GDPR – Applicants for Study

Palacký University Olomouc, Křížkovského 511/8, 779 00 Olomouc, Czech Republic (hereinafter referred to as "Palacký University", "UP" or "we"), acting as the controller of personal data, hereby informs data subjects ("data subjects" or "you") about the processing of your personal data by UP and your rights in connection with such processing.

The protection of personal data is important to UP. We process your personal data in accordance with applicable legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR").

If you have any questions or requests regarding the processing and protection of your personal data, please contact our Data Protection Officer. The Data Protection Officer (DPO) ensures that the processing of your personal data is carried out in accordance with applicable legal regulations and the internal UP standard Protection of Personal Data at Palacký University Olomouc.

Palacký University Olomouc processes your personal data for the following purposes:

• Administration of the admissions process, including deciding on admission or non-admission to study, managing any appeal proceedings, and collecting and administering fees associated with the admissions procedure
  • Compliance with legal obligations, in particular under the Higher Education Act (Article 6(1)(c) GDPR)
  • Performance of a task carried out in the public interest (Article 6(1)(e) GDPR)
• Fulfilment of legal obligations under applicable legislation (e.g. transfer of statistical data to the Ministry of Education, Youth and Sports of the Czech Republic; retention of accounting and tax records) and disclosure of admissions-related information to public authorities — in particular the Ministry of Education, Youth and Sports of the Czech Republic, the Ministry of the Interior of the Czech Republic (Czech Police), the Ministry of Foreign Affairs of the Czech Republic (Czech Embassies), the Customs Administration, and Czech courts
  • Compliance with legal obligations (Article 6(1)(c) GDPR)
• Protection of UP's legitimate interests, and the security and administration of IT systems (e.g. operation of camera systems — see Operation of the Camera System at Palacký University Olomouc)
  • Legitimate interests of UP (Article 6(1)(f) GDPR)
• Recording and promotion of UP (on the UP website, social media platforms (Facebook, Instagram, Twitter, etc.) and in promotional materials)
  • Legitimate interests of UP (Article 6(1)(f) GDPR) or your consent, where required (Article 6(1)(a) GDPR)
• Other purposes specified in a consent you have provided
  • Your consent (Article 6(1)(a) GDPR)

The provision of personal data is voluntary; however, if you decline to provide the data necessary for the proper conduct of the admissions procedure and related activities, UP will be unable to properly identify you or administer your application, including fulfilling its obligations towards other public authorities in the Czech Republic.

UP processes only the personal data that is necessary in connection with the admissions procedure, limited to what is adequate, relevant and proportionate to the purpose for which it is processed. This includes:

1. Identification data (e.g. name, surname, title, birth number, date of birth)
2. Contact details (e.g. address, email address, telephone number)
3. Study and education data (e.g. previous education, study programme applied for, mode of study, state examinations completed, academic titles awarded)
4. Data from identity documents
5. Data on the study programme applied for and the outcome of the admissions procedure
6. Health data (e.g. where it is necessary to take into account specific needs of the applicant)
7. Image and sound recordings (e.g. CCTV recordings)
8. Bank account details
9. Other data provided during the admissions process (e.g. information from correspondence)

We retain your personal data only for as long as is necessary for the specific purpose for which it is processed. Once the retention period has expired or the purpose has been fulfilled, we will delete or anonymise your personal data — that is, modify it in such a way that it can no longer be linked to you. This does not apply to personal data that must be archived for a specified period in accordance with applicable legal regulations.

UP discloses personal data only where necessary, to the following categories of recipients:

• Public authorities (e.g. Ministry of Education, Youth and Sports; tax office; health insurance companies; Ministry of the Interior of the Czech Republic (Czech Police); Ministry of Foreign Affairs of the Czech Republic (Czech Embassies); Customs Administration; Czech courts)
• SCIO s.r.o. (in connection with your participation in national comparative examinations and their evaluation)
• IT administrators and software providers (for the purpose of operating information systems)

Data is always disclosed only to the extent necessary and with due regard for the protection of your privacy. An up-to-date list of data processors is available upon request. Please note that the list of UP's processors may change and be updated over time.

As a general rule, UP does not transfer personal data outside the European Economic Area (EEA). Exceptions may arise where a student participates in a foreign or exchange programme (e.g. within the Erasmus+ programme). In such cases, UP will ensure that appropriate safeguards are in place (e.g. by concluding standard contractual clauses with the recipient of the personal data).

We will make reasonable efforts to ensure the accuracy of your personal data. You can help us by providing accurate, truthful and current information. If you believe that any information processed by UP is inaccurate, incorrect or out of date, please let us know so that we can take corrective action.

In accordance with the GDPR, applicants for study have the following rights:

1. Right of access to personal data (Article 15 GDPR) You have the right to obtain confirmation as to whether UP processes your personal data and, if so, to access that data and the information specified in Article 15(1)(a) to (h) GDPR. UP provides confirmation of processing and the first copy of your personal data free of charge.

2. Right to rectification (Article 16 GDPR) You have the right to request the correction of inaccurate personal data or the completion of incomplete or out-of-date data.

3. Right to erasure — "right to be forgotten" (Article 17 GDPR) You have the right to request that UP erase your personal data without undue delay where the conditions of Article 17 GDPR are met (e.g. where the data is no longer necessary for the purpose for which it was collected).

4. Right to restriction of processing (Article 18 GDPR) Where the conditions of Article 18 GDPR are met, you may request that the processing of your personal data be restricted.

5. Right to information about recipients of personal data (Article 19 GDPR) You may request that UP inform you of the recipients to whom your personal data has been disclosed, and to whom any rectification, completion, erasure or restriction of processing has subsequently been communicated.

6. Right to data portability (Article 20 GDPR) Where UP processes your data on the basis of consent or a contract and the processing is carried out by automated means, you may request that your data be provided in a structured format or transferred to another controller.

7. Right to object (Article 21 GDPR) Where UP processes your personal data for the performance of a task carried out in the public interest, in the exercise of official authority, or on the basis of its legitimate interests, you have the right to object to such processing. In that case, UP must demonstrate compelling legitimate grounds for continuing the processing.

8. Right to be notified of a personal data breach (Article 34 GDPR) Where a personal data breach is likely to result in a high risk to your rights and freedoms, UP is obliged to notify you without undue delay.

How to exercise your rights: Requests may be sent to the UP Data Protection Officer at: dpo@upol.cz. You may also contact the DPO by telephone: 585 631 187.