Customer’s rights and personal data processing application form
The customers as data subjects have all rights granted by General Data Protection Regulation (EU) 2016/679 (“the GDPR”) and other legal regulations.
The customers can use the forms available at any post office or on www.ceskaposta.cz to exercise their rights. These forms can be filled in by hand and handed over to post office personnel or online and submitted via the specified communication channel (preferably to gdpr@cpost.cz if the customer has an identifiable signature certificate or to Czech Post’s data mailbox with ID # kr7cdry). If the customers do not use the form, the submitted request must allow for their proper identification, i.e. it must contain all identification details specified on page one of the form.
The customers have the right to ask Czech Post for information about whether their personal data is or is not processed, and if it is processed, they have the right to access this personal data relating to them. If applicable, the customers also have the right to correct or delete or restrict the processing of their personal data, the right to withdraw their consent, and the right to object to processing. In the case of automated processing of personal data on the basis of consent or a concluded contract, the customers have the right to data portability where it is technically feasible.
Czech Post will, without undue delay and within one month of receipt of the request at the latest, inform the data subjects about the processing of their applications, which can be sent to the above-mentioned contact address of the Data Protection Officer.
In any case, should the customers believe that their personal data is being illegitimately processed (especially if Czech Post does not respond to their request for information or remedy of the condition or if the customers disagree with Czech Post’s response), the complaint can be referred to the supervisory authority - the Office for Personal Data Protection.
INFORMATION ON HOW TO FILL IN THE APPLICATION FORM FOR THE EXCERCISE OF RIGHTS WITH CZECH POST PURSUANT TO THE GENERAL DATA PROTECTION REGULATION (“the GDPR”)
The form used to exercise rights pursuant to the GDPR, which is available here, can be delivered to Czech Post’s Data Protection Officer as follows:
- To the data mailbox with ID # kr7cdry;
- By email with certified signature, addressed to: gdpr@cpost.cz;
- By letter with legalised signature attached to the form, addressed to the Data Protection Officer: Mgr. Jitka Drábková, Politických vězňů 909/4, 225 99 Prague 1;
- By filling in the form in person and submitting it at a post office or Partner Post Office after prior identification of the applicant.
We recommend that you use the electronic form of communication with the Data Protection Officer in order to receive a faster response to your request.
Time limit for response to the request
You will be provided information about the measures taken by Czech Post to comply with your request within one month from the day of receipt of your request. The requests may be complex and numerous, so this time limit can be extended by another two months, if necessary. In such case, you will be informed about the extension and the reasons thereof within the same period of time, i.e. one month.
Fee for submitting the request
You can submit a request free of charge. However, if you ask for more than one copy of the written response, a fee may be charged for your request. Similarly, if your request is unjustified or unreasonable, you may also be charged a fee. In such case, we are entitled to charge a reasonable fee to cover our administrative costs for the handling of your request. If a fee is to be charged, we will inform you about the amount of the fee and ask you for your consent to the handling of the request for which the fee is to be charged.
Rejection of the request
If your request is not granted, you will be informed within one month from the day of receipt of your request at the latest about the reasons for rejection and the possibility to submit a complaint with the supervisory authority and apply for judicial protection. If your request is evaluated as clearly unjustified or unreasonable, we have the right to reject it or charge a reasonable fee for its handling to cover our administrative costs (see the previous paragraph).
You will always be informed about the outcome of the handling of your request.
Exercise of rights
Fields 1 and 2 in the form can be used to exercise your rights. They are accompanied with explanatory notes to make it easier to fill them in. You can also find the following brief information useful. Any rights can be exercised only after proper identification. In order to make the communication as convenient as possible, please fill in your phone number (optional) that can be used by the Data Protection Officer or his/her deputy for directly contacting you in case of any missing information about your request.
Right of access - Article 15 of the GDPR
Select the information that you require for the particular service. Otherwise, we will provide you with the full range of information, if any is processed, including a copy of the processed personal data. The first copy is free of charge, any subsequent ones may be charged.
Right to rectification - Article 16 of the GDPR
If, under the rules set for a particular service, you prove that your data we are keeping is incorrect, we will arrange for it to be rectified.
Right to erasure - Article 17 of the GDPR
There are circumstances where we cannot arrange for erasure, especially if we still need your data to provide the service because without it we simply could not provide you with the requested service.
Right to restriction of processing - Article 18 of the GDPR
We will temporarily restrict the processing of your personal data for as long as we correct your data or check its legitimacy for further processing. We are obliged to inform you about imposition and lifting of any restrictions on the processing of your personal data.
Revocation of consent to the processing of personal data
If you tell us what consent you wish to revoke (preferably by describing it for a particular service), we will ensure that your personal data is not processed for the purpose for which the consent was revoked.
Right to data portability - Article 20 of the GDPR
If the processing of personal data is done by automated means (i.e. using computer technology to process either the whole or a part of the data) on the basis of a contract or explicit consent, you are entitled to have the personal data you have forwarded to us transmitted to a controller designated by you. The above mentioned right is implemented in such a way that your personal data (which we have received from you and which concerns only you) will be forwarded in a commonly used machine-readable format either directly to you or to another controller if you provide us with the contact details.
Right to object - Article 21 of the GDPR
If you identify a specific reason for which you object to the processing of data used for the service provided to you, we will carefully consider your objection and decide whether your objection is justified (your rights prevail over the reasons for processing by us) or whether the processing will continue. If you object to advertising, it is your right and we will immediately cease to send it either for the designated service or for all services, as per your request. In any case, we will inform you about the outcome of the handling of your objection.
Right to human intervention against automated decision-making - Article 22 of the GDPR
You are informed that if we make any automated decision-making, you will be informed about it as early as at the time of ordering the service. In such case, you have the right to oppose the decision made by automated means and request a human review of the decision made by those means.