Information about the processing of personal data

OTE, a.s. , Company ID No. 26 46 33 18, located in Prague 8, Karlín, Sokolovská 192/79, ZIP 186 00, registered In Commercial register in Prague, part B, file 7260 (further OTE or market operator), as an administrator of personal data, hereby informs about the method and the scope of processing of personal data, including the scope of the rights of subject´s data relating to the processing of their personal data by OTE.

OTE is processing the personal data according to EU law, particularly Regulation No. 2016/679of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; further "GDPR"), OTE is acting in accordance with Act No. 110/2019 Coll., on the processing of personal data (further "act on the processing of personal data").

Subject matter and scope of personal data processing

OTE is processing the personal data of registered market participants which were obtained with regard to GDPR requirements and the act on the processing of personal data in order to administrate its scope according to:

• Act No. 458/2000 Coll., on business conditions and public administration in the energy sectors and on an amendment to other laws (the „Energy Act“),
• Act No. 165/2012 Coll. on supported energy sources and on an amendment to some laws,
• Act No. 383/2012 Coll., on the Terms of Greenhouse Gas Emission Allowance Trading, as amended,
• Commission Regulation (EU) No 389/2013 of 2 May 2013 establishing a Union Registry pursuant to Directive 2003/87/EC of the European Parliament and of the Council, Decisions No 280/2004/EC and No 406/2009/EC of the European Parliament and of the Council and repealing Commission Regulations (EU) No 920/2010 and No 1193/2011,
• and related executive acts in force.

In situations described, the processing of personal data is considered to be legal because the processing is necessary to fulfil legal duties which apply on OTE, i.e. in these cases, the approval with personal data processing is not required.

Furthermore, OTE is legally processing personal data based on the following legal grounds:

• Agreement fulfilment,
• OTE’s legitimate interest in the protection of assets and people.

Processing of personal data in public procurement

All personal data are processed exclusively for the purpose of preparation, implementation and storage of documentation of procurement procedures and the resulting performance pursuant to Act No. 134/2016 Coll., on the public procurement, as amended (hereinafter “Public Procurement Act”) and internal regulations of the contracting authority, in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter "GDPR") and Act No. 110/2019 Coll., on the processing of personal data, and in the sense of the Public Procurement Act.

1. Purposes of personal data processing in public procurement, categories of personal data concerned and retention period
   1. In the electronic tool Tender Arena, personal data are processed for the purpose of
      • creation (registration) and administration of user accounts,
      • preparation and implementation of procurement procedures and the resulting performance to the extent necessary to meet legislative requirements,
      • sending system e-mail notifications,
      • protection against misuse of access.
   2. Within the implementation of procurement procedures, personal data may also be processed for the purpose of
      • submission, assessment and evaluation of tenders,
      • tender documents archiving.

Data retention periods

The data should be kept for the period that corresponds to applicable legal regulations or for the period corresponding to the agreement, but no later than 10 years after termination of the agreement.

Personal data processing scope

Following the relevant legal title and purpose of the processing OTE and its contractual process the subsequent personal data and categories of personal data:

• identifiers and address data: degree, name, surname, permanent/temporary place of residence, correspondence/contact address, tax identifier,
• contact data: telephone number, mobile number, email address, fax, ID Databox,
• other electronic data: IP address, cookies, authentication certificates,
• other personal data related to agreement or registration of a market participant: bank account number, registration number of market participant, EAN/EIC code of point of delivery, address of the point of delivery, information of consumption based on meter reading data, information obtained in connection with the registration for the purpose of paying aid for individual factories and heat generators, other information implying the agreement, law and EU Regulation.

OTE is not processing special categories of personal data (a.k.a. sensitive personal data).

OTE keeps records of access to their web pages (IP addresses, web browser versions, timestamp, cookies) to verify the accuracy and functionality of the graphical display of the website. These records are kept for a period of 3 months only. Thereafter they are anonymized for statistics purposes. If the subject of data does not want his computer to be recognized, it is necessary to modify the settings of the Internet browser in such a way as to remove cookies from the computer's hard drive, block cookies, or set warnings before storing cookies. In this regard, OTE publishes on its website the Term of Use of OTE website.

Calls to Help Desk are recorded in order to improve the quality of services and ensure the protection of the rights of market participants and the Market Operator.

To raise the level of services and to assure objectivity, demonstrability and security of provided services OTE is monitoring and recording communication with subjects on Help Desk telephone lines.

For OTE security reasons there is a monitoring system installed in OTE premises. The data subjects are informed constantly about being monitored by signs and glyphs placed by the entry to OTE premises. The camera records are stored for a necessary period and they are nowise further processed.

Personal data source

OTE obtains the personal data mostly from the power market participants and gas market participants in compliance with the Energy Act within the framework of CS OTE registration or signing the agreement with OTE.

OTE also obtains the personal data from public databases, from state authorities or based on special legal regulations.

Controllers and processors

The personal data may be also processed by OTE controllers based on agreements on personal data processing which are concluded in compliance with GDPR requirements as well as the action on the processing of personal data.

OTE is processing the data both manually and by automated means. The personal data protection is technically and organisationally implemented by OTE in compliance with GDPR requirements as well as the action on the processing of personal data.

OTE controllers and processors are mostly:

• IT suppliers
• Suppliers of monitoring, access and attendance systems in OTE premises,
• Other third-parties which provide or receive the services related to OTE agreement and legal fulfilment.

OTE informs that personal data may be passed on request to the third-party subjects which dispose of the legal authority to require such data, particularly the Energy Regulatory Office and the Ministry of Industry and Trade in compliance with §15a of Energy Act or for the purposes of legal, administration or other kinds of proceeding led by state administrative agency.

Rights of the data subjects

The subject of the data has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data, the purpose of the processing, the categories of personal data concerned, the period for which the personal data will be stored, information as to the information sources, the existence of automated decision-making, information about the controller and recipients or categories of recipient to whom the personal data have been or will be disclosed.

The subject of the data has the right to data rectification or completion without undue delay, to erasure, if there is a reason for that according to Article 17 of GDPR, or to restriction of personal data processing in accordance with Article 18 of GDPR. The subject of the data has the right to data portability.

OTE shall provide the required information free of charge and without undue delay, else according to the terms of Article 12 of GDPR. In case of groundless and inadequate request, particularly repetitious requests, of the subject, OTE may charge the subject appropriately to take in account the administrative costs for providing the information or announcement or refuse to satisfy the requirement.

OTE informs the subject of data about the execution of his request without undue delay. The data subject has the right to raise an objection to personal data processing and the right to appeal to the Office for Personal Data Protection.