Personal data controller: Gymnasium FOSTRA International s.r.o. (hereinafter referred to as Fostra)
Headquarters: Roháčova 1148/63, Žižkov (Prague 3), 130 00 Prague

Contact details of the controller:
e-mail: info@fostra.cz
phone: +420 737 602 434

Data Protection Officer: Ing. Lucie Svobodová
Contact details of the Data Protection Officer:
e-mail: lucie.svobodova@fostra.cz
tel: +420 730 199 589

A. Purpose for processing personal data

Personal data is any information that can be used to identify a data subject or that is associated with a natural person. In particular, Fostra processes personal data for the following purposes:

1. Education on Fostra:
a. Study,
b. Teaching,
c. Admissions,
d. Student mobility,
e. Lifelong learning,
f. Library services.
2. Research, development and creative activities:
a. Research and development activities,
b. Organisation of professional conferences and seminars,
c. Publication activities.
3. Certification in selected fields of economics.
4.Fostro operations:
a. HR,
b. payroll,
c. accounting,
d. asset management,
e. information security.
5. commercial activities:
a. e-shop operations,
b. commercial activities.
6Asset Protection and Security:
a. CCTV systems,
b. Computer network security monitoring.
7. Marketing and Outreach Activities:
a. Website,
b. Alumni Club and other student clubs,
c. Marketing and Promotion.

B. Categories of persons whose data are processed

1. Employees.

2. Students.

3. Applicants for studies.

4. Participants in CŽV.

5. Graduates.

6. External collaborators.

7. Customers.

C. Collection of information

We collect personal information directly from you (even if you communicate with us, for example, by email). We may also receive personal information from third parties such as government authorities, publicly available records, etc.

D. Basic principles for the processing of personal data

1. Lawfulness principle - we always comply with applicable law when processing personal data.

2. Fairness and Transparency Principle - we process personal data openly and transparently - we inform you about the processing of the data, we are also obliged to inform you about security breaches during processing, for example.

3. Purpose limitation principle - we only process data for the purpose for which we collect it and which we have publicly disclosed.

4. Data minimisation principle - we only collect data that is strictly necessary.

5. Accuracy Principle - we make every effort to process only valid and up-to-date data.

6. Storage limitation principle - we only keep data for as long as necessary, after which it is destroyed or archived.

7. Anonymisation principle - where possible, we work with data so that its subject cannot be identified.

8. Integrity and confidentiality principle - we process data with the utmost care and security, and only those authorised to do so have access to it.

E. Legal basis for processing personal data

We may process your personal data if:

1. Fulfilling a legal obligation - this is required by law or other legal regulation (Act No. 561/2004 Coll., Education Act, § 28, paragraph 2, the school collects and processes personal data of the data subject in the following scope - name and surname, birth number, date of birth, if the birth number has not been assigned to the child, pupil or student, as well as nationality, place of birth and place of permanent residence, or place of residence in the Czech Republic according to the type of residence of the foreigner or place of residence abroad, if the child, pupil or student does not reside in the Czech Republic. Furthermore, data on previous education, including the level of education attained, the field of study, form and duration of education, if it is a secondary school, the date of commencement of education at the school, data on the course and results of education at the school, the language of instruction, data on the disadvantages of the child, pupil or student, data on exceptional talents, data on the support measures provided to the child, pupil or student by the school and on the conclusions of the examination referred to in the recommendation of the school counselling centre. The school is also entitled to process data on the medical fitness for education and on health problems that could affect the course of education, as well as the date of leaving school and, where applicable, data on the examination by which education in secondary school was completed.

   In addition to the pupil's personal data, the school is also legally obliged to process the personal data of the pupil's legal representative, including: the name and surname of the legal representative, place of permanent residence or domicile if the pupil does not have a permanent residence in the Czech Republic, address for delivery of documents, and telephone number.
   

2. Consent - the data is required for one or more specific purposes and you have given us your consent to do so.

3. Performance of a contract - the data is necessary, for example, for the performance of a contract you have concluded with us.

4. The performance of tasks in the public interest or in the exercise of public authority for which we are responsible.

5. Legitimate interest of the controller - the data is necessary e.g. to protect security or property.

F. The categories of personal data we process include, in particular:

1. Basic information such as your name, title and your relationship to us, date of birth, birth number,

2. contact details such as postal address, email address, telephone number,

3. financial information, such as information relating to payment of fees associated with your studies, bank account,

4. study information - information related to your studies at Fostra (previous education, entrance exams, specific study programme, language skills, courses enrolled in, results, etc.),

5. information on activities - e.g. publications and other creative activities,

6. photographs, audio-visual recordings where appropriate,

7. information relating to the use of our website,

8. other information you may provide.

G. Transfer and sharing of personal data

We may transfer or share your personal information with third parties if:

1. We are under a legal or other obligation (for example, to comply with the requirements of the Education Act, the National Statistics Act or to carry out an audit or financial audit);

2. it is necessary for the purposes of or in connection with legal proceedings, or for the exercise or protection of legal rights;

3. due to organisational changes within Fostro or the transfer of all or part of our business, we may need to transfer your information to new entities or third parties;

4. where it is important to pass on information to partner universities and parties with whom we work (e.g. exchange visits),

5. you have given us your consent to do so,

6. we pass on anonymised statistical information about users of our website to reliable third parties.

H. Data retention period

Personal data is retained for the necessary period of time in relation to the data processing activity in question in accordance with the applicable shredding plan and is then destroyed or archived.

I. Data security

Fostra takes the necessary measures to secure the information stored in electronic or paper form and to prevent unauthorised access to it. Data is stored in restricted areas or in databases requiring authorisation and authentication. Data security and data management agreements are in place with all data processors.

J. Rights relating to the processing of personal data

When processing personal data, the subject has the following legal rights:

1. the right of access to personal data, which means the right to request information on whether or not your personal data is being processed. If we are processing it, you have the right to obtain it from us, together with other information relating to its processing.
2. The right to rectification, which is our obligation to correct your personal data without undue delay if you notify us of its inaccuracy.
3. The right to erasure represents our obligation to erase the personal data (unless prevented by the conditions set out in the Regulation) that we process about you if at least one condition is met:
a. the personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
b. the subject withdraws consent to the processing of the personal data and there is no further legal basis on our part for processing it,
c. You object to the processing of your personal data and there are no overriding legitimate grounds for processing on our part,
d. The personal data has been unlawfully processed,
e. The personal data must be erased to comply with our legal obligation,
f. The personal data was collected in connection with the offering of information society services.
4The right to restriction of processing is your right to have us restrict the processing of your personal data where:
a. you contest the accuracy of the personal data we process about you for the time necessary to enable us to verify the accuracy of your personal data,
b. the processing of your personal data is unlawful but you refuse to erase it and instead request that we restrict its use,
c. The processing of your personal data is no longer necessary on our part, but you request it for the establishment, exercise or defence of your claims; or
d. You have objected to the processing on the grounds of decision-making based solely on automated processing, pending verification that our legitimate grounds outweigh your legitimate grounds.
5The right to data portability is your right to obtain the personal data you have provided to us in a structured, commonly used and machine-readable format and to transfer that data to another controller, where
a. The processing of the personal data is based on consent or a contract; and
b. The processing is carried out by automated means.
6. The right to object to the processing of your personal data. If you exercise the right, we will no longer process your personal data unless we can demonstrate compelling and legitimate grounds that must override your rights and interests. We may further process such personal data where necessary for the exercise and defence of legal claims.

If you are dissatisfied with the manner in which we process your personal data, you have the right to lodge a complaint with the relevant supervisory authority, which in the Czech Republic is the Office for Personal Data Protection, located at Pplk. Sochorova 27, 170 00 Prague 7, Czech Republic.