Privacy Policy - Information on the Processing of Graduates’ Personal Data

1.  Controller of Personal Data

The data controller, Brno University of Technology, Antonínská 548/1, 602 00 Brno, ID No.: 00216305, VAT No.: CZ00216305, is a public university established by law. In the course of its activities, Brno University of Technology processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the repeal of Directive 95/46/EC (General Data Protection Regulation) and in accordance with other legal regulations. In connection with the entry into force of the aforementioned Regulation (hereinafter also “GDPR”), Brno University of Technology (hereinafter also “BUT”) has appointed a Data Protection Officer, Ms. Lucie Schimmelová, M.A. The Data Protection Officer can be contacted at: Brno University of Technology, Gorkého 62/13, 602 00 Brno, email: poverenec@vut.cz.

2.  Purposes of Personal Data Processing

The university may process graduates’ personal data in particular for the following purposes:

• maintaining the alumni agenda,
• communicating with graduates,
• organising activities, events and services intended for graduates,
• maintaining and developing the graduate community,
• registering and managing graduates’ enrolment in alumni services and university tools,
• publishing or making available selected data within alumni services, where the graduate has given consent.

If a graduate registers in the alumni portal or uses related alumni services, the university provides more detailed information on the processing of personal data separately for that specific agenda.

3.  Legal Basis for Processing

Graduates’ personal data are processed in particular on the following legal bases:

• Article 6(1)(a) GDPR – consent of the data subject, where the processing is connected with registration in the alumni portal, the sending of newsletters, publication of a profile, or other voluntary alumni communication,
• where applicable, another appropriate legal basis, if such basis exists for a specific partial agenda.

Consent is given voluntarily. Failure to provide consent or its withdrawal does not affect the graduate’s previously completed studies or the rights and obligations arising from the former student relationship.

4.  Scope of Personal Data Processed

Depending on the specific alumni agenda, the university may process in particular the following personal data of graduates:

• identification data,
• contact data,
• data relating to studies and graduation,
• professional and other profile data voluntarily provided by the graduate,
• other data necessary for the functioning of a specific alumni service.

If the alumni portal is used, the specific scope of personal data processed is set out in a separate notice relating to the alumni portal. In the portal version that has now been prepared, this scope is described in detail, including identification, study, contact, professional and verification data.

5.  Source of Personal Data

Personal data are obtained primarily directly from the graduate, in particular when registering for alumni services, completing a profile or communicating with the university.

To the extent necessary, certain data may be verified or supplemented from the university’s internal records, in particular for the purpose of verifying whether the person is in fact a graduate of the university.

6.  Recipients of Personal Data

Graduates’ personal data may be disclosed or transferred in particular to:

• university employees who need them for the performance of their work duties,
• processors providing technical, organisational or communication services for the university,
• other entities, where required by law or by a binding decision of the competent authority.

If an alumni service includes the possibility of making selected data available to other registered users, this is done only to the extent and under the conditions laid down for the specific service and, as a rule, on the basis of the graduate’s consent.

7.  Transfers of Personal Data to Third Countries

Graduates’ personal data are not normally transferred to third countries or international organisations, unless such transfer results from a specific technical service or communication platform. In such a case, the graduate will be informed in accordance with the applicable legal regulations.

8.  Retention Period of Personal Data

Graduates’ personal data are processed only for the period necessary to fulfil the relevant purpose of processing.

Where the processing is based on consent, personal data are generally processed for the duration of the consent given, i.e. until its withdrawal, but no longer than for the duration of the relevant alumni agenda or service.

If the graduate withdraws consent, their personal data will be removed, erased or anonymised without undue delay, unless their further processing is necessary on another lawful basis.

9.  Rights of the Data Subject

Under the conditions laid down by the GDPR, the graduate has the right to:

• request access to their personal data,
• request rectification of inaccurate personal data,
• request completion of incomplete personal data,
• request erasure of personal data,
• request restriction of processing,
• object to processing,
• request data portability,
• withdraw consent to processing, where processing is based on consent,
• lodge a complaint with the supervisory authority.

Requests to exercise the rights of the data subject may be submitted using the contact details of the controller or the Data Protection Officer listed above.

10.  Withdrawal of Consent

Where the processing of a graduate’s personal data is based on consent, the graduate may withdraw such consent at any time in a manner as easy as the one by which the consent was given.

Details of how consent may be withdrawn are always set out for the specific alumni service or in a separate notice relating to the alumni portal.

11.  Data Protection Officer

A graduate may contact the Data Protection Officer with any questions, requests or suggestions concerning the processing and protection of personal data or when exercising their rights.

12.  Right to Lodge a Complaint

The graduate has the right to lodge a complaint with the supervisory authority, which is:

Office for Personal Data Protection Pplk. Sochora 27 170 00 Prague 7

13.  Automated Decision-Making

When processing graduates’ personal data, no decisions are made based solely on automated individual decision-making, including profiling, unless the graduate is separately informed of such procedure.