GDPR – Participants in UP Events

Palacký University Olomouc, Křížkovského 511/8, 779 00 Olomouc, Czech Republic (hereinafter referred to as "Palacký University", "UP" or "we"), acting as the controller of personal data, hereby informs data subjects ("data subjects" or "you") about the processing of your personal data by UP and your rights in connection with such processing.

The protection of personal data is important to UP. We process your personal data in accordance with applicable legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR").

If you have any questions or requests regarding the processing and protection of your personal data, please contact our Data Protection Officer. The Data Protection Officer (DPO) ensures that the processing of your personal data is carried out in accordance with applicable legal regulations and the internal UP standard Protection of Personal Data at Palacký University Olomouc.

Palacký University Olomouc processes your personal data for the following purposes:

• Organisation, administration and proper conduct of events, including the collection of any associated fees
  • Performance of a contract (Article 6(1)(b) GDPR)
  • Compliance with UP's legal obligations (Article 6(1)(c) GDPR)
  • Performance of a task carried out in the public interest (Article 6(1)(e) GDPR)
• Fulfilment of legal obligations under applicable legislation (e.g. retention of accounting and tax records)
  • Compliance with legal obligations (Article 6(1)(c) GDPR)
• Recording and promotion of UP (on the UP website, social media platforms (Facebook, Instagram, Twitter, etc.) and in promotional materials)
  • Legitimate interests of UP (Article 6(1)(f) GDPR) or your consent, where required (Article 6(1)(a) GDPR)
• Protection of UP's legitimate interests, and the security and administration of IT systems (e.g. operation of camera systems — see Operation of the Camera System at Palacký University Olomouc)
  • Legitimate interests of UP (Article 6(1)(f) GDPR)
• Other purposes specified in a consent you have provided (e.g. newsletter subscription)
  • Your consent (Article 6(1)(a) GDPR)

UP processes only the personal data that is necessary in connection with your participation in the event, limited to what is proportionate, relevant and adequate for the purpose for which it is processed. This includes:

1. Identification data (e.g. name, surname, title)
2. Contact details (e.g. address, email address, telephone number)
3. Identification and contact details of a legal representative (where the participant is a child or minor)
4. Image and sound recordings (e.g. CCTV recordings)
5. Bank account details
6. Other data provided during the event (e.g. information from mutual correspondence)

We retain your personal data only for as long as is necessary for the specific purpose for which it is processed. Once the retention period has expired or the purpose has been fulfilled, we will delete or anonymise your personal data — that is, modify it in such a way that it can no longer be linked to you. This does not apply to personal data that must be archived for a specified period in accordance with applicable legal regulations.

UP discloses personal data only where necessary, to the following categories of recipients:

• Public authorities (e.g. Ministry of Education, Youth and Sports; tax office; Czech courts)
• IT administrators and software providers (for the purpose of operating information systems)

Data is always disclosed only to the extent necessary and with due regard for the protection of your privacy. An up-to-date list of data processors is available upon request. Please note that the list of UP's processors may change and be updated over time.

As a general rule, UP does not transfer personal data outside the European Economic Area (EEA). Where any recipient of your personal data (see section To whom is my personal data disclosed?) processes it in a country outside the EEA, your personal data may also be transferred to that third country. In such cases, UP will ensure that your personal data is processed in compliance with applicable law, in particular by putting in place appropriate safeguards such as concluding standard contractual clauses with the recipient.

We will make reasonable efforts to ensure the accuracy of your personal data. You can help us by providing accurate, truthful and current information. If you believe that any information processed by UP is inaccurate, incorrect or out of date, please let us know so that we can take corrective action.

In accordance with the GDPR, participants in UP events have the following rights:

1. Right of access to personal data (Article 15 GDPR) You have the right to obtain confirmation as to whether UP processes your personal data and, if so, to access that data and the information specified in Article 15(1)(a) to (h) GDPR. UP provides confirmation of processing and the first copy of your personal data free of charge.

2. Right to rectification (Article 16 GDPR) You have the right to request the correction of inaccurate personal data or the completion of incomplete or out-of-date data.

3. Right to erasure — "right to be forgotten" (Article 17 GDPR) You have the right to request that UP erase your personal data without undue delay where the conditions of Article 17 GDPR are met (e.g. where the data is no longer necessary for the purpose for which it was collected).

4. Right to restriction of processing (Article 18 GDPR) Where the conditions of Article 18 GDPR are met, you may request that the processing of your personal data be restricted.

5. Right to information about recipients of personal data (Article 19 GDPR) You may request that UP inform you of the recipients to whom your personal data has been disclosed, and to whom any rectification, completion, erasure or restriction of processing has subsequently been communicated.

6. Right to data portability (Article 20 GDPR) Where UP processes your data on the basis of consent or a contract and the processing is carried out by automated means, you may request that your data be provided in a structured format or transferred to another controller.

7. Right to object (Article 21 GDPR) Where UP processes your personal data for the performance of a task carried out in the public interest, in the exercise of official authority, or on the basis of its legitimate interests, you have the right to object to such processing. In that case, UP must demonstrate compelling legitimate grounds for continuing the processing.

8. Right to be notified of a personal data breach (Article 34 GDPR) Where a personal data breach is likely to result in a high risk to your rights and freedoms, UP is obliged to notify you without undue delay.

How to exercise your rights: Requests may be sent to the UP Data Protection Officer at: dpo@upol.cz. You may also contact the DPO by telephone: 585 631 187.