Personal data protection and processing in online verification of previously completed education as an admissions requirement In accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Masaryk University informs data subjects about the conditions of online verification of previously completed education as an admissions requirement under Sections 48 and 49 of Act No. 111/1998 Coll. on Higher Education Institutions and on Modification and Amendment of Other Acts (Higher Education Act). Personal data controller The personal data controller, i.e. the person which determines the purpose and means of personal data processing, which processes the data and bears liability for the process is: Masaryk University, Žerotínovo nám. 617/9, 601 77 Brno, company identification No.: 00216224, tax ID No.: CZ00216224, data box ID: 9tmj9e4. Masaryk University (hereinafter referred to as “MU” or “data controller”) is a public higher education institution of a university type under the Higher Education Act. Its principal mission includes providing free and independent education, related scientific and research, development and innovation, artistic and other creative activities. Data protection officer The Masaryk University data protection officer is Iva Zlatušková, e-mail address poverenec@muni.cz, telephone numbers +420 549 491 030, +420 603 289 580, personal web page https://www.muni.cz/en/people/2351-iva-zlatuskova. You can get in touch with the data protection officer in case you have any questions or requests concerning the processing and protection of personal data within the framework of exercising your rights. Personal data processing MU processes personal data only in the extent necessary to correctly verify previously completed education as an admissions requirement under Sections 48 and 49 of the Higher Education Act. Personal data are stored in the MU Information system, they are protected by the system of access rights and safeguarded to the maximum extent possible in accordance with the data controller’s standards and applicable legal regulations. During processing, the data controller adheres to all the principles of personal data processing under the GDPR. Rules and principles of personal data processing at MU are governed by MU Directive No. 1/2018 – Personal Data Processing and Protection. Purpose of personal data processing The purpose of processing is online verification of previously completed education as an admissions requirement of those applicants who successfully passed entrance examinations and met other admissions requirements. MU is obliged to verify previously completed education as an admissions requirement under Sections 48 and 49 of the Higher Education Act. The data subject inserts the document certifying previously completed education into the MU Information System in the form of: · authorised conversion of a document certifying previously completed education, or · a scan of a document certifying previously completed education and a statutory declaration that the scan corresponds to the original. Categories of persons whose personal data are processed In the process of online verification of previously completed education, Masaryk University processes the personal data: of admitted applicants, i.e. natural persons who filed an application to study in an accredited degree programme at MU from the beginning of the academic year 2021/2022 and met other admissions requirements under Section 49(5) of the Higher Education Act. Categories of personal data processed MU processes the document certifying previously completed education of the applicant in the electronic form – authorised conversion of a document certifying previously completed education, or a scan of a document certifying previously completed education with a statutory declaration that the scan corresponds to the original. Legal grounds for personal data processing Personal data processing in the process of online verification of previously completed education is necessary for compliance with a legal obligation of the data controller. Transfer of personal data The data controller has no intention to transfer the document certifying previously completed education to third parties, to other countries, or to international organizations. Retention period for personal data Under the Retention Schedule (MU Directive 2/2016), the document certifying previously completed education of admitted applicants is a document of lasting value and forms a permanent part of a student file. The document becomes archival material after ten years after the termination of studies. Exercise of data subject’s rights A data subject is entitled to exercise his/her rights ensuing from the GDPR against the data controller by: · a written request with a verified signature sent to the address: Masaryk University, Data Protection Officer, Žerotínovo nám. 9, 601 77 Brno, or · sending the request to Masaryk University data box: 9tmj9e4. Right to lodge a complaint at the supervisory authority A data subject has the right to lodge a request, complaint or motion regarding the processing of personal data to the supervisory authority: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, data box ID: qkbaa2n, telephone No.: +420 234 665 111, website: www.uoou.cz/en/, e-mail address: posta@uoou.cz. Brno, 7 May 2021