PPF Group a.s. is always your personal data controller as a job applicant (hereinafter referred to as the “Applicant”), company registration no.: 24908487, registered office: Evropská 2690/17, 160 00 Prague 6 (hereinafter referred to as “PPF Group a.s.”)
For the purpose of a particular selection procedure, another company within the PPF Group or a company that has entered into a service provision contract with PPF Group a.s. and is not a part of the PPF Group may also be your personal data controller together with PPF Group a.s., though only provided the work position within this company is subject to this particular selection procedure.
Air Bank a.s. (vč. Zonky), Bammer trade a.s., CETIN a.s., CME Services s.r.o. (CME Group), CzechToll s.r.o., EmbedIT s.r.o., Heureka Group a.s., Home Credit a.s., Home Credit Slovakia, a.s., ITIS Holding a.s., O2 Czech Republic a.s., POLL, s.r.o., PPF a.s., PPF banka a.s., PPF Real Estate s.r.o., SCT Cell Manufacturing s.r.o., SOTIO Biotech a.s., SOTIO Biotech AG, Škoda a.s., ŠKODA CITY SERVICE s.r.o., ŠKODA DIGITAL s.r.o., ŠKODA EKOVA a.s., ŠKODA ELECTRIC a.s., ŠKODA ICT s.r.o., ŠKODA PARS a.s., ŠKODA TRANSPORTATION a.s., ŠKODA TRANSTECH Oy, ŠKODA TVC s.r.o., ŠKODA VAGONKA a.s., Skytoll, a.s., TollNet a.s., TV Nova s.r.o., Vitronic Machine Vision GmbH (Vitronic Group)
OPEN GATE gymnázium a základní škola, s.r.o., Nadace The Kellner Family Foundation, Pomáháme školám k úspěchu, o.p.s.
Your personal data in this document only means those personal data you would provide to us by means of the PPF Group eRecruitment information system or which follow from related communication or in the implementation of the selection procedure itself, always in the scope required for the fulfilment of the particular purposes (i.e. always for the purposes of the particular selection procedure).
For the purpose of the particular selection procedure your personal data are processed under Article 6 par. 1, clause b) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing the Directive 95/46/EC (General Regulation on Personal Data Protection) (hereinafter referred to as “GDPR”) – contract fulfilment.
Following the completion of the selection procedure the Controller processes your personal data for the purpose of the legitimate interest of the controller, namely for the needs of proving that the selection procedure took place properly and transparently and to determine, defend and enforce the controller’s rights. The controller processes your personal data in compliance with valid and effective legislation in the area of personal data protection.
Your personal data will be processed throughout the selection procedure.
Following the completion of the selection procedure, your personal data will continue to be processed due to the legitimate interest of the controller, for a period of 12 months.
With some applicants participating in the selection procedures for a job position, their data are forwarded to personal placement portals acting as processors.
Forwarding the personal data of applicants in this category of processors only takes place in cases where the applicant enlisted in the selection procedure through these personal placement portals.
The processor also is an entity administering IT systems and providing IT services for the purpose of the selection procedure administration and organisation. This entity is Just IT Pro, s.r.o., company registration no.: 037 50 281, with its registered office at Šlechtitelů 813/21, Holice, 779 00 Olomouc.
My personal data are then forwarded to the twillio.com processor, which ensures that text alerts are sent to an applicant with the date and place of the selection procedure taking place.
The entity providing the functionality and operation of the chatbot, and the entity providing the creation of personalised videos are also in the position of the processor that personal data are forwarded to.
Certain personal data the controller processes may be shared with state institutions or other third parties in the fulfilment of obligations complying with given legislation.
PPF Group a.s. - human resources department,
address: Evropská 2690/17, 160 00 Prague 6, the Czech Republic,
email: recruitment@ppf.cz, www.ppf.eu
We would also like to inform you about principles and procedures during your personal data processing, in compliance with the provisions of Article 5 of the GDPR and with Act No. 110/2019 Sb. on Personal Data Processing.
Your personal data have been processed such that:
The controller has introduced and maintained reasonable technical and organisational measures, internal inspections and processes of the information security in compliance with the best business practice corresponding to the possible risk of a threat to you as a personal data protection subject. At the same time, the state of the technological development is taken into account with the aim of protecting your personal data against accidental loss, destruction, changes, unauthorised publication or access. These measures include inter alia taking appropriate steps to ensure the responsibility of respective employees who have access to your data, employee training, regular backup, procedures for data recovery and incident control and software protection of the equipment, on which data with personal data are stored.
Under Article 13-14 of the GDPR:
Under Article 15 of the GDPR – Right to access to My Personal Data:
Under Article 16 of the GDPR – Right to rectification of My Personal Data:
A job applicant may exercise his/her rights directly with the Controller at the above address, namely:
If a request is filed electronically, the Controller will provide the information also electronically, unless required otherwise by the job candidate. In case of a request filed electronically, the Controller must verify the identity of the person who filed the request to prevent the disclosure of information to unauthorised persons. To verify the identity, the Controller will contact the job applicant. The Controller provides the copy of processed personal data free of charge. A request filed repeatedly by the identical job applicant will be considered an obviously unreasonable request. In such a case, the Controller may charge a reasonable fee to process the applicant or deny the request.
Please acknowledge that you are responsible for the personal data you have provided and made available to the Controller and it is your duty to make sure they are relevant, truthful, exact and not misleading. You have the duty to make sure that the personal data provided do not contain material of an obscene and defamatory nature and/or are not in breach of the rights of a third person. Personal data provided must not contain malicious code.
If you provide personal data related to another person, e.g. an individual specified as your reference, you are obliged to inform this person thereof and to get his/her approval.
This document may be adjusted or updated on an ongoing basis. Any changes will become effective following the publication of the updated wording of this document at website www.ppf.eu. You will be informed of any material changes sufficiently in advance before these changes come into effect.
Under Article 17 of the GDPR – Right to erasure of My Personal Data:
a) My Personal Data are no longer required for the purposes for which they have been collected or otherwise processed;
b) I have objected to the processing under Article 21, par. 1 of the GDPR, and there are no prevailing reasons for processing, or I have objected to the processing under Art. 21, par. 2 of the GDPR;
c) My Personal Data have been unlawfully processed;
d) My Personal Data have to be erased to comply with a legal obligation in the law of the European Union or a Member State to which the Controller is subject.
a) for exercising the right to freedom of speech and information;
b) for compliance with the legal obligation that requires the processing by the law of the European Union or a Member State, to which the Controller is subject , or for the performance of the task carried out in the public interest or in the scope of a public authority if the Controller has been authorised by it;
c) for reasons of the public interest in the field of the public health;
d) for archiving purposes in the public interest, for the purpose of scientific or historical research or for statistical purposes in compliance with Art. 89, par. 1 of the GDPR; or
e) for the specification, performance or defence of legal claims.
Under Article 18 of the GDPR – Right to restriction of the processing of My Personal Data:
a) If I contest the accuracy of My Personal Data for a period enabling the Controller to verify the accuracy of My Personal Data;
b) If processing is unlawful and I would oppose the erasure of My Personal Data and request the restriction of their use instead;
c) If the Controller no longer needs My Personal Data for the processing purposes, but I would require them for the establishment, exercise or defence of legal claims;
d) If I have objected to processing under Article 21, section 1 of the GDPR, pending the verification whether the legitimate grounds of the Controller prevail over mine.
Under Article 19 of the GDPR – Notification obligation regarding rectification or erasure of My Personal Data or restriction of their processing:
Under Article 20 of the GDPR – Right to data portability:
Under Article 21 of the GDPR – Right to object:
Under Article 22 of the GDPR – Automated individual decision-making, including profiling:
I have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal impacts on me or affects me in a material way. This does not apply if the decision:
a) is necessary to enter into or perform a contract between me and the Controller;
b) is permitted by the law of the EU or a Member State applicable to which the Controller is subject and which also determines suitable measures to safeguard my rights and freedoms and legitimate interests;
c) based on may express consent.
Under Article 34 of the GDPR – Communication of a personal data breach
If it is likely that a specific instance of a security breach of My Personal Data will result in a considerable threat to my rights and freedoms, the Controller is required to report this breach to me without any undue delay.
However, the reporting referred to in this paragraph is not required if any of the following conditions are met:
a) The Controller has introduced appropriate technical and organisational measures, and these measures have been applied to the personal data affected by the personal data breach, in particular measures that render these data unintelligible to anyone who is not authorised to access them, such as encryption;
b) The Controller has taken subsequent measures that ensure that no considerable threat to the rights and freedoms referred to in the first paragraph of this article is likely to materialise;
