In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – "GDPR" – the Institute of Language and Preparatory Studies of Charles University (ILPS CU) hereby informs data subjects about the conditions under which personal data are processed.

1. By completing and submitting the form in the ASTRA app, the user, as the data subject, confirms that he/she understands these terms and conditions for the processing and protection of personal data, that he/she expresses his/her consent to their wording and that he/she accepts them in their entirety.

2. The provision of personal data by the user is not mandatory, but it is not possible to access or use the app without providing personal data.

3. The controller of personal data is Charles University, Ovocný trh 560/5, 116 36 Prague 1, ID no.: 00216208, VAT no.: CZ00216208, data box ID: piyj9b4 (the " Data Controller")

4. The service provider for the ASTRA app is the Institute of Language and Preparatory Studies of Charles University, Vratislavova 29/10, 128 00 Prague 2, ID no.: 00216208, VAT no.: CZ00216208, data box ID: piyj9b4 ("ILPS CU" or the "Provider"). ILPS CU is a unit of Charles University.

5. Contact details for the Data Protection Officer of Charles University: gdpr@cuni.cz, phone: +420 771 232 578.

6. The Data Controller processes the following personal data: e-mail address, gender, age category, reason for test, language skills,for the purpose of providing a placement test using the ASTRA app, as well as for the purpose of sending commercial messages and other marketing activities.

7. The legal basis for the processing of the data referred to in point 6 is a legitimate interest under Art. 6 1 f) GDPR. The legitimate interest of the Data Controller is the processing of data for the purposes of the further progress of the examination and research, which, among other things, guarantees the continuous quality of the examination and its corresponding content in relation to the profile of examination candidates. The legitimate interest of the Data Controller also includes the processing of personal data for direct marketing purposes.

8. For the performance of the contract, the Data Controller may utilise the services of subcontractors, in particular providers of mailing services and webhosting, and transfer the processed personal data to them for this purpose. Subcontractors are bound by the obligation of confidentiality and may not use the personal data for any other purpose.

9. Personal data is not transferred outside the EU during processing.

10. The Data Controller processes and stores personal data for the period necessary to exercise the rights and obligations arising from the contractual relationship between the Provider and the user and the exercise of claims under these contractual relationships (for a period of fifteen years from the termination of the contractual relationship). Data are deleted once this period has expired.

11. The Data Controller makes automatic individual decisions in connection with the processing of personal data within the meaning of Art. 22 GDPR.

12. By filling in the order form, applicants interested in using the Provider's services:

    1. consent to the use of their personal data for the purpose of sending online commercial messages, advertising materials, direct sales, market research and direct product offers by the Provider and third parties, but not more than once per week, and

    2. declare that they do not consider the sending of information under point 12.1 to be unsolicited advertising within the meaning of Act. no. 40/1995 Coll., as amended, as the User explicitly agrees to receipt of such information under point 12.1 in conjunction with §7 of Act. no. 480/2004 Coll.

    3. The consent granted under this paragraph may be revoked by the user at any time in writing to astra-testy@ujop.cuni.cz.

13. The User has the right to request from the Administrator access to their personal data under Art. 15 GDPR, their correction under Art. 16 GDPR, or the restriction of their processing under Art. 18 GDPR. The User has the right to have their personal data deleted under Art. 17 1 a), and c) to f) GDPR and their portability under Art. 20 GDPR. The User further has the right to object to the processing of their personal data under Art. 21 GDPR.

14. The User also has the right to file a complaint with the Office for Personal Data Protection in the event that he/she believes that his/her right to privacy has been violated.

15. General information on the processing and protection of personal data at Charles University is available at Personal Data Protection (GDPR).

These terms and conditions take effect from 1 December 2023.