Statement on the processing of personal data in the Information System of the Licensed Trades Register

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the "GDPR"), we provide information on the processing of personal data in the Information System of the Licensed Trades Register (hereinafter the "IS LTR"), which is used to administer the Licensed Trades Register.

IS LTR is an information system of public administration. The Licensed Trade Register serves for registration purposes and is kept in electronic form through the IS LTR. The Licensed Trades Register (and thus the IS LTR) is used to record data on entrepreneurs (natural and legal persons) provided by the Licensed Trades Act, as well as changes in these data. The scope of the data to be registered in the Licensed Trades Register is laid down in Section 60 of the Licensed Trades Act (Act No 455/1991, on licensed trades, as amended, hereinafter the "Licensed Trades Act"). The Licensed Trades Register has two parts - public and non-public. The non-public part includes data that are, by their nature, not suitable to be published (e.g. personal identification number, mailing address). Other data are kept in the public part of the Licensed Trades Register, which are accessible to any person. The data from the non-public part of the Licensed Trades Register may only be obtained by the entrepreneur to whom the data relate, an administrative body, if it needs the data for the performance of its activities, and these data are provided in cases provided by another legal regulation. Some data from the non-public part of the Licensed Trades Register are also provided to persons that have demonstrated legal interest (e.g. public information which are transferred to the non-public part of the Licensed Trades Register after 4 years from the expiry of an entrepreneur's last trade licence).

Personal information controller and controller of the Information System of the Licensed Trades Register (IS LTR)

Minister of Industry and Trade

Na Františku 32, 110 15 Prague 1

ID No. 47609109

Tel.: +420 224 851 111, Fax: +420 224 811 089

E-mail: posta@mpo.cz

Data Box ID: bxtaaw4

(hereinafter the "MPO")

Data Protection Officer

Mgr. Jarmila Marta Šmardová

Tel.: 224 851 111

E-mail: poverenec@mpo.cz

Legal basis for and purpose of the processing of personal data

The legal basis for the processing of personal data in the Licensed Trades Register is the Licensed Trades Act and Act No 570/1991, on licensed trades offices, as amended (hereinafter the "Licensed Trades Offices Act").

The purpose of the processing of personal data is the registration and keeping records of entrepreneurs pursuing business under the Licensed Trades Act, their trade licences and other related information, the scope of which is laid down by the Licensed Trades Act.

Categories of entities

An applicant for a trade licence, an entrepreneur as a natural person, an entrepreneur as a legal person, a responsible representative, a governing body of a legal person, a head of a branch, a person continuing a licensed trade after a deceased entrepreneur, a participant in administrative proceedings, another interested person.

Categories of personal data

Personal data whose processing is necessary to comply with a legal obligation that applies to the IS LTR controller pursuant to Article 6(1)(c) of GDPR, are personal data kept in:

• the public part of the Licensed Trades Register, which are the personal data specified in Section 60(2) of the Licensed Trades Act:
  • identification details (e.g. name, surname, title, scientific rank, date of birth, company identification number, company name);
  • contact details (e.g., address of residence),
  • business data (e.g. objects of business, type of licensed trade, establishment, date of commencement and termination of a trade licence, termination of a licensed trade, suspension of a licensed trade, insolvency decision, barriers to the pursuit of the licensed trade).
• the non-public part of the Licensed Trades Register, which are the personal data specified in Section 60(3) of the Licensed Trades Act:
  • identification data (e.g. personal identification number ),
  • contact details (e.g. address of residence / place of residence in the Czech Republic or abroad, mailing address),
  • business data (e.g. details of fines and penalties, proof of education and practice).

Personal data whose processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller pursuant to Article 6(1)(e) of GDPR includes the other data related to registration and pursuit of a licensed trade (e.g. telephone contact, e-mail).

Acquisition, transfer and access to personal data in the Licensed Trades Register

Licensed trades offices acquire personal data both from the entrepreneur and from other interested persons, as well as through public information systems, such as national registers, agenda information systems (population records, foreigners' records, Criminal Register, Insolvency Register, Public Register).

The data from the IS LTR are transferred to other public administration bodies on the basis of a Licensed Trades Act or another act (e.g. to tax offices, health insurance companies, the Czech Social Security Administration, the Czech Statistical Office, the Ministry of Transport). The IS LTR provides data to the national register of persons.

The data kept in the IS LTR can be accessed by the authorised employees of municipal licensed trades offices, regional licensed trades offices and the Licensed Trades Offices of the Czech Republic, whose competence is exercised by the Ministry of Industry and Trade.

The data from the public part of the Licensed Trades Register is publicly accessible via the website (www.rzp.cz) and can be downloaded in XML format.

Licensed trades offices issue extracts from the Licensed Trades Register:

• to the entrepreneur,
• to administrative authorities to carry out their activities and in cases provided for by other legislation,
• to other persons; in the case of specified data from the non-public part of the Licensed Trades Register, only to persons who demonstrate legal interest.

The data from the public part of the Licensed Trades Register are used by the contact points of public administration - Czech POINT, through which it is also possible to obtain an extract of an entrepreneur from the public part of the Licensed Trades Register.

Security of personal data

Personal data obtained from the data subjects or from other information systems are processed in the IS LTR, which meets the security requirements in accordance with Act No 181/2014, on cyber security and amending related acts, as amended, and its implementing regulations.

Period for which personal data are kept

The data kept in the public part of the Licensed Trades Register are published for the duration of the trade licence. After an entrepreneur's last trade licence has expired, the data are published for a period of 4 years in the public part of the Licensed Trades Register. After this time, the data are transferred from the public part of the Licensed Trades Register to the non-public part. If the entrepreneur again obtains a trade licence, the data are again transferred from the non-public part of the Licensed Trades Register to the public part.

Other data related to the registration and the pursuit of the licensed trades are kept in the IS LTR for a period for which they are used for the exercise of the public authority vested in the controller.

Upon the expiry of the business entity (the death of the self-employed natural person or the deletion of the legal entity from the public register) and the expiry of the discarding period according to the filing and discarding plan, the data are discarded.

Rights of data subjects

Right of access by the data subject (Article 15 of the GDPR)

The right of the data subject can be exercised with the IS LTR administrator via the form "Data subject application", which can be delivered in the following ways:

• in person or in writing to the address of the Data Protection Officer, Ministry of Industry and Trade, Na Františku 32, 110 15 Prague 1,
• electronically, signed by a valid, recognised electronic signature at poverenec@mpo.cz,
• through Data Box ID: bxtaaw4.

Right to rectification (Article 16 of the GDPR)

The right of the data subject to rectification may be exercised with any municipal trades licensing office in person, in writing, electronically (with a valid recognised electronic signature), or via the data box of the office.

Right to erasure (Article 17 of the GDPR)

The right of the data subject cannot be exercised. The personal data of the data subject as defined in Section 60(2) of the Licensed Trades Act are kept in the IS LTR on the basis of the Licensed Trades Act and their processing is necessary to fulfil the legal obligation imposed on the controller by the Licensed Trades Act and the Licensed Trades Offices Act, and cannot be erased/delete at the request of the data subject.

Right to data portability (Article 20 of the GDPR)

The right of the data subject cannot be exercised.

In the case of data kept in the IS LTR in accordance with Section 60(2) of the Licensed Trades Act, the conditions set out in Article 20(1)(a), (b) of the GDPR [the processing of data is not based on the consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) of the GDPR; the processing is not carried out by automated means].

Right to object (Article 21 of the GDPR)

The right of the data subject can be exercised partially.

Data kept in the IS LTR pursuant to Section 60(2) of the Licensed Trades Act are processed on the basis of compliance with the legal obligation under Article 6(1)(c) of the GDPR; therefore, the right to object cannot be exercised in respect of these data.

Other data kept in IS LTR (such as contact telephone, e-mail, etc.) are processed in the public interest or in the exercise of public authority under Article 6(1)(e) of the GDPR; therefore, the right to object can be exercised in respect of these data.

The data subject has the right to lodge at any time a complaint with the supervisory authority (Article 77 of the GDPR), which is:

Office for the Protection of Personal Data

Registered office: Pplk. Sochora 727/27, 170 00 Prague 7 - Holešovice

Tel.: +420 234 665 111

E-mail: posta@uoou.cz

Data Box ID: qkbaa2n