Directive of the Director of the IPP CAS
Information on the Rules for the Processing and Protection of Personal Data
(for publication by remote access)
Prepared by: Institute of Plasma Physics of the Czech Academy of Sciences, a public research institution (Ústav fyziky plazmatu AV ČR, v. v. i.), Identification No.: 613 89 021, with its registered office at Prague 8, U Slovanky 2525/1a, postcode 182 00, entered in the Register of Public Research Institutions maintained by the Ministry of Education, Youth and Sports under file reference 17113/2006-34/IPP (hereinafter also referred to as “IPP”)
Intended for data subjects: employees, employees processing personal data at the IPP, managerial employees, and other persons
______________________________________________________________________
PREAMBLE
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the “GDPR”), and other relevant legislation, in particular Act No. 110/2019 Coll., on the Processing of Personal Data, the IPP hereby informs the relevant data subjects of the rules governing the IPP’s processing of personal data.
I. DESCRIPTION OF THE PERSONAL DATA CONTROLLER
Institute of Plasma Physics of the Czech Academy of Sciences, a public research institution (Ústav fyziky plazmatu AV ČR, v. v. i.), Identification No.: 613 89 021, with its registered office at Prague 8, U Slovanky 2525/1a, postcode 182 00, entered in the Register of Public Research Institutions maintained by the Ministry of Education, Youth and Sports under file reference 17113/2006-34/IPP.
The IPP is a legal entity, constituted as a public research institution pursuant to Act No. 341/2005 Coll., and established for an indefinite period. The founder of the IPP is the Czech Academy of Sciences, pursuant to the Deed of Establishment dated 28 June 2006. The IPP is established to conduct scientific research and development in the fields of plasma physics and chemistry, optics and materials engineering. Through its activities, the IPP contributes to the advancement of knowledge and education and to the practical application of scientific research results. It acquires, processes and disseminates scientific information, issues scientific publications and provides scientific assessments, opinions and recommendations, trains researchers, develops international cooperation, organises scientific meetings, conferences and seminars, including international events, and provides infrastructure for its research. It performs its tasks both independently and in cooperation with universities and other scientific and professional institutions in the public and private sectors.
II. DESCRIPTION OF THE PERSONAL DATA PROCESSED
The IPP processes both personal data provided directly by individual natural persons (whether on the basis of consent or other legal grounds) and other personal data generated in the course of processing activities and necessary for carrying out those activities.
The personal data processed include, in particular:
a) personal details, such as first name, surname, permanent residential address, correspondence address, date of birth/age, sex, personal identification number, identity document number (identity card, passport, etc.), private/work telephone number, private/work email address, nationality, employee number, etc.;
b) economic data, such as bank account details, salary, remuneration, fees, liabilities and receivables, orders, purchases, taxes, etc.;
c) operational and location data, typically data from electronic systems related to a specific data subject, such as data on the use of information systems, data traffic and electronic communications, telephone use, access to various premises, CCTV recordings, etc.;
d) descriptive data, such as education, family/marital status, medical fitness, health-related disadvantage, details of family members (spouse, children, etc.), and similar data;
e) employment data, such as records of work, studies and work activities, employer, workplace, job assignment and position, performance appraisals, awards for work, etc.;
f) data on the data subject’s activities, such as publication activity, details of professional activities, participation in conferences, involvement in projects, details of business or study trips, etc.;
g) data relating to another person, such as address and identification details of a family member, spouse, child, partner, etc.
The applicable legal grounds for processing personal data are:
a) compliance with a legal obligation (in particular a statutory obligation), covering data required for compliance with all legislative obligations of the IPP, including, primarily, the performance of the tasks for which the IPP was established, as well as tasks carried out in the public interest or in the exercise of official authority;
b) performance of a contract, covering data required for entering into a contractual relationship and subsequently performing obligations arising therefrom, and, where applicable, prior to entering into a contract (including public procurement and similar procedures);
c) consent given directly by the data subject to the processing of personal data for one or more specific purposes;
d) the legitimate interests of the controller or, where applicable, a third party, including, for example, data enabling the protection of property and the prevention of fraud (CCTV, access to secured premises, etc.), the processing and transfer of personal data within the IPP for internal administrative and operational purposes (financial management, accounting, human resources, asset management, occupational health and safety, etc.), ensuring network and information security, and the exchange of information within agreed scientific and other cooperation, including publications, promotion, etc.
A separate subgroup of personal data comprises the so-called special categories of personal data under the relevant Articles of the GDPR, including, for example, data concerning health, data concerning criminal offences, trade union membership, etc. This separate category of personal data is processed only in specific, justified cases where such processing is required or necessary.
The data subjects whose personal data are processed include, in particular:
a) a person in an employment relationship with the IPP,
b) an applicant for employment at the IPP,
c) a student at the IPP,
d) a participant in the relevant scientific programmes,
e) an employee or student of another entity on a work or study placement at the IPP,
f) a business partner (supplier, purchaser, customer, etc.),
g) an external collaborator (e.g., a co-investigator or co-author of a publication),
h) a visitor or external participant in an event organised by the IPP,
i) an applicant for information pursuant to Act No. 106/1999 Coll.,
j) another person.
III. PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA
1. Personal data shall always be processed fairly, lawfully and in a transparent manner (the principle of fairness, lawfulness and transparency).
2. Personal data may be collected only for specified, explicitly stated and legitimate purposes (the principle of purpose limitation).
3. Personal data must be processed only to the extent which is proportionate and limited to what is necessary in relation to the purpose of the processing (the principle of data minimisation).
4. Whenever personal data are processed, measures shall be taken to ensure that inaccurate personal data are rectified or erased without delay (the principle of accuracy).
5. Personal data may be kept in a form which permits identification of the data subject only for as long as is strictly necessary for the purposes for which they are processed (the principle of storage limitation).
6. Whenever personal data are processed, appropriate security of the personal data shall be ensured by technical and organisational measures so as to prevent unauthorised or unlawful processing, loss, destruction or damage to personal data (the principle of integrity and confidentiality).
7. As a rule, data are retained only for as long as is strictly necessary in relation to the relevant personal data processing activity.
8. For the purpose of complying with statutory obligations, the IPP may disclose selected data to entities designated by legislation (for example, public authorities).
IV. RIGHTS OF DATA SUBJECTS AND THEIR EXERCISE
Under the GDPR, each data subject is entitled to exercise, vis-à-vis the controller, their own rights concerning the protection of their personal data. The controller shall enable the data subject to exercise these rights.
These rights are as follows:
a) the right of access to their own personal data;
b) the right to rectification of their own personal data;
c) the right to erasure of their own personal data (the “right to be forgotten”);
d) the right to restriction of processing of their own personal data;
e) the right to object to the processing of their own personal data;
f) the right to data portability (provision of personal data directly to the data subject in a structured, commonly used electronic format);
g) the right not to be subject to automated decision-making, including profiling (where a data subject is subject to a decision based solely on automated processing, they have the right to a review of that decision and, where appropriate, human intervention on the part of the controller);
h) the right to lodge a complaint or seek a remedy (the data subject has the right to lodge a complaint concerning the processing of personal data with a supervisory authority (in the Czech Republic, the Office for Personal Data Protection), or to seek a judicial remedy against the supervisory authority, controller or processor);
i) the right to withdraw consent to the processing of personal data.
The data subject is entitled to exercise their rights under the GDPR vis-à-vis the personal data controller by submitting a request directly to the IPP. Before handling the request, the IPP has the right and the obligation to verify the identity of the applicant.
The right to lodge a complaint with the supervisory authority:
The data subject has the right to lodge a complaint concerning the processing of personal data with the supervisory authority, namely the Office for Personal Data Protection.
Contact: Office for Personal Data Protection; address: Pplk. Sochora 27, 170 00 Prague 7; telephone: 234 665 111; website: www.uoou.cz
This Directive consolidates and supersedes all previous technical and organisational measures implemented within the IPP to ensure that the processing and protection of personal data are carried out in compliance with the applicable binding legislation and regulations.
This Directive shall take effect on the day of signature.
Tomáš Chráska, PhD.
Prague 12. 11. 2026
