Information on personal data protection and processing by VINCI Construction CS Group

In connection with personal data obtained from you in connection with your enquiry regarding a job vacancy with VINCI Construction CS, we hereby provide, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the Regulation, or GDPR), the following information:

1.a) Identity and contact information of the controller and their deputy, if appointed:

The controller of personal data for the purposes of employee recruitment by VINCI Construction CS Group, including all associated rights and liabilities, is VINCI Construction CS a.s., Reg. No.: 140 80 672, with its registered office at U Michelského lesa 1581/2, 140 00, Prague 4, registered under B 27244 with the Municipal Court in Prague (VINCI Construction CS).

1.b) Purposes of processing of personal data, and legal basis of personal data processing:

The purpose of processing your personal data is: i) arranging, organising and evaluating of selection processes (employee recruitment in accordance with requirements and criteria specified by the prospective employer) to fill vacancies within the VINCI Construction CS Group, i.e. with VINCI Construction CS a.s., or any of its subsidiaries, ii) fulfilment of rights and liabilities associated with processes preceding employment, iii) application of the data in any subsequent selection processes for other suitable positions fitting you as an applicant, iv) maintaining of a database of job applicants, v) inclusion in a register of applicants and maintenance of the register (Applicant Tracking System, ATS). The legal basis for the processing of your personal data is: i) the performance of measures that must precede the establishment of an employment relationship pursuant to your application (job vacancy / employment proposal) as per Article 6, paragraph 1, letter b), of the Regulation, ii) compliance with a legal obligation to which the controller is subject as per Article 6, paragraph 1, letter c) of the Regulation, namely the Act No. 262/2006 of the Czech Legislative Code, Labour Code, as amended, and Act No. 435/2004 of the Czech Legislative Code, Employment Act, as amended, and iii) a legitimate interest pursued by the controller as per Article 6, paragraph 1, letter f) of the Regulation.

1.c) Legitimate interest of the controller or a third party where data processing is based on Article 6, par. 1, letter f), of the Regulation:

The legitimate interests of the controller on which your personal data is processed as per paragraph 1.b), clauses iii), iv), and v) above, include in particular the identification of suitable candidates among job applicants, the preservation of competitiveness, the reduction of administrative costs, and the protection of the rights and other legitimate interests of the controller.

1.d) Potential recipients or categories of recipients of personal data:

Any member of VINCI Construction CS, a.s., or any of its subsidiaries within the VINCI Construction CS group with access to the ATS system within the extent of specified job vacancies can be a potential recipient of your personal data. A company belonging to the VINCI holding of companies, of which VINCI Construction CS is a member, and the respective processors of personal data, may also be recipients of your personal data. Other potential recipients include employees of Human Resources departments of the abovespecified companies, and providers of occupational medicine services. Public authorities empowered to obtain personal data through their own specific investigations as stipulated by Czech law are not considered personal data recipients for the purposes of GDPR.

1.e) Category of personal data concerned and the source from which the personal data originates:

The categories of personal data concerned primarily include those that we have obtained directly from you. Furthermore, the categories of affected personal data also include such data that we obtained from employment or recruitment intermediaries, or from your previous employer, and possibly also from social networks or other publicly available sources. The category of personal data in question includes, depending on the nature of the personal data obtained, in particular: name, surname, date of birth, address of permanent residence, or mailing address, signature, nationality, gender, email, phone number, or other personal data listed in your CV or motivation letter.

1.f) Potential intention on the part of the controller to transfer personal data to a third country or to an international organisation, and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49, par 1, of the regulation, reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available:

The controller does not intend to transfer your personal data to a third country or to an international organisation.

We also wish to provide the following additional information:

2.a) The period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period:

Your personal data will be stored for the duration of the selection process relevant to the vacancy to which you apply or a similar position but no longer than for the period required by the purposes for which such personal data are processed. Where an employment relationship results from the selection process, your personal data will be stored for the period stipulated by the relevant legislation (e.g. Act. No. 582/1991 of the Czech Legislative Code, on social security, as amended).

2.b) The existence of the right to request from the controller access to, and rectification or erasure of, personal data or the restriction of processing concerning the data subject or to object to processing as well as the right to data portability:

As a data subject you are entitled in particular to request from the controller: a) access to your personal data as per Article 15, b) rectification by means of correcting incorrect personal data and/or supplementing incomplete personal data as per Article 16, c) the erasure of personal data concerning you as the data subject as per Article 17, and d) the restriction of processing personal data concerning you as per Article 18 of the Regulation. You are also entitled to object to the processing of your personal data as specified in Article 21 of the Regulation. Article 20 of the Regulation determines the conditions under which you are entitled to portability of your personal data.

You may exercise any of your rights described above with VINCI Construction CS, a.s., in writing by addressing your letter to: U Michelského lesa 1581, 140 00 Prague 4 or, by electronic mail, to info@vinci-construction.cz. 

All information contained herein as well as any reports provided and actions performed in accordance with Articles 15 to 22, and Article 34 of the Regulation and the exercising of individual rights and obligations by the controller are free of charge. In the case of requests that are manifestly unfounded or excessive, in particular because of their repetitive nature, the controller may either a) charge a reasonable fee corresponding to the administrative costs associated with the provision of the information or the performance of the requested steps, or b) refuse to act on such a request. In response to a request made in accordance with Article 15 to 22, the controller shall provide information about the measures adopted. The response shall be provided without undue delay and no later than one month from the reception of the request. This period may be extended by another two months where necessary due to the complexity and/or number of requests received.

You are also advised that when a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person, the controller shall communicate the personal data breach to the data subject without undue delay as per Article 34 of the Regulation.

2.c) Where personal data processing is based on provisions of Article 6, par. 1., letter a), or Article 9, par. 2, letter a), of the Regulation, there is the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal:

The processing of your personal data is not based on provisions of Article 6, par. 1., letter a), or Article 9, par. 2, letter a), of the Regulation (consent with processing). 

2.d) The existence of the right to file a complaint with a supervisory authority:

You, as the data subject, are entitled to file a complaint with the relevant supervisory authority, namely the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Reg. No.: 70837627, with offices at Pplk. Sochora 27, 170 00 Prague 7. The website of the supervisory authority can be found at www.uoou.cz.

2.e) Information as to whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as to whether the data subject is obliged to provide the personal data and the possible consequences of failure to provide such data:

The personal data provided by you constitute a statutory requirement essential for the exercise of the rights and liabilities of your potential employer, as stipulated by the relevant legislation. Your personal data must also be entered into the employment contract or similar contractual arrangement that forms the basis of the employment relationship between you and your employer. Without the provision of your personal data the purposes for which such data are to be processed could not be fulfilled, i.e. you would be unable to participate in the selection process to fill a job vacancy and it would not be possible to establish an employment relationship with you. 

2.f) The existence of automated decision-making, including profiling, referred to in Article 22, par. 1 and 4, of the Regulation, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Neither your personal data nor you as a job applicant are subject to automated decision-making or profiling as specified in in Article 22, par. 1 and 4, of the Regulation.

Prague, 1 July 2022