Information about processing the personal data of employees
Information about processing the personal data of employees
Joint controllers: due to the centralized administration of activities of the other data controllers defined below, the personal data of employees are processed by Travel Service, a.s., ID: 25663135, registered office Praha 6, K Letišti 1068/30, 160 08 (hereinafter referred to as “TVS CZ”). TVS CZ is the parent company of the other joint controllers, namely Travel Service Slovensko s.r.o., registered office Ivanská cesta 30/B, Bratislava 821 04 (hereinafter referred to as “TVS SK”), Travel Service Kft., registered office Wesselényi u. 16/A, Budapest, 1077, Hungary (hereinafter referred to as “TVS HU”), Travel Service Polska, Sp. z o.o., registered office ul. Gordona Bennetta 2B, Warszawa, 02-159, Poland (hereinafter referred to as “TVS PL”) and Travel Service Gmbh, registered office Theatinerstraße 23, 80333 München, Germany (hereinafter referred to as “TVS DE”) (all hereinafter jointly referred to as “TVS” or “Controller”). By means of an arrangement between them, the joint controllers determined, in a transparent manner, their respective responsibilities under the General Data Protection Regulation and designated TVS CZ as the contact point for data subjects. However, data subjects may also contact the data controller with which they have entered into employment or other contractual relationship.
From the moment of entering into the contract (employment or similar) we, as the data Controller, process your personal data you provided to us in a personal questionnaire and CV and when entering into the contract (employment or similar), for the purpose of compliance with labour standards in connection with the employment relationship we have entered into. Our contact data are: Travel Service, a.s., ID: 25663135, registered office Praha 6, K Letišti 1068/30, 160 08, e-mail: firstname.lastname@example.org. If our mutual legal relationship is terminated, we will continue processing your personal data for further 5 years due to judicial protection (this applies to all personal data stated in this document, unless the statutory retention period is longer). Some documents that contain your personal data will be retained by us for the period set out in the applicable regulations. We will be happy to inform you about the concerned retention periods at your request. We transfer your personal data to the state and to various companies that need your personal data for the purpose of performance of your activities for our company also with regard to the fact that we send you abroad if you hold an applicable position. In the controller’s business in the field of civil aviation, the matters of personal data protection are very complicated, but please be assured that we handle your personal data fairly and do not disclose them to anyone who is not allowed to access them.
Further information is available on the following pages of this document.
We are hereby trying to provide you with as detailed and transparent description of the processing of your personal data as possible. However, if you have any additional questions, you may contact the data protection officer of TVS CZ, which is the law firm KUBEČKA & PROKOP, advokátní kancelář s.r.o., Kladská 5, Praha, represented by lawyer Mgr. František Kubečka, which secures a high level of personal data protection in our company. This way we also want to give you an opportunity to obtain maximum information about anything you want to know about the protection of your personal data.
If you have any questions concerning the description of the processing operations, the e-mail address of the data protection officer is: email@example.com
Some of the personal data we may have about you are:
- date of birth
- personal identification number
- insured person’s number
- biometric data contained in a passport /photograph/
- passport number and data of issue /and other information contained in the passport/
- private e-mail and telephone number
- documents of education and professional qualification
- extract from the criminal register
- height and weight
- language skills
- bank account
As part of a selection procedure (or when signing the employment or similar contract), we could, if you hold a relevant position, collect data concerning your education and experience and their levels, records of the selection procedure and, as the case may be, simulator reports, technical interview reports or other reports and records of tests (e.g. psychological test). We have the statutory obligation to transfer some of your personal data to the state, e.g. to Česká správa sociálního zabezpečení (Czech Social Security Administration), Úřad práce (Labour Office), Všeobecná zdravotní pojišťovna (General Health Insurance Company) (and other commercial health insurance companies), courts and executors. We only provide your common personal identification data to the aforesaid institutions if we are obliged to do so under a legal regulation. Where other than common personal data (not sensitive personal data or special categories of personal data, such as racial or ethnic origin, political opinions, religion or other data) are concerned, we will inform you about the reason why we need them and about the legal ground which gives us the right to process them.
If you hold a relevant position (crew, executive pilot, captain, engineer/mechanic), then when commencing your employment, you provided the controller with a copy of your passport which also contains your photograph, number of the passport, date of its issue and other information. As part of the performance of your work you are sent abroad, and the concerned authorities of the foreign countries (particularly the authorities exercising state administration in the field of civil aviation and state administration in the field of the stay of foreigners in the territory of the given country) require a copy of your passport (landing and overflight permits, visa, etc.) or, whenever possible, only data from the passport. The permit to enter a certain territory (visa, landing and overflight permits) is a legal ground for the processing that is necessary for the reason of an important public interest (protection of the concerned state from illegal migration) under the law of the Union or the Member State, which is proportionate to the aim pursued. In the event of absence of an adequacy decision of the EU Commission or any other appropriate safeguards at the time of transferring your personal data, we have to transfer such personal data due to the necessity of such transfer in order to perform the employment or similar contract – Article 49(1)(b) of GDPR (creation of corresponding working conditions) and for important reasons of public interest (protection of the concerned state from illegal migration) – Article 49(1)(d) of GDPR. We may disclose your personal data to the “payroll agencies” that process accounting, taxes and wages and that provide adequate protection of your personal data. We only disclose your personal data to such recipients that participate in the processing of wages, contracts and other activities relating to your employment relationship. We may also disclose your personal data to companies within the group Travel Service, a.s., i.e. parent, subsidiary and affiliated companies, if the processing of wages or contracts or similar administrative activities are performed centrally in some company of the group. These companies also share personal data on the grounds of administrative activities associated with the air traffic, trainings and other similar activities. Some payroll agencies are located abroad, in particular in the USA and Canada, and there are decisions of the EU Commission according to which such countries secure adequate protection of personal data and are safe in terms of the provision of your personal data. If we are obliged to provide personal data to another third country for similar reasons, we will always secure their adequate protection, either by knowing that that the EU Commission or an international treaty secures their adequate protection, or by drawing up an “export clause” with the given entity to secure such protection if no derogation for specific situations applies in our case for the transfer of personal data to third countries.
You have the right to request from the Controller access to and rectification or erasure of personal data or restriction of processing concerning you and to object to processing as well as the right to data portability. If you do not agree with the personal data processing to the extent we inform you about, you also have the right to lodge a complaint with the supervisory authority, which is Úřad pro ochranu osobních údajů (The Office for Personal Data Protection). It may seem that the exercise of your rights is complicated, so do not hesitate to contact the data protection officer who will be happy to explain your options to you. If we can ask you, please submit your complaints about processing to the independent control body in the company, which is the data protection officer – namely KUBEČKA & PROKOP, advokátní kancelář s.r.o., e-mail: firstname.lastname@example.org, and this officer will try to take such measures to make sure that no unlawful personal data processing takes place on the part of Travel Service, a.s. We make efforts to process only such personal data that have to be processed, because we are legally obliged to collect them. However, we also collect other personal data in respect of which we have defined a “legitimate interest” (it is in our interest to collect them for the purpose of effective provision of services in the field of civil aviation, and we always make a responsible evaluation that these interests are not overridden by the rights and interests of the data subject – however, you may contact us any time to object to such processing) which can be found below in this document.
The most fundamental personal data we process (without being obliged to do so under the law) on a legal ground – legitimate interest are:
- e-mail addresses in cases where we have a legitimate interest in collecting such data, i.e. the necessity to contact you in relation to the performance of work (e.g. stand-by duty; on-call duty)
- telephone number in cases where we have a legitimate interest in collecting such data, i.e. the necessity to contact you in relation to the performance of work (e.g. stand-by duty; on-call duty)
- bank account in cases where we have a legal ground for collecting such personal data, i.e. the performance of the contract between us and you, if you have informed us about the number of your bank account to remit your wages.
We will only process these personal data if you have provided them in a personal questionnaire and if it is necessary for the performance of your work, e.g. in relation to the on-call duty or remitting wages to your account. If you believe that a real ground for this processing has ceased to exist, you can raise this objection at any time (e.g. as for the bank account, when you do not wish your wages to be remitted to the bank account any more or if your wages are not remitted to the bank account; as for e-mail, if you do not perform on-call duty, etc.). We will continue processing such personal data only if another legal ground for their processing exists on our part, otherwise we will erase them. We will process such personal data for the term of the employment (or similar) contract.
Other personal data we may process depend on whether you hold any of the special positions which are typical for civil air transport and where we need such data for the fulfilment of legal obligations under special legislation in the field of civil aviation, or on our legitimate interest defined for such collection. Such data are the personal data contained in various documents – e.g. extract from the criminal register, background check, incident and accident report, pilot licence, radiotelephonist certificate, medical certificate, records of training documentation, records of the previous training documentation, cabin crew attestation and licence, copies of visa, passports, passport photographs or other records and certificates or documents of education, trainings and re-examinations. Collecting most of aforesaid data is mandatory under the Civil Aviation Act and related regulations, directives and ordinances. However, all of them form the contents of the file based on which we conscientiously select employees for the positions of responsibility.
These data may be transferred to the Úřad pro civilní letectví (Civil Aviation Authority), Letiště Praha, a.s. (movement in a non-public restricted area of the airport (SRA zone) which is conditioned by your clean criminal record and reliability ascertained by the Authority from the submitted extract from the criminal register, either for the purpose of one-time entries or airport IDC), as well as to the company training aviation professionals (CACT, s.r.o.) or other approved training organizations (ATO).
We process some personal data in order to enhance the convenience for the employees or to provide work bonuses. The data Controller arranges for you a corporate holiday with a travel agency of the data Controller’s choice or arranges for its employees accommodation, transfers from and to the airport and visa (in connection with the fulfilment of their work duties) and, in connection with this creation of adequate working conditions, the data Controller processes your personal data and transfers them to other involved entities. However, the data Controller assures you that it takes care of the adequate personal data protection. According to the Controller, this personal data processing is its legitimate interest, but if any employee says that the above stated processing is inacceptable for him/her, the Controller will be at the employee’s full disposal at the employee’s request.
Last but not least, we state other possible recipients of your personal data. They are e.g. commercial insurance companies from which we, as your employer, take out travel insurance for you, as well as examiners under ICAO standards, companies providing Dangerous Goods Training, subcontractors that provide catering services on board and have to know basic identification and contact data of the cabin crew on the grounds of the mutual contractual cooperation consisting in the sale of refreshments and supplementary goods. In order to secure mutual communication in the fulfilment of work duties, your name, surname, ID and e-mail address /sending of generated access codes to the payment terminals for on-board sales/ are provided.
If needed, you may contact us concerning personal data at any time at the e-mail address email@example.com.
All such information is available on the website: https://www.smartwings.com/cs/o-smartwings/ochrana-osobnich-udaju/
List of your rights:
I. Right to obtain basic information about processing – We are obliged to provide you with such information when obtaining personal data if we have them directly from you, and if the data were not obtained directly from you, then at the latest within one month after obtaining the personal data, or at the moment of mutual communication if the personal data are used for the purposes of such communication, or at the latest at the time of the first disclosure if we are going to disclose the data to a third party.
II. Right to access to personal data – At your request, we are obliged to confirm to you whether we process your personal data and to inform you in accordance with GDPR e.g. about the purpose, period of processing, right to erasure, etc. We will also provide you with a copy of the personal data undergoing processing, provided that this does not result in adverse interference with the rights and freedoms of other persons.
III. Right to rectification – If we have inaccurate personal data, we are obliged to rectify or complete them at your request.
IV. Right to erasure – at your request, we are obliged to erase personal data without undue delay, especially if:
- you have withdrawn your consent, and we do not have any other legal ground for the processing,
- we do not need the personal data any longer for the specified purpose for which they were processed,
- we have processed the personal data unlawfully,
- we fulfil a legal obligation laid down in legal regulations by doing so,
- you object to the personal data processing on the grounds of legitimate interests, and there are no overriding legitimate grounds,
you object to the personal data processing for the purposes of direct marketing, including profiling. If you request erasure, we are not obliged to erase personal data where the following reasons, in particular, are concerned:
the establishment, exercise or defence of legal claims,
- the compliance with a legal obligation laid down in legal regulations,
- the exercise of the right of freedom of expression and information.
V. Right to restriction of processing – we are obliged to restrict the processing of your personal data if:
- you contest the accuracy of the personal data,
- the Controller processes the personal data unlawfully, but you do not want the Controller to erase them,
- the Controller no longer needs the personal data for any of the specified purposes, but you require the Controller to maintain them for the establishment, exercise or defence of legal claims,
- you have objected to the processing on the grounds of a legitimate interest under Article
IV, and we are waiting for the verification whether the Controller’s interests override your legitimate grounds. Where personal data processing has been restricted, the Controller may only process such data by storing them, except for the situation when you give us consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural person or legal entity, or on the grounds of important public interest of the Union or of a Member State. The Controller will inform you beforehand if the restriction of processing is lifted.
VI. Right to data portability - If we process personal data on the basis of consent or a contract, and the processing is carried out fully automatically, you can request the Controller to:
- provide you with the personal data in a structured, commonly used and machine-readable format,
- transfer such data to another controller where technically feasible.
VII. Right to object – If we process your personal data on the grounds of a legitimate interest or carry out profiling, you may object to such processing at any time. We will restrict the processing until everything is clarified, and if we do not demonstrate compelling legitimate grounds for the processing subsequently, we will no longer process the personal data. If we use the data for direct marketing purposes, we will no longer process them after you lodge your objection.
VIII. Right to protection by national authorities – You have the right to lodge a complaint with the supervisory authority for personal data protection - Úřad pro ochranu osobních údajů, registered office Pplk. Sochora 27 170 00 Praha 7, website: https://www.uoou.cz/, telephone - fixed landline: +420 234 665 111 (telephone exchange). In addition, you have the right to judicial redress. You may lodge a complaint to the supervisory authority and an action to a court if you believe that your rights protected by GDPR were infringed in the consequence of the processing by the Controller.
If the control authority in your country is another authority, you may also contact it: For TVS PL: Biuro Generalnego Inspektora Ochrony Danych Osobowych, website: http://www.giodo.gov.pl For TVS SK: Úrad na ochranu osobných údajov Slovenskej republiky, website: http://www.dataprotection.gov.sk For TVS HU: Nemzeti Adatvédelmi és Infotmációszabadság Hatóság, website: http://www.naih.hu/ For TVS DE: Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, website: http://www.bfdi.bund.de
EXERCISE OF RIGHTS AGAINST THE CONTROLLER
You may exercise your rights against the Controller by using the contact data stated in the introductory part of this information, in particular electronically, by sending an e-mail to the address: firstname.lastname@example.org, or a letter to the address Na bojišti 1473/18, Nové Město, 120 00 Praha 2. If you contact us electronically, the Controller will also reply electronically, because we like to spare our forests. However, if you request a different method of communication, we will comply with your wish. You can also exercise your rights with and against any of the controllers. We will handle your requests and reply to them as soon as possible, depending on our capacities and capabilities; according to GDPR we are obliged to reply at the latest within 1 month from the receipt of the request. This period may be extended by further two months where necessary, taking into account the complexity and number of requests. However, we will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.