Privacy policy

Information on the processing of personal data of employees of oncomed manufacturing a.s.

 

Personal Data Administrator

The administrator of personal data is oncomed manufacturing a.s., company reg. no.: 247 11 667, registered office at Brno, Karásek 2229/1b, 621 00, registered in the Commercial Register maintained by the Regional Court in Brno, file no. B 6266 (hereinafter referred to as “Administrator”).

The administrator can be contacted at the address of his registered office, on the following email address: kucerova@oncomed.cz or at telephone number: +420 602 670 875.

 

Purpose of personal data processing

The Administrator processes personal data of employees mainly for the purpose of recruiting new employees, performance of the relevant employment contracts (or contracts for work outside employment), or exercise of rights and obligations of the Administrator arising from the relevant employment contract (or contracts for work outside employment), for the purpose of managing the personnel and payroll administrative work of its employees, for the purpose of providing employee benefits, for the presentation and promotion of the Administrator externally, for the protection and maintenance of the property of the Administrator and the employees, for the protection of legitimate interests of the Administrator and for the purpose of fulfilling the legal obligations of the Administrator as an employer arising from generally binding legal regulations.

 

Legal basis of personal data processing

The legal basis for the processing of personal data of the employees of the Administrator is:

performance of a contract to which the employee concerned is a data subject within the meaning of Article 6 subsection 1 paragraph b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) , fulfilment of legal obligations of the Administrator within the meaning of Article 6, subsection 1, paragraph c) GDPR, legitimate interests of the Administrator within the meaning of Article 6 subsection 1 paragraph (f) GDPR, and the consent of an employee within the meaning of Article 6 subsection 1 paragraph a) GDPR.

 

Scope of personal data processing

The Administrator processes in particular: (i) identification, (ii) contact, (iii) payment and (iv) personal profile data of employees, as well as personal data of special categories and personal data of third parties, as well as personal data provided to the Administrator by the employees and personal data collected by the Administrator (including from other sources) for the duration of the employee or similar relationship with the Administrator.

The Administrator processes personal data of employees to a reasonable and relevant extent, limited to the extent strictly necessary with regard to the purpose of processing personal data of employees.

 

Recipients of personal data

The Administrator will transfer personal data of employees to relevant state administration bodies and other recipients, to whom the Administrator is obliged to transfer personal data of its employees on the basis of relevant legal regulations.

The Administrator will also transfer personal data of the employees to the following categories of recipients of personal data: (payroll) accounting and tax advisors, lawyers, translators, operators of IT systems of the Administrator, banks, service providers, and providers of employee benefits.

Other recipients may also be processors with whom the Administrator has concluded a contract on the processing of personal data.

 

Duration of personal data processing

Personal data will be processed only for the time necessary with regard to the purpose of their processing, and:

personal data processed based on the legal basis pursuant to Article 3.1 of this document will be processed until the termination of all obligations arising from the relevant employment contract (or contract for work held outside the employment relationship). This does not affect the possibility of the Administrator to further process the personal data for other purposes based on legal bases according to Articles 3.2, 3.3 and 3.4 of this document. Personal data processed based on the legal basis pursuant to Article 3.2 of this document will be processed for the duration of the relevant legal obligation of the Administrator. Personal data processed based on the legal basis pursuant to Article 3.3 of this document will be processed for a maximum of 10 years from the termination date of all obligations arising from the relevant employment contract (or contract for work held outside the employment relationship). In the event of the commencement and duration of judicial, administrative or other proceedings concerning the rights and/or obligations of the Administrator in relation to a relevant employee, the processing of personal data will not end before the end of such proceedings. Personal data processed based on the legal basis pursuant to Article 3.4 of this document will be processed for the period specified in a written consent to the processing of the personal data or until such consent is revoked by the given employee (if the consent is revoked before the specified period).

The right to withdraw consent

All employees are entitled to revoke the consent to the processing of their personal data at any time. In such a case, the Administrator will stop processing the personal data for the given purpose and will inform the relevant employee thereof.

 

Employee rights

In connection with the processing of personal data by the Administrator, the employees have the following rights:

 

Right of access to personal data

The Administrator is obliged to provide the employee, at his/her request, with information concerning the processing of his/her personal data (especially the purpose of the processing, the categories of the personal data, the duration of their processing and the source of the personal data). The employee is also entitled to request a copy of the processed personal data. However, for their repeated provision, the Administrator is entitled to demand a reasonable fee from the employee corresponding to the incurred administrative costs associated with the provision.

 

Right to correct any inaccurate personal data and to supplement incomplete personal data

In the event that the Administrator processes inaccurate or incomplete personal data, the employees are entitled to request their correction and completion.

 

Right to delete personal data

Each employee is entitled to request that the Administrator deletes all personal data concerning the employee if one of the following reasons is given:

• the personal data are no longer needed for the purposes for which they were collected or otherwise processed, or
• the processing of the personal data is unlawful, or
• the employee objects to the processing of the personal data and there are no predominant legitimate reasons for the processing of the personal data, or
• the personal data must be deleted in order to comply with a legal obligation laid down in European Union law or in law of a member state, or
• any consent granted to the processing of personal data was revoked.

On the other hand, the employees are not entitled to request deletion of their personal data if the processing of the personal data is necessary for the fulfilment of the legal obligation of the Administrator or for the determination, exercise or defence of legal rights of the Administrator or for archival purposes.

 

The right to object to the processing of personal data

Each employee is entitled to object to the processing of the personal data which is carried out based the legitimate interest of the Administrator at any time. When raising such an objection, the Administrator assesses whether the interest in the protection of the personal data of the employee predominates the legitimate interest of the Administrator for which the personal data are processed by the Administrator. In the event that the Administrator concludes that the interest in the protection of the personal data of the employee predominates, the Administrator will stop processing the personal data of the employee for this purpose.

In the event that the Administrator concludes that the interest in the protection of the personal data of the employee predominates, the Administrator will stop processing the personal data of the employee for this purpose.

 

Right to restrict the processing of personal data

Employees have the right to request restricting of the processing of personal data only in the case of:

• when the employee objects to the processing of personal data which is carried out based on the legitimate interest of the Administrator, or
• questioning the accuracy of the personal data processed, or
• unlawful processing of personal data by the Administrator and simultaneous refusal of their deletion by the employee, or
• when the Administrator does not need personal data for the given purpose of processing, but the employee will still request the personal data to determine, exercise or defend his/her legal claims.

If any of the above conditions are met, the Administrator will temporarily disable the access to the personal data of the employee and will not process them for a certain period of time.

Right to the transferability of personal data

Each employee is entitled to obtain personal data concerning him/her and which he/she has provided to the Administrator in a structured, commonly used and machine-readable format, and to transfer these personal data to another personal data administrator without obstructions of the Administrator, or rather, each employee is entitled to request a direct transfer of the personal data by the Administrator to another personal data administrator, if technically feasible. This right belongs to the employees only in the case of processing personal data based on a consent granted to the processing of the personal data or based on the performance of a relevant employment contract (or contract for work held outside the employment relationship).

 

Right to file a complaint to the supervisory authority

Each employee is entitled to file a complaint or suggestion concerning the processing of his/her personal data to the supervisory body, which is the Office for Personal Data Protection, with its registered office in Prague, Pplk. Sochora 27, 170 00, website: www.uoou.cz at any time.