Information on the processing of personal data

In accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"), the Ministry of Finance, as the controller of personal data, provides this information on how it processes personal data during the organization and hosting of the Investment Treaty Arbitration Conference ( “Conference”).

1) Who is the controller of your personal data?

The personal data controller is the Ministry of Finance, with registered office at Letenská 15, 118 10 Prague 1, ID No.: 00006947. You can contact the controller via e-mail at podatelna@mfcr.cz, via data message ID DS: xzeaauv, or via postal services at the above mentioned address of the registered office.

2) Has the controller appointed a data protection officer?

As a public authority, the controller is obliged under Article 37(1)(a) of the GDPR to appoint a data protection officer ("Data Protection Officer") whose task is to ensure the protection of your personal data in cooperation with the controller. You can contact the Data Protection Officer if you believe that the controller is processing your personal data in breach of the GDPR and you can also exercise your rights under point 8 of this information. The Data Controller is an employee of the controller who can be contacted as set out above.

3) Why does the controller process personal data?

The controller is always obliged to process personal data on the basis of at least one legal basis under Article 6(1) of the GDPR. In the case of the organization and hosting of the Conference, your personal data is processed on the basis of Article 6(1)(b) GDPR, i.e. it is processing of personal data that is necessary for the performance of a contract. This contract is gratuitous and consists of an obligation on the part of the controller to provide the data subject with the online Conference service. The processing of your personal data is a condition for the provision of the service, as only the login details for the video conference call can be sent to the email provided.

4) To what extent is personal data processed?

Your personal data will be processed to the extent of identification data (name and surname) and contact data (e-mail).

5) Does the controller transfer personal data to anyone else?

The controller will not pass on your personal data to any recipients of personal data.¹

6) Are personal data transferred to third countries²?

The controller does not transfer personal data to third countries.

7) How long will the controller process the personal data?

Your personal data will be processed for the duration of the Conference.

8) What rights do I have with regard to the processing of my personal data?

As a data subject, you have the following rights:

1. the right to withdraw your consent - this right applies if you have given your consent to the processing of your personal data by registering for the Conference.
2. the right to request access to personal data - any data subject may request access to his or her personal data from the controller, within the scope and under the conditions set out in Article 15 of the GDPR.
3. right to rectification - every data subject has the right to request the controller to rectify his or her personal data on the basis of Article 16 of the GDPR.
4. right to restriction of processing - each data subject has the right to apply to the controller and to request restriction of the processing of his or her personal data under the conditions set out in Article 18 of the GDPR.
5. right to erasure - the data subject has the right to request the controller to erase his or her personal data, under the conditions set out in Article 17 of the GDPR.
6. Portability of personal data - the data subject has the right to obtain from the controller the personal data concerning him or her where the processing is based on consent [Article 6(1)(a) GDPR] or on a contract [Article 6(1)(b) GDPR] and is carried out by automated means.
7. right to lodge a complaint - every data subject has the right to lodge a complaint with a supervisory authority; the supervisory authority in the Czech Republic is the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, posta@uoou.cz, DS: qkbaa2n; the supervisory authority is obliged to inform the complainant about the progress and outcome of the complaint (Article 77 GDPR) every three months (Article 78(2) GDPR), otherwise the data subject has the right to effective judicial protection.

Prague, 1 November 2021

¹ Under Article 4(9) of the GDPR, a recipient of personal data is a natural or legal person, public authority, agency or other entity to which personal data are disclosed, whether or not it is a third party. Information on the processing of personal data for the
² Third country means a country outside the European Union or the European Economic Area. Information on the processing of personal data for the Investment Treaty Conference