.

Depending on the nature of the obtained personal data, the categories of personal data concerned include: gender, first name, surname, birth surname, nationality, date of birth, personal identification number, place of birth, permanent residence address, correspondence address (if applicable), private email address, data box ID, personal identification number, intern card number (if issued), temporary/work email address, phone number, ID card number, health insurance information, bank details, health status information (e.g., medical assessments and examinations), personal and academic/professional development information and academic achievements, including information and documentation on the course and results of education, achieved academic results and qualifications (e.g., completed training), career planning information, completed occupational health examinations, other personal data established or required by relevant legal regulations or authorized persons under legal regulations, documentation proving compliance with obligations under the agreement, and also IP addresses, records of camera systems, GPS records, records of offenses committed with the assigned company vehicle and/or of damage events involving such vehicles, log records of assigned technical devices, operational and location data of used devices, work/internship email and electronic communication, personal data in audio recordings; personal data in video recordings – camera footage, photographs, videos.

1.c) Purposes of processing for which the personal data is intended and the legal basis for processing:

The purposes of processing your personal data are:
i) the implementation, organization, and evaluation of potential recruitment (employee recruitment based on the requirements and criteria set by the potential employer) for the requested job position, internship during university studies, or summer work internship and/or possible collaboration with a student on a bachelor's/master's thesis within the VINCI Construction CS Group, i.e., at VINCI Construction CS a.s. or any other company that is a member of the VINCI Group;
ii) the fulfillment of the rights and obligations arising from the pre-contractual relationship with the controller, or with VINCI Construction CS a.s.;
iii) compliance with or adherence to the legal obligations of the controller;
iv) provision of preventive and/or occupational healthcare services to assess working ability;
v) the fulfillment of obligations and the exercise of rights by the controller or VINCI Construction CS a.s. as the controller or employer in the field of labor law and social security and social protection law;
vi) the determination, exercise, or defense of legal claims, litigation, or when courts act within their judicial powers, control, and protection of the employer's property rights;
vii) ensuring the management and efficient use of the controller's production resources, including company vehicles, company phones, computers, and other production and working resources of the employer, which may record certain data (especially IP addresses, GPS locator data, operational and location data);
viii) the fulfillment of obligations arising from your legal relationship with a company within the VINCI Construction CS Group (especially remuneration, incentive contributions, and other obligations according to the agreement);
ix) ensuring the operational activities of the controller;
x) keeping a central contract register, for administrative purposes, managing and enforcing claims;
xi) protection of persons, property, and health, including through the operation of camera systems with recordings;
xii) verification of the accuracy of data and checking in public registers;
xiii) for tax and accounting purposes;
xiv) responding to requests for information;
xv) complying with requests from public authorities;
xvi) protecting the legitimate interests of the controller or third parties;
xvii) use for the purposes of potential further recruitment for suitable job positions for the student in case the student expresses interest in a position within the VINCI Construction CS Group;
xviii) maintaining a database of job applicants and candidates for collaboration on bachelor's/master's theses within the VINCI Construction CS Group;
xix) inclusion and management in the system for managing applicants/candidates for employment (ATS);
xx) inclusion and management in records of candidates for collaboration and/or for potential recruitment in the event of your interest in a job position within the VINCI Construction CS Group.

The legal basis for processing your personal data is:
i) the fulfillment of obligations arising from the agreement/contract to which you, as the data subject, are a party or the implementation of measures that need to be taken before the possible conclusion of such an agreement/contract, in accordance with Article 6(1)(b) of the Regulation;
ii) compliance with a legal obligation to which the controller is subject in accordance with Article 6(1)(c) of the Regulation, in particular under Act No. 262/2006 Coll., the Labor Code, as amended, Act No. 435/2004 Coll., on Employment, as amended, or other legal regulations;
iii) the legitimate interests of the controller or a third party in accordance with Article 6(1)(f) of the Regulation; and/or
iv) processing is necessary to take measures prior to the conclusion of an agreement/contract at your request.

1.d) Legitimate interests of the controller or third party if the processing is based on Article 6(1)(f) of the Regulation:

The processing of your personal data is not based solely on the legal basis that the processing is necessary for the purposes of the legitimate interests of the controller or a third party under Article 6(1)(f) of the Regulation. Such a legal basis for processing is also linked to other legal bases and stems from the purpose stated in section 1.c) point v) above. The legitimate interests of the controller or a third party primarily include:
i) protection of the controller's good reputation;
ii) administrative purposes within the VINCI Construction CS Group;
iii) protection of economic interests and property and ownership rights;
iv) defense against a potential lawsuit from your side, conducting a legal dispute with you;
v) exercising rights and obligations from an already terminated contractual relationship (e.g., occupational diseases, claims from work-related injuries, etc.);
vi) initiation or conduct of administrative, judicial, or arbitration proceedings;
vii) proof of qualification to relevant authorities and institutions.

A third party is considered to be:
i) any entity that is a member of the VINCI Construction CS Group or the VINCI Group;
ii) a person who has a legal interest or an urgent legal interest in determining, exercising, or defending legal claims (e.g., an injured party, an insurance company, etc.).

1.e) Potential recipients or categories of recipients of personal data:

Potential recipients of the personal data you provide may include VINCI Construction CS a.s., or any of its subsidiaries, companies within the VINCI Construction CS Group, as well as within the VINCI Group, to which the VINCI Construction CS Group belongs, and potentially other data processors who have a contractual relationship with companies of the VINCI Construction CS Group and/or VINCI. Potential recipients of personal data may also include relevant employees of the aforementioned companies from human resources and payroll departments or other departments. Additionally, your personal data may be disclosed to public authorities (e.g., state authorities such as ministries, courts, bailiffs, notaries, police, administrative authorities including, but not limited to, social security administration, employment offices, and labor inspections), as well as to clients of the work contracts that are part of the controller’s business, and other contractual partners of the controller, such as occupational health service providers, health insurance companies, insurance companies, etc. Public authorities that may obtain personal data as part of a special investigation in accordance with Czech law are not considered recipients.

1.f) Any intention of the controller to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission, or, in cases of transfer referred to in Article 46 of the Regulation or Article 47 or Article 49(1) second subparagraph of the Regulation, a reference to appropriate safeguards and means to obtain a copy of those data or information on where the data was made available:

The controller does not intend to transfer the personal data you provided to a third country or an international organization.

1.g) Method of updating personal data:

Your personal data is updated based on the information received from you about changes to contact details or inquiries to the controller to confirm the accuracy of your contact details or to correct them. Personal data is also updated as needed based on verification of the current status of your personal data in relation to fulfilling the purpose of processing your personal data as per Article 1.c) of this information, through public authorities or from publicly available sources, etc.

We are further providing to you the following information: 

2.a) Duration for which personal data will be stored, or if not possible to determine, the criteria used to determine this period:

Your personal data will be stored for the period specified by relevant legal regulations, but no longer than is necessary for the purposes for which the personal data is processed.

2.b) The existence of the right to request from the controller access to personal data concerning the data subject, its rectification or erasure, or restriction of processing, and to object to processing, as well as the right to data portability:

As a data subject, you have the following rights:
a) the right to request access to your personal data from the controller according to Article 15 of the Regulation;
b) the right to rectification, which involves correcting inaccurate personal data and/or completing incomplete personal data according to Article 16 of the Regulation;
c) the right to erasure of personal data concerning you under Article 17 of the Regulation;
d) the right to request the restriction of processing under Article 18 of the Regulation. You also have the right to object to the processing of your personal data under the conditions of Article 21 of the Regulation. Additionally, you have the right to data portability under Article 20 of the Regulation.

You can exercise these rights by contacting the controller in writing at the controller's correspondence address or electronically at info@vinci-construction.cz.

All information contained in this document, as well as any communications and actions under Articles 15 to 22 and Article 34 of the Regulation, and the exercise of individual rights and obligations, will be provided to you free of charge. If your requests are manifestly unfounded or excessive, particularly if they are repetitive, the controller may either:
a) charge a reasonable fee taking into account the administrative costs of providing the requested information or communication or taking the requested actions; or
b) refuse to comply with the requests. The controller will provide you with information about the actions taken in response to your request under Articles 15 to 22 of the Regulation without undue delay and in any case within one month of receiving the request. This period may be extended by up to two additional months if necessary, considering the complexity and number of requests.

We also inform you that if a data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller will notify you of the breach without undue delay, according to the conditions of Article 34 of the Regulation.

2.c) If the processing is based on Article 6(1)(a) or Article 9(2)(a) of the Regulation, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal:

If the processing of your personal data cannot be based on any of the legal grounds explicitly mentioned in point 1.c) i), ii), and iii) of this information document, such as personal photographs, copies of driving licenses, copies of certificates or professional qualifications, or other cases (although not exclusively, as it depends on the specific circumstances of each employee’s employment relationship), and such processing of your personal data is based on your prior free and informed consent, you have the right to withdraw your consent at any time. However, the withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

2.d) The existence of the right to lodge a complaint with a supervisory authority:

You have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection, Identification No.: 70837627, with its registered office at Pplk. Sochora 27, 170 00 Prague 7. The office’s website is: www.uoou.cz.

2.e) Whether the provision of personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract, and whether the data subject is obliged to provide the personal data, and the possible consequences of not providing such data:

The provision of your personal data is a legal requirement necessary for the performance of rights and obligations arising from your employment or other legal relationship in the context of the cooperation. Your relevant personal data must be included in the contract/agreement related to your relationship with the controller, which establishes this relationship. Failure to provide the required personal data is incompatible with establishing an employment relationship and fulfilling the related rights and obligations, or with cooperating on a bachelor's/master's thesis within the VINCI Construction CS Group.

2.f) Whether automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the Regulation, is carried out, and, at least in such cases, meaningful information about the logic used, as well as the significance and the expected consequences of such processing for the data subject:

Your personal data, and you personally, are not subject to automated decision-making or profiling as referred to in Article 22(1) and (4) of the Regulation.

Prague, June 24, 2024