This Personal Data Processing Policy explains how 42 Prague z. ú., with its registered office at Kolbenova 9, Prague 9, ID No.: 140 64 570, registered in the Commercial Register maintained by the Municipal Court in Prague, Section U, Insert 1028, in the performance of its business activities and activities related thereto, processes personal data about persons with whom it comes into contact in various situations (hereinafter referred to as "you").
42 Prague z. ú. ("42 Prague") is, within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the controller of your personal data, i.e. it collects, stores and uses (and otherwise processes) your personal data for the performance of its business activities (the individual purposes for which personal data are processed are defined in more detail below).
In certain cases, primarily for the purpose of providing technical background, know-how and all related services, 42 Prague z. u. is a joint administrator of your personal data with Network 42, registered with the police prefecture under number W751218379, whose headquarters are at 96, boulevard Bessieres, 75017 – Paris (collectively referred to as “42” or “Administrator”). The administrator protects all processed personal data as strictly confidential and handles them in accordance with valid and effective legal regulations in the field of personal data protection.
The 42 companies have entered into a contract through which they have negotiated their respective shares of responsibility for compliance with their obligations under the GDPR, in particular with respect to the settlement of data subjects' rights, as follows:
This Privacy Policy applies to the processing of personal data:
(i) potential business partners and during the execution of contracts with business partners,
(ii) applicants,
(iii) job seekers and cooperation,
(iv) visitors to campus and attendees of events hosted by the Administrator,
(v) visitors to the website operated by 42 Prague ("Website").
The Personal Data Processing Policy describes the purposes of processing personal data and the methods of processing, informs about the individual categories of personal data processed, their potential recipients, the retention period of personal data and your rights in relation to the protection of personal data.
LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA
Contract performance - in particular the performance of contracts with business partners 42, including pre-contractual measures such as preparation of offers etc;
Fulfilling legal obligations - especially obligations in terms of accounting and tax legislation;
Protection of the legitimate interest of the Controller - e.g. protection of the Website and internal network 42 from abuse, operation of the CCTV system, verification of persons entering the premises;
Consent - e.g. sending commercial communications (newsletter) and targeting advertising (especially on the Website).
PERSONAL DATA PROCESSED - business partners and potential business partners
Legal basis for processing
a. Performance of the contract according to Article 6, paragraph 1, letter b) GDPR,
b. Legitimate interest according to Article 6(1)(f) GDPR,
c. Fulfillment of the legal obligation under Article 6(1)(c) GDPR.
Scope of personal data and purpose of processing
The controller is entitled to process the following personal data according to the purpose of processing:
| Data subjects' data | Purposes of processing: |
| Name and surname | Fulfilling the contract, Fulfilling legal obligations, Protecting the legitimate interest of the Controller, Handling requests and suggestions |
| Contact address | Performance of the contract, Performance of legal obligations, Protection of the legitimate interest of the Controller |
| Fulfilling the contract, Fulfilling legal obligations, Protecting the legitimate interest of the Controller, Handling requests and suggestions | |
| Telephone number | Performance of the contract, Protection of the legitimate interest of the Controller |
| Account number | Performance of the contract, Performance of legal obligations, Protection of the legitimate interest of the Controller |
| ID | Performance of the contract, Performance of legal obligations, Protection of the legitimate interest of the Controller |
| IP address and information obtained through cookies (see below) | Advertising targeting on websites |
| Information on your CV | Pre-contractual measures (for jobseekers) |
Processing method
Personal data is processed both manually and automatically. Automated processing of personal data occurs for the purposes of contract performance, in particular to ensure the internal processes of the Controller. Automated processing of personal data also occurs in cases of consent to the sending of marketing communications and targeting of advertising.
Processing time
The controller is entitled to process personal data according to the purpose of processing for the following period of time:
| Performance of the contract | for the duration of the contract and for the period of time specified by the relevant legislation from the termination of the contract |
| Fulfilling legal obligations | for the period of time specified by the relevant legislation |
| Protection of the legitimate interest of the Controller | for a maximum period of three (3) years from the start of the processing, unless otherwise provided for in specific legislation or unless there is a justified need to keep the data for a longer period in connection with a specific case |
| Dealing with requests and suggestions | for as long as necessary to process the relevant request (and to document the processing of the request) |
| Sending commercial communications | for as long as consent is given to receive commercial communications and targeting of advertising, or until consent to processing is withdrawn, or in accordance with applicable law* |
| Pre-contractual measures | For the duration of the contract negotiations (during the selection process) or for the duration of the consent (in the case of inclusion in the database of potential employees and collaborators for 3 years or until the consent is withdrawn) |
* 42 Prague is entitled to process your e-mail address within the meaning of Section 7 (3) of Act No. 480/2004 Coll., on certain information society services and on amendments to certain acts (Act on certain information society services), as amended, for the purpose of disseminating commercial communications concerning its own products or services (e.g. in the form of a newsletter) in the event that you have not refused such sending.
PERSONAL DATA PROCESSED – applicants for study
Legal basis for processing
a. Performance of the contract / measures taken prior to the conclusion of the contract pursuant to Article 6(1)(b) GDPR,
b. Legitimate interest according to Article 6(1)(f) GDPR.
Scope of personal data and purpose of processing
The controller is entitled to process the following personal data according to the purpose of processing:
| Data subjects' data | Purposes of processing: |
| Name and surname | Performance of the contract, Protection of the legitimate interest of the Controller, Handling of requests and suggestions |
| Contact address | Performance of the contract, Protection of the legitimate interest of the Controller |
| Performance of the contract, Protection of the legitimate interest of the Controller, Handling of requests and suggestions | |
| Telephone number | Performance of the contract, Protection of the legitimate interest of the Controller |
| Address | Performance of the contract, Protection of the legitimate interest of the Controller |
| The results of the tests taken and other information about the applicant that the applicant submits to us as part of the admissions process | Pre-contractual measures, Protection of the legitimate interest of the Controller |
Processing method
Personal data is processed primarily by automated means. The automated processing of personal data occurs for the purposes of fulfilling the conditions of the admission procedure, in particular to ensure the internal processes of the Administrator.
Processing time
The controller is entitled to process personal data according to the purpose of processing for the following period of time:
| Pre-contractual measures | Personal data of applicants who failed the admission tests:They will be deleted after the admission procedure has been completed (within three months at the latest).Personal data of applicants who succeeded in some admission tests but did not complete the entire admission procedure: They will be retained for three years to enable these candidates to pick up where they left off. After this period, the personal data of such candidates will be deleted or permanently anonymised. |
| Protection of the legitimate interest of the controller | for a maximum period of three (3) years from the start of the processing, unless otherwise provided for in specific legislation or unless there is a justified need to keep the data for a longer period in connection with a specific case |
| Dealing with requests and suggestions | for as long as necessary to process the relevant request (and to document the processing of the request) |
PERSONAL DATA PROCESSED - job/cooperation applicants
Legal basis for processing
c. Performance of the contract / measures taken prior to the conclusion of the contract pursuant to Article 6(1)(b) GDPR,
a. Legitimate interest according to Article 6(1)(f) GDPR.
In case you express interest in cooperation with 42 Prague by responding to a specific job advertised by us, we process your personal data in the scope of name, surname, e-mail, telephone and, if applicable, other data provided in the sent CV (including a photo, if you voluntarily provide it) for the duration of the respective selection procedure (however, for a maximum of six months). Alternatively, if you give us your consent to register you in the database of job seekers and/or co-operation, we will process your aforementioned personal data for a period of three (3) years or until your consent is withdrawn.
If you express a general interest in cooperating with us by sending us your personal data in the scope of name, surname, e-mail, telephone number and possibly others via the form located on our Website or in any other way and give us your consent to your registration in the database of job seekers and/or cooperation, we process your personal data for a period of three (3) years or until your consent is withdrawn. For as long as you allow us to do so, we may, on the basis of your consent, send you offers of employment and/or cooperation that may be of interest to you.
You can withdraw your consent to the processing of your personal data at any time using the contact details below.
PERSONAL DATA PROCESSED - Campus visitors / event participants
Legal basis for processing
b. Legitimate interest according to Article 6(1)(f) GDPR.
If you visit our campus, please note that we are entitled to verify your identity and the purpose of your visit in the interest of safety and property protection. For these purposes we process your personal data in the scope of name, surname, purpose of visit, signature. We process your aforementioned personal data for a maximum period of six months. Please also note that CCTV may be installed on our campus premises for the purposes of ensuring health and safety and protection of property. You will be informed of the location of the CCTV system via information boards located outside the entrance to the monitored areas. Further information on the operation of CCTV systems is available on request from the location listed on this information board.
If you are attending events that we organise, please note that we may keep an attendance list and take photo and/or video documentation at events. You can object to this processing of your personal data by contacting us using the details below.
_________________________________
PROCESSING OF PERSONAL DATA ON THE BASIS OF CONSENT
If you give 42 consent to the processing of personal data for the purposes of sending commercial communications and targeting advertising, you acknowledge that your consent is voluntary and that you may withdraw your consent at any time. Consent is provided for a period of 5 years or until revoked.
Refusal to grant such consent shall in no way affect the business or other relationship with the Administrator. Even if you do not give this consent, 42 is entitled to send you commercial communications concerning similar services to your e-mail address or by other means of electronic communication, unless you express your opposition to this marketing outreach in advance (this opposition, so-called opt-out, can also be expressed via a link in each of the marketing emails sent).
If you give the Controller consent to the processing of personal data for other purposes, always specified in the form through which consent is given, you acknowledge that the consent is entirely voluntary, is given for the period specified in the relevant form and can be withdrawn at any time through the contacts listed below.
RECIPIENTS OF PERSONAL DATA
The Controller discloses your personal data only to authorised employees (as well as other authorised employees who are not in an employment relationship) or to individual personal data processors contracted by the Controller, or to other recipients as separate controllers. This includes, for example, processors or controllers involved in the provision of services, payments, I or marketing services. However, only to the extent necessary for the fulfilment of the individual processing purposes and on the basis of the corresponding legal title for the transfer and processing of personal data. An up-to-date list of recipients of personal data is available on request via e-mail info@42prague.com.
In cases provided for by law, the controller is entitled or obliged to transfer certain personal data on the basis of valid and effective legal regulations, for example to law enforcement authorities or other public authorities.
PERSONAL DATA OF THIRD PARTIES
Personal data of third parties, which means personal data of employees of business partners of 42 Prague and other natural persons involved in cooperation with 42 Prague, or other data that 42 Prague receives from a business partner in connection with the conclusion or performance of a contract, will be processed in accordance with applicable and effective legislation on the protection of personal data. This personal data will be used by 42 Prague exclusively for the purpose of fulfilling contracts with business partners. The Business Partner hereby acknowledges that 42 Prague will process the personal data of third parties for the duration of the contractual relationship and for the period of time stipulated by special legal regulations, if any. For a longer period of time, the data will then be kept if the need to keep the data arises in a justified case in connection with a specific case. The Business Partner is obliged to properly instruct its employees and other natural persons involved in the Business Partner's cooperation with 42 Prague about the processing of personal data by 42 Prague.
__________________________________
PERSONAL DATA PROCESSED - Website Visitors
PROCESSING OF PERSONAL DATA BY A THIRD PARTY
We use Mailchimp on our Website to manage our contacts. If you use the contact forms located on our Website you acknowledge that your information will be transferred to Mailchimp for processing (more information on privacy HERE). If you do not agree to this processing, please contact us in another way (via the contact details provided HERE).
USE OF COOKIES
Cookies are small data files that are stored on your computer, phone or other device when you visit the Website. Cookies are used to store and receive identifiers and other information about the computers, phones and other devices from which you access the Website and help us to provide, protect and improve the services we offer.
We use functional, basic analytical and marketing cookies on the Website.
FUNCTIONAL COOKIES
They are used when you visit and use the Website for informational purposes only, i.e. unless you register or give us your consent, we only collect the data that your browser transmits to our server, which is necessary in order to display the Website to you and to guarantee the stability and security of its use.
BASIC ANALYTICAL COOKIES
These cookies are only used to improve the functioning of the Website. They allow us to recognise and track the number of visitors and to monitor how our visitors use the Website. They help us to improve the way the Website works, for example by enabling users to easily find what they are looking for. These cookies do not collect personally identifiable information.
We use these tools to analyse and regularly improve the functionality of our Website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user.
MARKETING COOKIES
They are used to track the preferences of Website users for the purpose of targeting advertising, i.e. displaying marketing and advertising messages in accordance with those preferences. Marketing cookies use tools from external companies. These marketing cookies will only be used on the basis of your consent.
We use the following marketing tools (third party cookies) on our Website:
HOW CAN YOU SET COOKIES?
You can set cookies via our cookie banner. Alternatively, you can also refuse or set to use only certain cookies (depending on the type of browser) in your browser settings.
However, if you do not allow us to use basic (functional) cookies, some features of the Website may not work as they should.
The privacy settings on your computer, where you can refuse or disable the use of cookies, can be found in the menu of the respective internet browser. You can find the cookie settings in the most commonly used browsers at the following links:
LINKS TO SOCIAL NETWORKS
The social network buttons are placed on our Website mainly for the possibility of interaction with social networks to make our Website more interesting for you as a user. A connection to the relevant social network will only occur if you actively click on the relevant button. In this case, your web browser will initiate a connection to the servers of the respective social network.
RIGHTS OF DATA SUBJECTS
As a data subject, you have the following rights under the law, which you can exercise at any time under the conditions set out in the data protection legislation. These are the right (i) to have access to personal data, (ii) to have inaccurate or false personal data corrected, as well as to have incomplete personal data completed, (iii) to have personal data erased if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed or if it is established that it has been unlawfully processed, (iv) to restrict the processing of personal data, (v) to data portability, and (vi) the right to object, after which the processing of your personal data will be terminated unless it is demonstrated that there are compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, in particular if the ground is the enforcement of legal claims. You also have the possibility of contacting the Data Protection Authority (www.uoou.cz), with whom you can lodge a complaint.
In the event of repeated or manifestly unjustified requests to exercise the above rights, we shall be entitled to charge a reasonable fee for the exercise of the right in question or to refuse to exercise the right. We would inform you of such a procedure.
In order to exercise your rights, please contact us by letter to our registered office at 42 Prague or by e-mail to info@42prague.com. We reserve the right to reasonably verify the identity of the applicant for the rights in question.
This Personal Data Processing Policy is effective as of 23.11.2022