Information on the processing and protection of personal data – for participants in courses and study programmes, including lifelong learning provided by ILPS CU and for candidates for examinations organised by ILPS CU

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – "GDPR" – the Institute of Language and Preparatory Studies of Charles University (ILPS CU) hereby informs data subjects about the conditions under which personal data are processed.

1. By submitting the application, the user, as the data subject, confirms that he/she understands these terms and conditions for the processing and protection of personal data, that he/she expresses his/her consent to their wording and that he/she accepts them in their entirety.

2. While the provision of personal data by the user is not mandatory, it is necessary for the conclusion and performance of the contract. If personal data are not provided, it will not be possible to accept the application or conclude the contract.

3. The controller of personal data is Charles University, Ovocný trh 560/5, 116 36 Prague 1, ID no.: 00216208, VAT no.: CZ00216208, data box ID: piyj9b4 (the " Data Controller")

4. The service provider ordered by the user through submission of the application is the Institute of Language and Preparatory Studies of Charles University, Vratislavova 29/10, 128 00 Prague 2, ID no.: 00216208, VAT no.: CZ00216208, data box ID: piyj9b4 ("ILPS CU" or the "Provider"). ILPS CU is a unit of Charles University.

5. Contact details for the Data Protection Officer of Charles University: gdpr@cuni.cz, phone: +420 771 232 578.

6. The Data Controller processes the following personal data: identification and address data (name, surname, date and place of birth, gender, nationality, address (including e-mail address), telephone number, personal ID number, etc.), descriptive data (education, knowledge of foreign languages and Czech, etc.),for the purpose of providing a course or study programme, including lifelong learning/ language exams, as well as for the purpose of sending commercial messages and other marketing activities.

7. The legal basis for the processing of personal data as stated in point 6 is the performance of the contract under Art. 6 1 b) GDPR, fulfilment of the statutory obligations of the Data Controller under Art. 6 1 (c) GDPR and a legitimate interest under Art. 6 1 f) GDPR. The legitimate interest of the Data Controller is the processing of personal data for direct marketing purposes.

8. In the case of the Certified Examination in Czech for Foreigners and the Citizenship Examination, the Data Controller processes more detailed personal data of a descriptive nature (employment, length of study of Czech, place of instruction, etc.), which the user enters into the questionnaire for candidates as part of the application. The purpose of processing this data is the further progress of the examination and research. Data are processed anonymously.

9. The legal basis for the processing of the data referred to in point 8 is a legitimate interest under Art. 6 1 f) GDPR. The legitimate interest of the Data Controller is the processing of data for the purposes of the further progress of the examination and research, which, among other things, guarantees the continuous quality of the examination and its corresponding content in relation to the profile of examination candidates.

10. In the case of online teaching, lessons can be recorded. These recordings can be used in a reasonable manner for internal purposes of UJOP Charles University.

11. For the performance of the contract, the Data Controller may utilise the services of subcontractors, in particular CRM system providers, mailing services, webhosting and insurance, and transfer the processed personal data to them for this purpose. Subcontractors are bound by the obligation of confidentiality and may not use the personal data for any other purpose.

12. Personal data are not transferred outside the EU during processing.

    An exception may be made for the

    • notification of an intermediary agency outside the EU about application processes for the lifelong learning programme. This is done solely at the explicit request of the applicant, which is stated in the application form;

    • transfer of personal data (entered by the candidate on the application form for the language examination) to an examination centre outside the EU for the sole purpose of sitting the examination.

13. The Data Controller processes and stores personal data for the period necessary to exercise the rights and obligations arising from the contractual relationship between the Provider and the user and the exercise of claims under these contractual relationships (for a period of fifteen years from the termination of the contractual relationship). Data are deleted once this period has expired.

14. The Data Controller makes automatic individual decisions in connection with the processing of personal data within the meaning of Art. 22 GDPR.

15. The User has the right to request from the Administrator access to their personal data under Art. 15 GDPR, their correction under Art. 16 GDPR, or the restriction of their processing under Art. 18 GDPR. The User has the right to have their personal data deleted under Art. 17 1 a), and c) to f) GDPR and their portability under Art. 20 GDPR. The User further has the right to object to the processing of their personal data under Art. 21 GDPR.

16. The User also has the right to file a complaint with the Office for Personal Data Protection in the event that he/she believes that his/her right to privacy has been violated.

17. General information on the processing and protection of personal data at Charles University is available at Personal Data Protection (GDPR).

These terms and conditions take effect from 1 December 2023.