Information on processing and protection of personal data within the VINCI Construction CS Group

Dear Visitor,

In connection with personal data that we have obtained from you (with the exception of data from persons belonging to the group of job candidates and employees of the VINCI Construction CS Group), and in connection with personal data that was not obtained directly from you, such as in the case of commercial contracts concluded between a business corporation that is a member of the VINCI Construction CS Group and a business corporation in which you serve as a representative or contact person of such business corporation (legal entity), or in the case of personal data that we have obtained, as a general rule, independently of our will, e.g. from public authorities or from other third parties, or in any other cases in which we did not obtain personal data directly from you, we provide, in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as the “Regulation” or “GDPR”), the following information:

1.a) Identity and contact information of the controller and, as the case may be, its representative:

The controller of your personal data within the VINCI Construction CS Group is the member of the group (business corporation) that initially obtained your personal data, whether directly from you, indirectly, via a third party or by other means. In the event of doubt, the controller of your personal data shall be considered to be VINCI Construction CS a.s., Identification no.: 140 80 672, with its registered office at U Michelského lesa 1581/2, 140 00 Prague 4, ref. no. B 27244 administrated by the Municipal Court in Prague (hereinafter referred to as “VINCI Construction CS“). The representative of all potential controllers within the VINCI Construction CS Group is: VINCI Construction CS a.s. (hereinafter referred to as "representative of the controller").

1.b) The purposes for which personal data is processed and the legal basis for processing:

Depending on the nature of processing, the purpose of the processing of your personal data is: i) the performance of a contract to which you are a party, and/or ii) the implementation of measures adopted at your request prior to conclusion of a contract, and/or iii) fulfilment of a legal obligation relating to the controller or any other member of the VINCI Construction CS Group, and/or iv) fulfilment of a requirement imposed by a public authority, and/or v) protection of the legitimate interests of the respective controller or a third party, and/or vi) the establishment, exercise or defence of legal claims and/or if that the courts are acting within their jurisdiction, and/or vii) the protection of persons, property and health, including through the operation of camera systems with recording functionality, and/or viii) handling of complaints and suggestions, and/or ix) handling of requests for information, and/or x) resolution of damage claims, and/or xi) keeping of customers’ records, invoicing, tax and accounting purposes, and/or xii) keeping of central contract records, administrative purposes, administration and debt collection, and/or (xiii) keeping of records, visitor logs, and/or (xiv) checking of accuracy and verification in public registers, (xv) ensuring operational activities. The legal basis for processing your personal data is: i) the performance of a contract to which you are a party, and/or ii) implementation of measures adopted at your request prior to concluding a contract, and/or iii) fulfilment of a legal obligation relating to the controller, and/or iv) the legitimate interests of the controller or of a third party, except in cases when such interests are secondary to the interests or fundamental rights and freedoms of the data subject requiring protection of personal data.

1.c) Categories of processed personal data:

The categories of processed personal data include primarily such data that we have obtained directly from you. Furthermore, the categories of processed personal data also include data that we have not obtained directly from you, but, for example, from public authorities, from your previous employer, from your bank or insurance company, from a company (business corporation) in which you serve as an employee or member of a statutory body, from publicly available sources, etc. Depending on the nature of the acquired personal data, the category of processed personal data includes particularly the following: name, surname, identification number, tax identification number, residential address, business address, signature, job title, e-mail address, telephone number, camera-system recordings, recordings from the controller’s production facilities.

1.d) The legitimate interests of the controller or of a third party in the case that processing is based on Article 6 (1) (f) of the Regulation:

The processing of your personal data is not in and of itself based exclusively on the legal grounds consisting in the fact that the processing is necessary for the purposes of the legitimate interests of the controller or of a third party pursuant to Article 6 (1) (f) of the Regulation. Such legal grounds for processing are generally connected with other legal grounds for processing and are derived from the purposes set forth above in item 1.b). In particular, the legitimate interests of the controller or of a third party consist in: i) the controller’s good reputation, ii) administrative purposes within the VINCI Construction CS Group, iii) protection of the economic interests and property rights of the controller, iv) the commencement or execution of administrative, judicial or arbitration proceedings.

1.e) Potential recipients or categories of recipients of personal data:

A potential recipient of your personal data may be any entity that is a member of the VINCI Construction CS Group or the VINCI concern. Furthermore, public authorities (particularly bodies of the state administration, e.g. ministries, courts, distrainors, notaries, the police, administrative authorities, etc.), District Social Security Administrations, Labour Offices, the Labour Inspectorate, health insurance companies, other insurance companies, business partners and customers of the VINCI Construction CS group and the VINCI concern may also be recipients of your personal data. However, public authorities that may obtain personal data in connection with a special investigation in accordance with Czech law are not considered to be recipients.

1.f) In relation to the controller’s intention to transfer personal data to a third country or to an international organisation (if any such intention arises) and the existence or non-existence of a Commission decision on appropriate protection or, in cases of transfer set forth in Article 46 of the Regulation or Article 47 or the second sub-paragraph of Article 49 (1) of the Regulation, a link to the appropriate guarantees and means of obtaining a copy of the given data or information on where the data has been made accessible shall be provided.

The controller has no intention to transfer your personal data to a third country or international organisation.

We are further providing to you the following information:

2.a) The period for which the personal data will be retained or, if it is not possible to determine such period, the criteria for specifying such period: 

Your personal data will be retained for the period stipulated by the relevant legal regulations, though no longer than the period necessary for the purposes for which the personal data is processed.

2.b) The existence of the right to request from the controller access to personal data pertaining to the data subject, the correction or deletion of such data and the restriction of processing of such data, as well as the right to raise objections to processing and the right to data portability:

As a data subject, you have  the following rights in particular: a) the right to request from the controller access to your personal data pursuant to Article 15 of the Regulation, and b) the right to correction consisting in the correction of inaccurate personal data and/or the supplementation of incomplete personal data pursuant to Article 16 of the Regulation, and c) the right to deletion of personal data pertaining to you as a data subject pursuant to Article 17 of the Regulation, and d) the right to demand that the controller restrict processing pursuant to Article 18 of the Regulation. You also have the right to raise objections to the processing of your personal data under the conditions pursuant to Article 21 of the Regulation. You also have the right to portability of your personal data under the conditions pursuant to Article 20 of the Regulation.

You can exercise the above-mentioned individual rights by writing to VINCI Construction CS a.s., Identification no.: 140 80 672, at the company's correspondence address at U Michelského lesa 1581, 140 00 Prague 4, or by e-mail at the address info@vinci-construction.com.

All of the information contained in this informational document and all communications and all actions pursuant to Articles 15 to 22 and Article 34 of the Regulation are provided to you free of charge by the controller. There is also no charge associated with the exercise of individual rights or fulfilment of obligations. If your demands are obviously unfounded or excessive, especially due to their repetitiveness, the controller may either: a) impose a proportionate fee taking into account the administrative costs associated with providing the requested information or communication or with carrying out the requested actions, or b) refuse to comply with the request. Pursuant to Articles 15 to 22 of the Regulation, the provider shall provide to you, in each case and without undue delay, information on the adopted measures within one month of receiving the given request. If necessary and with respect to the complexity and number of requests, it is possible to extend this period by an additional two months. 

We also inform you that if it is probable that a particular case involving a breach of the security of your personal data will lead to a heightened risk to the rights and freedoms of natural persons, the controller will notify you of such breach without undue delay pursuant to the conditions of Article 34 of the Regulation.

2.c) If processing is carried out on the basis of Article 6 (1) (a) or Article 9 (2) (a) of the Regulation, the existence of the right to withdraw consent at any time, without affecting the legality of processing based on consent granted prior to its withdrawal: 

Processing of your personal data is not based on Article 6 (1) (a) or on Article 9 (2) (a) of the Regulation.

2.d) Existence of the right to file a complaint with the supervisory authority:

You have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection, Identification no.:  70837627, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, website: www.uoou.cz. 

2.e) The fact of whether the provision of personal data is a legal or contractual requirement, or a requirement that must be included in a contract, and whether the data subject is obligated to provide personal data and with respect to possible consequences of not providing such data:

If we have obtained personal data directly from you, the provided personal data is a contractual and/or legal requirement that is necessary to include in the given contract if you are a party to such contract. In this case, the provision of personal data is also a legal requirement, particularly with respect to the obligations arising from the legal regulations governing taxation and accounting. Failure to provide the necessary personal data is incompatible with establishing the given legal relationship and fulfilment of the rights and obligations arising therefrom.

2.f) The source of personal data and information on whether such data comes from publicly available sources, if any:

You are the source of personal data if we have obtained personal data directly from you. If we did not obtain personal data directly from you, the personal data comes from the following sources in particular: i) public authorities and bodies of the state administration, ii) banks, iii) insurance companies, iv) publicly available sources including public registers regulated by Act No. 304/2013 Coll., on Public Registers of Legal Entities and Natural Persons and on the Registration of Trust Funds, as amended, v) camera or other systems operated for the purpose of protecting property, life and health, vi) e-mail and electronic communication.

2.g) The fact of whether automated decision-making, including profiling, specified in Article 22 (1) and (4) of the Regulation occurs at least in cases involving meaningful information pertaining to the utilised process, as well as to the significance and anticipated ramifications of such processing for the data subject.

Neither the personal data that you provide nor you personally are the subject of automated decision-making or profiling as specified in Article 22 (1) and (4) of the Regulation.

Prague, 1 July 2022