Privacy Policy

Introduction

Through this Privacy Policy, Metrostav Concessions a.s. (hereinafter referred to as the “Company”) informs data subjects, i.e. natural persons whose personal data it processes, about the principles governing the protection of their privacy and the personal data processing activities carried out by the Company in accordance with the European Union General Data Protection Regulation (“GDPR”).

 

Basic Information on Personal Data Processing

This Privacy Policy applies to all clients, suppliers, contractors and customers of the Company, as well as to anyone else who contacts the Company or otherwise provides or communicates personal data to it (unless stated otherwise below). This includes all individuals who use the Company’s services, provide services or subcontracting work to the Company, or otherwise have a relationship with the Company.

Personal data is processed by the Company both manually and through automated information systems. Where personal data is processed through information systems, no automated decision-making takes place.

 

Data Controller

The controller of personal data is:

Metrostav Concessions a.s.
Company ID No. (IČO): 21702462
Registered office: Koželužská 2450/4, Libeň, 180 00 Prague 8, Czech Republic
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 28916.

 

What Data the Company Collects

The Company collects the following categories of data:

1.   Data Provided by Data Subjects

Information provided in the following situations:

  • when entering into a contractual relationship with the Company or for the purpose of establishing such a relationship;
  • data provided for the execution of a contract or project;
  • when a data subject contacts the Company to request or offer goods or services;
  • when communicating with the Company, whether via email or through any contact form available on the website https://metrostav-concessions.cz;
  • when contacting the Company for any other reason.

2.   Information from Other Sources

Such sources include:

  • publicly available sources, including public registers and the Internet;
  • information received from third parties, such as employers, colleagues, or business partners of the data subject, where such information is necessary for project execution or compliance with legal obligations.

The Company may combine information collected from these sources with other information obtained through its own activities, including the processing and evaluation of previously collected personal data.

 

How the Company Uses Personal Data

The Company uses collected data for the following purposes:

  1. Protection of Property, Security and Other Rights of the Company and Third Parties

The Company has a legitimate interest in protecting its property and rights, as well as the property and rights of third parties. For this purpose, construction sites, office buildings and Company premises may be secured by CCTV systems and visitor registration systems.

Personal data is used solely for these purposes. CCTV recordings are generally retained for three days in accordance with the guidance of the Office for Personal Data Protection. Visitor records containing only necessary personal data (typically name and surname, identification document number, employer details and vehicle registration number) are retained for a maximum of 90 days.

  1. Business Cooperation and Supplier Engagement

The Company may use contact details to request services and products from existing and potential suppliers. This processing is based on the mutual legitimate interest in business cooperation.

If a data subject no longer wishes to be contacted by the Company for business purposes, they may notify the Company using any of the available contact details.

  1. Construction Activities

The Company uses personal data for the execution and administration of projects and contracts, communication with clients, customers and suppliers, and the fulfilment of all related contractual and legal obligations.

  1. Accounting

The Company uses personal data for issuing accounting documents and maintaining accounting records in accordance with applicable legal requirements.

  1. Marketing Related to the Company’s Services

The Company may use personal data of its suppliers for the preparation and submission of bids in tenders and public procurement procedures in which the Company participates.

Personal data for this purpose is processed on the basis of the mutual legitimate interest in pursuing business opportunities and concluding relevant contracts, including processing in the Company’s internal CED information system where applicable.

  1. Marketing, Advertising and Corporate Communications

The Company may use personal data for:

  • publication in promotional materials, on the Company’s website and social media profiles, based on the data subject’s consent;
  • distribution of information and news, for example through the Metrostav Group Newspaper, either on the basis of consent or the mutual legitimate interest arising from a contractual or similar relationship between the Company and the data subject.

If a data subject no longer wishes to receive such communications, they may notify the Company using any of the available contact details.

Where the Company organizes promotional, educational or other social events, it may create photographic or audiovisual recordings and publish them on its website, social media platforms or other marketing materials to inform about the event and its course.

Such recordings are not made with the intention of processing personal data, and therefore no personal data processing takes place in this context.

  1. Recruitment of New Employees

Where the Company obtains personal data for recruitment purposes, such data is used solely for filling vacant positions.

If professional psychodiagnostic assessments form part of the recruitment process, the Company processes the resulting personal data only with the explicit consent of the data subject.

Personal data for recruitment purposes is processed for the duration of the recruitment process unless the data subject consents to the retention of their personal data for a longer period for consideration in future vacancies.

Personal data of vocational school, secondary school and university students may also be processed to support education, professional development and future employment opportunities within the Company, where this arises from a contract, consent, or a mutual legitimate interest concerning internships and future cooperation.

Students who are not interested in undertaking professional internships with the Company may notify the Company accordingly using its contact details.

  1. Legal Proceedings and Protection of Legal Claims

The Company may use collected data to enforce claims, resolve disputes, or protect its rights and legitimate interests in accordance with applicable laws.

  1. Prevention and Ethics Hotline

Where a data subject submits a report through the Ethics Hotline, they consent to the processing of their personal data for the purpose of investigating the report, for a period reasonably necessary to complete the investigation and implement corrective measures.

Where personal data relating to a data subject is reported by a third party through the Ethics Hotline, the Company processes such data only to the extent necessary and for the time strictly required to investigate the report and implement remedial measures, based on the legitimate interest of the Company and third parties in ensuring legal compliance.

 

Data Sharing and Transfers

The Company may share collected data as follows:

  1. With Other Companies within the Metrostav Group

The Company may provide information or allow access to information to legal entities forming part of the Metrostav Group.

A list of all members of the Metrostav Group is available at: https://www.skupinametrostav.cz/cs/

All Metrostav Group companies are bound by confidentiality obligations and comply with applicable personal data protection legislation.

  1. With Business Partners

The Company may provide information or allow access to information to its associates, clients, suppliers, consultants, software providers, insurance companies, auditors and other service providers or business partners where they provide services involving personal data processing.

Under no circumstances does the Company disclose personal data to third parties, whether for consideration or free of charge, without a lawful basis.

All contractual partners are bound by confidentiality obligations and comply with applicable personal data protection laws.

  1. For Legal Reasons or in Connection with Disputes

The Company may share personal data where required by law:

  • with the Police of the Czech Republic, courts, public authorities or other third parties where necessary to comply with legal obligations, enforce legal claims or protect the rights and property of the Company or third parties;
  • with other parties in connection with mergers, asset sales, consolidation, restructuring, financing transactions, or transfers of ownership of all or part of the Company.
  1. With the Consent of the Data Subject

The Company may also share personal data in other ways and with other entities where the data subject has expressly consented.

In necessary cases, the Company may transfer personal data outside the European Union, particularly where it conducts business or construction activities abroad. In such cases, the Company always complies with applicable legal requirements governing international transfers of personal data.

 

Rights of Data Subjects

Data subjects may exercise the following rights regarding the processing of their personal data.

  1. Data Retention and Erasure

Personal data is retained only for the period necessary to fulfil the purpose of processing, in particular:

  • for periods required by law or other generally binding legal regulations;
  • for periods specified in a consent granted by the data subject;
  • for the duration of the contractual relationship and, as a rule, for ten (10) years after its termination, unless different statutory retention periods apply.

The Company will erase personal data upon request unless there is a legal basis for continued processing, such as:

  • statutory retention periods have not yet expired;
  • ongoing disputes or legal claims involving the data subject;
  • the data is maintained in anonymized or aggregated form;
  • retention is necessary for legitimate business purposes.
  1. Access to Personal Data

Data subjects may contact the Company at any time, free of charge, to request confirmation as to whether their personal data is being processed and, if so, to obtain information about such processing.

  1. Rectification of Personal Data

If personal data changes during a contractual relationship, such as a change of name, address, email address or telephone number, or if the data subject discovers that the Company holds inaccurate or outdated information, they have the right to request correction or updating of the data.

  1. Restriction of Processing

A data subject may request restriction of processing where:

  • the accuracy of personal data is contested and the Company is verifying it;
  • processing is unlawful, but the data subject does not wish the data to be erased;
  • the Company no longer needs the personal data, but the data subject requires it for the establishment, exercise or defence of legal claims;
  • the legitimate interest relied upon by the Company is contested and is being assessed.
  1. Data Portability

A data subject may request that the personal data held by the Company be transferred to a third party designated by the data subject.

  1. Objection to Processing

Where the Company processes personal data based on its legitimate interests, the data subject may object to such processing in accordance with the instructions contained in this Policy.

  1. Withdrawal of Consent

Where processing is based on consent, the data subject may withdraw that consent at any time in writing, including by email.

  1. Right to Lodge a Complaint

If a data subject believes that the Company processes personal data unlawfully, they may submit a complaint to the Special Personal Data Protection Officer and, if necessary, to the Office for Personal Data Protection.

 

Special Personal Data Protection Officer

The Company has established the position of Special Personal Data Protection Officer.

The officer’s responsibilities include internal and external communication, handling complaints, receiving notifications and suggestions, and addressing matters related to personal data processing within the Company.

Controller Contact Details

Metrostav Concessions a.s.
Company ID No. (IČO): 21702462
Registered office: Koželužská 2450/4, Libeň, 180 00 Prague 8, Czech Republic
E-mail: poverenec@m-concessions.cz