GDPR
LAYER I.
Information obligation of Mercedes-Benz Trucks Czech Republic s.r.o.
Here you will learn all about the processing of personal data that we carry out, including details of your rights and how to exercise them.
1. Admistrator
The controller of personal data within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation 2016/679) is Mercedes-Benz Trucks Česká republika s.r.o., registered with the Municipal Court in Prague, Section C, Insert 281781, ID No.: 06418147, VAT No.: CZ 06418147, registered office at Bavorská 2666/16, Stodůlky, 155 00 Prague 5 (hereinafter referred to as the "Controller").
2. YOUR RIGHTS
In relation to the processing, you have the right to:
a. WITHDRAWAL OF CONSENT - consent may be withdrawn at any time in the manner set out below
b. ACCESS - the right to know whether or not your personal data is being processed. If personal data is processed, further the right to information about the processing to the extent prescribed and the right to obtain a copy of the data processed under certain conditions;
c. CORRECTION - the right to request a correction if the personal data processed is inaccurate. Alternatively, the right to request completion if the data is incomplete;
d. DELETION (right to be forgotten) - the right to request the erasure of data under the conditions provided for by law (withdrawal of consent, termination of contract, unlawfulness of processing);
e. LIMITATION OF PROCESSING - the right to request the marking and possible limitation (suspension) of processing pending verification of the accuracy of the data, the lawfulness of the processing, the handling of an objection or for the protection of your interests (exercise or protection or defence of rights and legal interests);
f. COMPLAINT - the right to contact the Office for Personal Data Protection with a complaint against the Controller, the processing or the conditions for exercising your rights. See www.uoou.cz for contact and other information about the Office;
g. TRANSFERABILITY - the right to obtain data for further processing by another person designated by you, to whom you transfer the data, or to request its direct transfer for further processing by another person, under the conditions set out by law.
For the individual rights, their detailed characteristics, conditions for their creation and exercise, see the relevant link. For the procedure for exercising the rights, see. Layer II.
3. LEGAL BASIS FOR PROCESSING
The legal basis for processing is the performance of a contract with the data subject pursuant to Article 6(1)(b) of the GDPR.
4. Purpose for which we will process the data
The Controller processes personal data for the purpose of negotiating and concluding the contract and its performance, resulting in (1) participation in competitions for the most efficient driver (participation, evaluation, announcement of results, including and (2) evaluation of Fleetboard telematics data ).
5. SCOPE OF THE DATA WE WILL PROCESS
The Controller processes the following personal data for the above purpose:
- identification and contact details - name, surname, telephone number, email;
- data from the Fleetboard system on the operation of the vehicles for the period of each competition and the period preceding the competitions and defined in the terms and conditions of each competition - driver card number, data from the Performance Analysis service, vehicle registration number and VIN;
- telematics data from Fleetboard on the operation of the vehicle being driven for the purpose of evaluating telematics data for the period of one year back from the date of activation of the For.Fleetboard account until its termination - driver card number, data from Performance Analysis, vehicle VIN, trip and parking logging.
6. DATA PROVISION
The provision of personal data is mandatory as it is a contractual requirement
7. PERIOD for which personal data will be stored and processed
The controller processes personal data for the period of time until the registration in the for.fleetboard.cz system is valid, and the results of competitions for 5 years from the date of the evaluation of the competition and the announcement of its results.
8. PLACE where personal data will be processed
The place of processing of personal data will be: Headquarters of the controller and processors.
9. THIRD COUNTRY
Personal data will NOT be transferred outside the EU as part of the processing.
10. PROCESSOR
I acknowledge that a data processor as defined in Article 4(8) of the GDPR or a third party authorised by the Controller to process personal data may participate in the processing of personal data. I acknowledge that in such cases the Controller will minimise the risk of unauthorised disclosure, destruction, processing or loss of personal data.
11. AUTOMATED DECISION-MAKING AND PROFILING
Automated decision-making means decision-making by technological means or based on the results of the operation of technological means without human intervention/free decision-making. Profiling means the use of personal data to assess certain personal aspects of a person, such as an estimate of their job performance, economic situation, health, personal preferences, interests, reliability, etc. There will be NO automated decision-making in connection with the processing of personal data. There will be NO profiling in connection with the processing of personal data.
LAYER II.
Rights and their application
ARTICLE I.
GENERALLY TO APPLY RIGHTS
1. CHANNELS TO APPLY RIGHTS
Rights may be excercised under the conditions set out below:
a. through the Controller's data mailbox;
b. via the e-mail address: dataprotection.trucks@daimler.com;
c. by written submission to the following address: Prague 5 - Stodůlky, Bavorská 2666/16, Postal Code 155 00;
d. in person at the address: Praha 5 - Stodůlky, Bavorská 2666/16, Postal Code 155 00;
e. by telephone at +420 271 077 482.
2. IDENTIFICATION AND SAFE COMMUNICATION
The exercise of rights must not prejudice the rights and freedoms of third parties. For this reason, the Controller has the right and obligation to identify the applicant for the exercise of rights in necessary cases. For these reasons, the Controller must choose secure and reliable communication. Reliable communication, in which the identity of the addressee does not need to be further verified, is always considered to be communication by means of an e-mail message bearing a certified electronic signature, communication by means of a data box, communication by means of a postal service provider where the document is signed and the signature of the person acting has been officially verified, or where the reply is sent by hand.
3. ORAL ASSERTION OF RIGHTS
Exceptionally, if the beneficiary so requests, it is possible to provide information or allow the exercise of rights orally. A written record shall be made of the oral provision of information or the oral exercise of rights by the beneficiary. Verification of the identity of the person concerned by means of an identity card, passport, driving licence or other document from which it can be seen that the person to whom the rights are asserted is exercising the rights shall be a condition for the oral exercise of the rights if the person concerned is not known in person.
4. APPLICATION IN ELECTRONIC FORM
If the application is made or the rights are exercised by electronic submission, the reply shall also be sent in electronic form, unless the person concerned has requested another method.
5. COSTS
The information provided to data subjects, the provision of copies to data subjects, all communications and all acts related to the exercise of rights by the data subject shall be free of charge.
6. REFUSAL AND FEE
Where a request (exercise of a right) by a data subject is manifestly unfounded or unreasonable, in particular because it is an identical or largely identical request or a request of unreasonable length which cannot be dealt with within the statutory time limit,
a. make the execution of the request conditional upon the lodging of an advance payment to cover the administrative costs associated with providing the requested information or communication or with taking the requested action - the advance payment may be requested up to the amount of the estimated costs, provided that the information, communication, etc. shall be provided to the data subject only after full reimbursement of the costs incurred; or
b. the request is not granted or the exercise of the right is refused in writing with reasons.
7. TIME LIMIT FOR PROCESSING
Requests from the data subject and responses to the exercise of the data subject's rights shall be processed without delay. The reply, containing the requested information or describing the measures taken in response to the data subject's request, etc., shall be delivered to the data subject within 30 days of the date of receipt of the request. If, for serious reasons, it is not possible to deal with the matter within the time limit, the data subject shall be informed in writing or by e-mail no later than the end of the time limit that the time limit will not be met and the reasons for this, and the time limit within which the matter will be dealt with shall be notified; the time limit shall not be extended by more than 60 days.
ARTICLE II.
RIGHT OF ACCESS AND COPY
(1) If the data subject so requests, he or she shall be provided with confirmation of whether or not his or her personal data are being processed.
2. Where personal data of the data subject are processed, the data subject shall be provided with information on:
a. the purposes of the processing and the legal basis/title for the processing of the personal data, including a reference to the legal provision, and the extent and consequences of the processing;
b. the recipient or category of recipients, if any, of the personal data;
c. the transfer of personal data to third countries, if any, including information on appropriate safeguards for the security of the data transferred to the third country;
d. the period for which the personal data will be stored and, if such period cannot be determined, the criteria for determining the storage period;
e. the right to request access to personal data relating to the data subject, the right to request their rectification or erasure, the right to request restriction of processing, the right to object to the processing of personal data and the conditions under which each right arises and how to exercise it - the data subject shall only ever be provided with information on those rights whose exercise is relevant in relation to the personal data processing in question;
f. the right to data portability, the conditions under which it arises and the conditions under which it may be exercised - where the exercise of this right is relevant in view of the nature of the processing of personal data;
g. whether automated decision-making takes place and the data subject's rights relating to automated decision-making;
h. the source of the personal data and, where applicable, the fact that the personal data come from publicly available sources;
i. the right to lodge a complaint with a supervisory authority (the Data Protection Authority);
j. whether automated decision-making in the form of profiling takes place and the significance and expected consequences of such processing for the data subject, if it is carried out.
The data subject has the right to request a copy of the personal data processed. The first provision of a copy is free of charge. Further copies shall be subject to a fee. Article I, paragraph 6 also applies here.
4. If the provision of a copy is likely to cause damage to the rights and freedoms of third parties (e.g. the copy contains personal data of third parties in relation to whose disclosure the data subject requesting the copy has no legal basis), the copy shall be anonymised accordingly. If anonymisation is not possible or if the requested information would lose its probative value by appropriate anonymisation, the copy shall not be provided.
ARTICLE III.
RIGHT TO RECTIFICATION
(1) The data subject shall have the right to rectification of the personal data processed if the personal data processed are inaccurate in relation to the purpose of the processing or incomplete in relation to the purpose of the processing of the personal data. The data subject may request the rectification (including completion) of the personal data processed or their completion.
2. If the data subject exercises the right to rectification of the personal data processed, the Controller shall immediately check the processing of the personal data in respect of which the right to rectification is exercised.
3. If the Controller concludes that the objection is justified, even if only partially, it shall immediately ensure that the remedy, i.e. the correction of the personal data processed or their completion, is carried out.
4. The data subject shall be informed of the result of the investigation and the measures taken in writing or by e-mail.
ARTICLE IV.
RIGHT OF EXCLUSION
(1) The data subject shall have the right against the controller to have personal data relating to him or her erased only:
a. if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
b. the data subject withdraws consent to the processing of the personal data and if there is no other legal basis (title) for the processing of the personal data;
c. the data subject has raised a relevant objection to the processing of the personal data;
d. personal data have been processed unlawfully, in particular without a legal basis (title) for the processing of personal data;
e. the erasure of the personal data is required to comply with a legal obligation as a result of a legal regulation or a decision issued on the basis of a legal regulation;
f. the personal data were collected in connection with the offer of information society services pursuant to Article 8(1) of the General Regulation.
2. Erasure of personal data means the physical destruction of the medium of personal data (e.g. destruction of documents) or their erasure (from multimedia media) or other permanent exclusion from further processing of personal data.
3. If the data subject exercises the right to erasure, the Controller shall review the data subject's request. If the data subject's request is justified, even partially, the erasure shall be carried out to the extent necessary. Article I, paragraph 7 of this Part applies here as well.
4. Pending the processing of the data subject's request, the personal data against which the right to erasure has been exercised shall be marked.
5. Personal data may not be erased if their processing is necessary:
a. for the exercise of the right to freedom of expression and information;
b. for compliance with a legal obligation under the law;
c. for reasons of public interest in the field of public health (Article 9(2)(h) and (i) and Article 9(3) of the General Regulation);
d. for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, where erasure is likely to prevent or seriously jeopardise the achievement of the purposes of that processing;
e. to determine, exercise and enforce the rights of the Controller.
ARTICLE V.
RIGHT TO RESTRICTION OF PROCESSING
(1) Where a data subject invokes the right to restriction of processing in respect of a specific processing of personal data, the Controller shall promptly assess the relevance of the data subject's request, primarily in terms of the fulfilment of the conditions for the exercise of the right to restriction of processing, taking into account both the content of the request and other circumstances and facts relating to the processing of personal data in question.
2. The right to restrict the processing of personal data shall be available to the data subject in the following cases:
a. The data subject contests the accuracy of the personal data;
b. the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead a restriction on their use;
c. The controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims;
d. the data subject objects to the processing.
3. The personal data subject to the restriction of processing shall be identified.
4. Where processing has been restricted, such personal data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest.
5. Before the restriction on the processing of personal data is lifted, the data subject shall be notified of the lifting of the restriction in writing or by e-mail. The notification shall specify the time when the restriction on the processing of personal data will be lifted and the reason for which it will be lifted.
ARTICLE VI.
RIGHT OF PORTABILITY
(1) Where the processing of personal data is based on personal data obtained from the data subject (either data transmitted directly by the data subject or data obtained about his or her activities, etc.) and concerns the data subject, the data subject shall have the right to the portability of such data, provided that the processing is based on the consent of the data subject concerned or is based on a contract with the data subject and is carried out by automated means. The right to data portability does not include data and information generated by the Controller on the basis of data obtained from the data subject (e.g. profiling of the data subject's expected consumer behaviour on the basis of data obtained from the data subject, etc.).
2. Under the right to portability, the data subject may request:
a. the transmission of the personal data subject to the right to data portability in a structured, commonly used and machine-readable format, in particular, a format that requires special licenses for consideration or a format that excludes further editing or other disposition (processing) of the personal data (e.g. *.pdf) may not be used, to the data subject;
b. the transmission of the personal data subject to the right of portability in a structured, commonly used and machine-readable format, in particular, a format which requires special licences for consideration or a format which precludes further editing or other disposition (processing) of the personal data (e.g. *.pdf), to another data controller identified by the data subject in the request for the transfer of personal data.
(3) The data subject's request shall not be complied with, inter alia (Article I, paragraph 6), if compliance with the data subject's request would prejudice the rights and freedoms of other persons (data subjects).
(4) A request for data portability pursuant to paragraph 2(b) shall also be refused if the transfer is not technically feasible, including a transfer which cannot be adequately secured in a manner that is reasonable in relation to the nature of the personal data transferred and the risks involved, taking into account the available technological possibilities.
5. The personal data transmitted shall be accompanied by information on the purpose of the processing of the personal data and, if requested by the data subject, information on the processing of the personal data within the scope of Article 13 of the General Data Protection Regulation.
ARTICLE VII.
AUTOMATED INDIVIDUAL DECISION-MAKING, INCLUDING PROFILING
(1) A decision in respect of a data subject, a legal act in respect of a data subject or any other measure or procedure which results in adverse legal consequences for the data subject or would otherwise similarly affect the data subject (e.g. automated rejection of an online credit application, electronic search for job applicants without human intervention and review of negative decisions by an electronic system) may not be based on an automated individual decision, including profiling, unless the decision is
a. necessary for the conclusion or performance of a contract between the data subject and the data controller;
b. permitted by law which provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject; or
c. based on the data subject's explicit consent.
2. In the cases referred to in paragraph 1(a) and (c), the controller shall ensure that appropriate measures are implemented to safeguard the rights and freedoms and legitimate interests of the data subject against the adverse effects of automated individual decision-making. Such measures shall include at least ensuring that the data subject has the opportunity to express his or her opinion before the implementation of the act with adverse consequences and the possibility of a review of the decision by the person designated by the controller, as well as human intervention, which shall mean, for example, regular review of the functionality of the automated decision-making system and adjustment of its functional conditions so as to avoid unjustified adverse interference with the rights and freedoms of the data subject or his or her legitimate interests.
3. Where sensitive data are the subject of the processing, or where individual decisions within the meaning of paragraph 1 are to be based on sensitive data, the procedure referred to in paragraph 2 may be followed only if sufficient safeguards within the meaning of paragraph 2 of this Article are provided and provided that the legal basis for the processing of personal data is the explicit consent of the data subject within the meaning of Article 1(1) of this Regulation. 9(2)(a) of the General Regulation, or the processing is necessary for reasons of substantial public interest arising from the legislation, is proportionate to the aim pursued, respects the essence of the right to data protection and provides appropriate and specific safeguards for the protection of the fundamental rights and interests of the data subject.
ARTICLE VIII.
RIGHT TO OBJECT
(1) Where the legal basis for the processing of personal data is a legal title pursuant to Article 6(1)(e) of the General Regulation (performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or a legal title pursuant to Article 6(1)(f) of the General Regulation (processing necessary for the protection of the controller's rights and legitimate interests), the data subject shall have the right to object to the processing of personal data in question.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which shall include profiling insofar as it relates to such direct marketing. If the data subject objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.
3. If the data subject exercises the right to object, the Controller shall examine the objection without delay.
4. Pending the processing of the data subject's objection, the personal data concerned or the processing of personal data shall be marked.
5. Personal data to which a legitimate objection has been raised may not be further processed unless:
a. there are compelling legitimate grounds for further processing which override the interests or rights and freedoms of the data subject; or
b. further processing was necessary for the establishment, exercise or defence of the Controller's rights.