GDPR - Job Applicants

Palacký University Olomouc, Křížkovského 511/8, 779 00 Olomouc, Czech Republic (hereinafter referred to as "Palacký University", "UP" or "we"), acting as the controller of personal data, hereby informs data subjects ("data subjects" or "you") about the processing of your personal data by UP and your rights in connection with such processing.

The protection of personal data is important to UP. We process your personal data in accordance with applicable legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR").

If you have any questions or requests regarding the processing and protection of your personal data, please contact our Data Protection Officer. The Data Protection Officer (DPO) ensures that the processing of your personal data is carried out in accordance with applicable legal regulations and the internal UP standard Protection of Personal Data at Palacký University Olomouc.

Palacký University Olomouc processes your personal data for the following purposes:

• Conducting the recruitment process and concluding an employment contract
  • Performance of a contract (Article 6(1)(b) GDPR)
• Protection of UP's legitimate interests, including ensuring the security of UP premises and handling security incidents (e.g. in the event of an inspection or legal dispute)
  • Legitimate interests of UP (Article 6(1)(f) GDPR) — data is retained for a maximum of 3 years after the conclusion of the selection procedure
• Contacting you with future job offers
  • Only where you have given your voluntary consent (Article 6(1)(a) GDPR)

As a job applicant, you are not obliged to provide us with your personal data; however, without it we cannot include you in the selection process.

UP processes only the personal data necessary in connection with the recruitment process. This includes:

1. Identification data (e.g. name, surname, title, date of birth)
2. Contact details (e.g. address, telephone number, email address)
3. Data provided in the job application, including CV (e.g. information about previous employment, education, qualifications and supporting documents)
4. Image data (e.g. from the UP camera system)
5. Other information provided during the selection process (e.g. references from former employers)

We will process your personal data for the duration of the selection process. If you have given your consent to be contacted with future job offers, we will retain your personal data for a period of one year. Following this period, your personal data will be deleted (with the exception of data relating to candidates with whom an employment relationship has been established). Candidates will not be individually notified of such deletion. You may withdraw your consent at any time.

UP discloses personal data only where necessary, to the following categories of recipients:

• Public authorities, where required by law
• Courts and administrative bodies, where necessary to protect the rights and interests of UP
• Contractual processors (e.g. IT service providers, legal or tax advisors)

Data is always disclosed only to the extent necessary and with due regard for the protection of your privacy. An up-to-date list of data processors is available upon request. Please note that the list of UP's processors may change and be updated over time.

As a general rule, UP does not transfer personal data outside the European Economic Area (EEA). Exceptions may arise where it is necessary for the performance of work activities with a partial international dimension, for example in the context of projects or foreign exchange placements (e.g. the Erasmus+ programme). In such cases, UP will ensure that appropriate safeguards are in place (e.g. by concluding standard contractual clauses with the recipient of the personal data).

We will make reasonable efforts to ensure the accuracy of your personal data. You can help us by providing accurate, truthful and current information. If you believe that any information processed by UP is inaccurate, incorrect or out of date, please let us know so that we can take corrective action.

In accordance with the GDPR, job applicants have the following rights:

1. Right of access to personal data (Article 15 GDPR) You have the right to obtain confirmation as to whether UP processes your personal data and, if so, to access that data and the information specified in Article 15(1)(a) to (h) GDPR. UP provides confirmation of processing and the first copy of your personal data free of charge.

2. Right to rectification (Article 16 GDPR) You have the right to request the correction of inaccurate personal data or the completion of incomplete or out-of-date data.

3. Right to erasure — "right to be forgotten" (Article 17 GDPR) You have the right to request that UP erase your personal data without undue delay where the conditions of Article 17 GDPR are met (e.g. where the data is no longer necessary for the purpose for which it was collected).

4. Right to restriction of processing (Article 18 GDPR) Where the conditions of Article 18 GDPR are met, you may request that the processing of your personal data be restricted.

5. Right to information about recipients of personal data (Article 19 GDPR) You may request that UP inform you of the recipients to whom your personal data has been disclosed, and to whom any rectification, completion, erasure or restriction of processing has subsequently been communicated.

6. Right to data portability (Article 20 GDPR) Where UP processes your data on the basis of consent or a contract and the processing is carried out by automated means, you may request that your data be provided in a structured format or transferred to another controller.

7. Right to object (Article 21 GDPR) Where UP processes your personal data for the performance of a task carried out in the public interest, in the exercise of official authority, or on the basis of its legitimate interests, you have the right to object to such processing. In that case, UP must demonstrate compelling legitimate grounds for continuing the processing.

8. Right to be notified of a personal data breach (Article 34 GDPR) Where a personal data breach is likely to result in a high risk to your rights and freedoms, UP is obliged to notify you without undue delay.

How to exercise your rights: Requests may be sent to the UP Data Protection Officer at: dpo@upol.cz. You may also contact the DPO by telephone: 585 631 187.