Customer rights and form for submitting a request for personal data processing

Customers can exercise their rights using the form available here or at the post office. Customers can fill out these forms and submit them at the post office or fill them out electronically and send them via the specified communication channel (ideally either to gdpr@cpost.cz, where the customer must be identifiable by a signature certificate, or to the ČP data box - data box ID: kr7cdry). If the customer does not use the form, it is necessary for them to be properly identifiable when submitting the request in the form of their choice, and therefore to include all the identification data listed on the first page of the form in their submission.

The customer has the right to ask ČP whether their personal data is being processed and, if so, they have the right to access this personal data concerning them. Furthermore, in specific cases, the customer has the right to correct or delete, or restrict the processing of personal data, the right to withdraw consent, and the right to object to processing. In cases where personal data is processed automatically on the basis of consent or a concluded contract, the customer has the right to data portability, if technically feasible.

ČP shall always inform the data subject without undue delay, no later than one month after receiving the request, about the processing of their request, which can be submitted to the contact details of the Data Protection Officer listed above.

In any case where the customer believes that their personal data is being processed unlawfully (in particular if ČP does not respond to their request for information or rectification, or if the customer disagrees with ČP's statement), they may lodge a complaint with the supervisory authority, Supervisory Authority - Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, Prague 7, 170 00.

INFORMATION ON COMPLETING THE FORM FOR EXERCISING YOUR RIGHTS WITH THE CZECH POSTAL SERVICE UNDER THE GENERAL DATA PROTECTION REGULATION

The form used to exercise rights under the Regulation can be delivered to the CP Representative in the following ways:

1. Data box: Data box ID: kr7cdry
2. Email with certified signature to: gdpr@cpost.cz
3. By letter with an officially certified signature on the application to the address of the Authorized Representative: Mgr. Jitka Drábková, Politických vězňů 909/4, 225 99 Prague 1
4. By personally filling out a paper form at a Czech Post branch or Pošta Partner office after prior identification of the applicant.

We recommend that you choose electronic communication with the Data Protection Officer in order to speed up the response to your request.

Deadline for responding to the request

Within one month of receiving your request, ČP will provide you with information about the measures taken in response to your request.  Due to the complexity and number of requests, this period may be extended by two months if necessary. You will be informed of the extension and the reasons for it within the same period, i.e. within one month.

Application fees

Submitting a request is completely free of charge. However, if you request multiple copies of a written response, we may charge a fee for your request. The same applies if the request is deemed unfounded or unreasonable. In such cases, we are entitled to charge a reasonable fee based on administrative costs for processing the request. Before charging any fee, ČP will inform you of the amount and ask for your consent to process the fee-based request.

Rejection of application

If your request is not granted, ČP will inform you within one month of receiving the request of the reasons for the refusal and of the possibility of filing a complaint with the supervisory authority and seeking judicial protection. If ČP assesses the request as manifestly unfounded or unreasonable, it has the right to reject the request or to charge a reasonable fee based on administrative costs (see paragraph above) for processing it.
We will always inform you of the outcome of your request.

Information for filling out the form:

1/ Identification of the applicant

The form contains fields for filling in the applicant's personal details on the first page. Filling in the applicant's personal details is mandatory. If you are a ČP employee, please also fill in your personal number. If you are a former ČP employee, we do not require your personal number. The application cannot be accepted without filling in the mandatory fields (not marked with an asterisk). The applicant is required to fill in information that corresponds to the information on a valid personal document used to identify themselves at the post office. If the application is submitted in paper form at a post office, the postal worker is required to check the applicant's identification information by viewing the personal document presented by the applicant.

To facilitate communication as much as possible, we recommend that you fill in your telephone number (optional information), which the Data Protection Officer or his representative can use to contact you directly to resolve any uncertainties regarding your request.

2/ Applicant's representative

If the applicant is represented when submitting the application, the applicant's representative must present a power of attorney or other document containing all the mandatory identification details of the applicant as specified in the application form. The applicant's representative shall fill in all the required personal details in the submitted form on the basis of his/her valid personal document. The postal worker is obliged to check the completed identification details of the applicant and their representative by inspecting the applicant's personal document and the power of attorney/other document of representation submitted by the applicant's representative.

Application for a child under the age of 15

If the application is submitted by a child under the age of 15, they must be represented by a legal representative (parent/guardian). In such cases, proof of representation is not required and a verbal statement by the child's representative confirming that the mandatory fields have been completed correctly by the applicant (child) is sufficient. The child's representative shall fill in their details in the "representative's personal details" field and present their valid personal ID to the postal worker for verification of the accuracy of the personal details they have filled in for the representative.  

3/ Communication with ČP

If you do not select your preferred method of communication (letter/email/data box), the response to your request will be sent by letter to your contact or permanent address (except in cases where your request was sent to ČP by email or via a data box, in which case it will be answered by the same means).

For optimal communication, we recommend using email or a data box. Applicants who submitted their application at a branch, and were therefore already identified when submitting the application and selected email as their preferred communication channel, do not need a certified signature for further communication with ČP via email. (This is in contrast to applicants who send their application directly by email. In such a case, an email with the applicant's certified signature is required. – See the information in the introduction.)

4/ ČP services and products

If you list the products or services to which your request relates in the designated fields, we will be able to respond directly to your specific requirements. It is not necessary to fill in the exact name of the service and its ID, but if you do so, we will be able to process your request more easily.

5/ Exercise of rights

Form fields 1 and 2 are available for you to exercise your rights. These fields are accompanied by explanations to help you navigate the form. Below is a brief overview of other useful information. The basis for exercising any rights is your proper identification. To facilitate communication as much as possible, we recommend that you fill in your telephone number (optional), which the Data Protection Officer or his representative can use to contact you directly to resolve any uncertainties regarding your request.

Right of access – Article 15 of the Regulation

Select the information you require for the given service. If you do not make a selection, we will provide you with information in the full scope specified, if it is being processed, including a copy of the personal data being processed. The first copy is free of charge; additional copies may be subject to a fee.

Right to rectification – Article 16 of the Regulation

If, according to the rules set for a specific service, you prove that the data we hold about you is incorrect, we will do everything we can to correct it.

Right to erasure – Article 17 of the Regulation

There are rules under which we cannot delete your data, primarily if we still need it to provide a given service, as without it we would simply be unable to provide the requested service.

Right to restriction of processing – Article 18 of the Regulation

While we are correcting your data or determining the legitimacy of its further processing, the processing of your personal data will be temporarily restricted. We are obliged to inform you about the restriction and lifting of the restriction on the processing of your personal data.

Withdrawal of consent to the processing of personal data

If you tell us which consent you wish to withdraw (ideally by describing it in relation to a specific service), we will ensure that your personal data is no longer processed for the purpose for which consent was withdrawn.

Right to data portability – Article 20 of the Regulation

If personal data processing is carried out in an automated manner (i.e., wholly or partly using computer technology) on the basis of a contract or express consent, you have the right to have the personal data you have provided to us transferred to a controller designated by you.  This right is exercised by transferring your personal data (which we have received from you and which relates only to you) in a commonly used machine-readable format either directly to you or to another controller, if you provide their contact details.

Right to object – Article 21 of the Regulation

If you specify the specific reason for processing according to the service provided to you against which you are objecting, we will thoroughly consider your objection and compare whether your objection is justified (your rights outweigh the reasons for processing on the part of ČP), or whether processing will continue. If you object to advertising, it is your right, and we will immediately stop sending it to you for the service you have specified or for all services, according to your request. In any case, we will inform you of the outcome of your objection.

Right to human intervention against automated decision-making – Article 22 of the Regulation

Please note that if we make any automated decisions, you will be informed of this when you sign up for the service. In such cases, you have the right to object to the automated decision-making and request a human review of the decision made.