Information on processing of personal data relating to the students of Brno University of Technology

Information on personal data controller

The personal data controller, i.e. Brno University of Technology with its registered office at Antonínská 548/1, 602 00 Brno, Czech Republic, Id. No.: 00216305, Tax Id. No.: CZ00216305, is a public higher-education institution established through a law. In its activities, Brno University of Technology processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and repealing Directive 95/46/EC (General Data Protection Regulation). In connection with the effect of the above specified regulation (hereinafter the “GDPR”), Brno University of Technology appointed Mgr. Lucie Schimmelová to be the data protection officer. You can contact the data protection officer at the registered office of BUT at Antonínská 548/1, 602 00 Brno, Czech Republic, or via e-mail: poverenec@vutbr.cz.

Information on the processed personal data relating to the students

For the purposes of the admission procedure, the data controller processes the following personal data relating to the data subjects, i.e. the students:

1. Name (names, if applicable) and surname, name at birth, academic titles,
2. Birth identification number,
3. Place of birth,
4. Address of the place of residence in the Czech Republic,
5. Address of the place of residence outside the Czech Republic, mailing address in the Czech Republic if provided by the data subject,
6. Date of birth, sex, residence in the Czech Republic and nationality for foreigners,
7. E-mail address, Mobile phone number,
8. Photograph for the purposes of issuing a student identity card,
9. Number of the student identity card,
10. BUT personal number,
11. Bank account number, if the student provides it for the purposes of scholarship payments.

For the purposes of keeping a register of students, the following personal data are also processed in accordance with the Act on Higher Education Institutions:

1. Information on enrolment in studies,
2. Attained education,
3. The study programme and form of study,
4. Enrolment into the next year or next block,
5. State examination passed and academic title awarded,
6. Interruption of studies,
7. Termination of studies,
8. Number of the diploma and diploma supplement, if issued.

Information on the duration of personal data processing

Information regarding the students kept in the register of students are subject to archiving as specified in the Act on Higher Education Institutions, and they will therefore be stored permanently in the paper or electronic information systems of BUT; identification data specified in paragraphs (f) and (g) for the maximum of 1 year from termination of studies. Information on the student’s bank account number will be processed for the maximum of 10 years from the last payment by BUT to the relevant account.

Lawfulness of personal data processing

Personal data are processed on the basis of law (e.g. Sections 50, 57 and 80 of the Act on Higher Education Institutions and amending and supplementing other laws (Act on Higher Education Institutions), as amended), except for the data specified in paragraphs (f) and (g), where the legal ground for processing of personal data consists in the legitimate interest of the data controller following from the necessity to communicate with the students (for example to communicate the system access information). Further, the data controller has legitimate interest in an unambiguous internal identification of individuals (students and employees) both within BUT and with regards to external entities (place of birth, BUT identification number and the number of the student identity card), in particular when it is not possible to use a different identifier in accordance with law.

Transfers of personal data

Pursuant to Section 87 (1)(i) of the Act on Higher Education Institutions, personal data are transferred to the recipient, i.e. the Ministry of Education, Youth and Sports with its registered office at Karmelitská 529/5, 118 12 Praha 1, Czech Republic. If a student requests the issuance of an ISIC card, his/her personal data in the following scope: name, surname, date of birth, photography, validity, licence number, and the name of the education institution are processed by GTS ALIVE s.r.o., Id. No.: 26193272, with its registered office in Prague 1, at Letenská 118/1, Postal Code 11800, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 78560 under the terms and conditions available at http://www.isic.cz/o-nas/pravni-dokumenty/zasady-ochrany-osobnich-udaju/

Rights of data subjects

A data subject has the right to request from the personal data controller (hereinafter also the “data controller”) access to personal data (he/she can request information as to which personal data relating to him/her are being processed), rectification and erasure of personal data and restriction of processing. A data subject has the right to object to processing and the right to portability of personal data. A data subject can deliver the requests to exercise the rights specified in the preceding sentence in person to the filing department of BUT at Antonínská 548/1, 602 00 Brno, Czech Republic, or via electronic mail to epodatelna@vutbr.cz. The aforementioned request will be assessed and dealt with in accordance with GDPR and other applicable legal regulations.

A data subject has the right to lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection, stating that the processing of his/her personal data violates GDPR. Contact details of the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, electronic filing: posta@uoou.cz .