Personal Data Protection

Declaration on the protection of personal data

Firstly we need to say that we see the protection of your personal data as an important task. České aerolinie a.s., registered office at K Letišti 1068/30, Ruzyně, 161 00 Praha 6, ID no.: 45795908, incorporated in the Companies Register kept by the Municipal Court in Prague, Section B, File 1662 (“Czech Airlines”), appreciates your trust which you put into us when using our services. We promise to protect the personal data which you provide.

On this website you will find information on why, when, how and what personal data are processed by the Czech Airlines. You will learn how to contact us if have any inquiries regarding the processing of your personal data or how to correct the personal data.

The personal data protection regulation may be changed and updated by the Czech Airlines in certain circumstances. Therefore we ask you to visit this website, in your own interest, and make sure to keep yourself updated about its content.

The Czech Airlines undertake to adopt all measures to prevent the misuse of the personal data provided by you. Your personal data will only be processed when there are legal grounds for their processing. Thank you for using our services!

Basic terms and information

Before we go onto describe why, when, how and what personal data are processed by the Czech Airlines, we have to explain some basic terms regarding the protection of personal data. We believe you will gain a better understanding and insight into the reasons why the Czech Airlines process the personal data in the particular manner.

Personal data

Personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (name, number, online identifier) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special categories of personal data

This is just a new term for sensitive personal data. This category covers personal data which may harm the data subject in society, at work, at school or which may result in his or her discrimination. Such personal data usually reveal his or her racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and involve the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Data subject

A data subject is a natural person to whom the personal data relate and who can be identified or is identifiable by the personal data.

Controller of personal data

The controller is a natural or legal person who determines the purposes and means of the processing of personal data and who is primarily responsible for the processing. Unless otherwise stated in these rules or specific service conditions, CSA is the controller of personal data.

Processor of personal data

The processor is a natural or legal person which processes personal data on behalf of the controller on the ground of the controller’s instructions.

Processing of personal data

Processing means any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Which legal regulation covers personal data processing?

The processing of personal data is governed primarily by Regulation of the European Parliament and of the Council (EU) 2016/679 (“GDPR”). National regulations may in certain cases (where allowed by the GDPR) define different rules. Such rules are laid down in Act no. 101/2000 Coll., on the Protection of Personal Data, as amended by later regulations.

When is it possible to process personal data?

For the processing of your personal data to be lawful, at least one of the requirements specified in Article 6 of GDPR must be satisfied. In the case of special categories of personal data at least one of the requirements specified in Article 9 of the GDPR must be satisfied. In both cases the principles of personal data processing mentioned in Article 5 of the GDPR have to be complied with.

Processing of personal data in the Czech Airlines

Why do Czech Airlines process personal data?

We provide for air transportation to tens of countries around the world. To be able to issue and send you an air ticket, ensure that you are checked in and admitted to transportation and provide you our services we need some of your personal data. You do not have to disclose any other personal data which we do not necessarily need to be able to carry you to your desired destination. But when you decide to disclose this information, we can do for you more than transport you.

What personal data do we process?

The following table shows what kind of personal data we need for a particular service.

Czech Airlines service Personal data processed
Making reservation/ administering reservation /purchase of ticket a) title (for all persons during reservation)
b) first name (for all persons during reservation)
c) surname (for all persons during reservation)
d) number(s) in a loyalty program (if you are a member and give us such information, for all persons during reservation)
e) email address
f) phone number(s) (if you give us such information)
g) fax number (if you decide to give us such information)
h) payment card data (if you use a card)
i) travel document number (if required by legal regulations)
j) ticket number and PNR
k) information on your health condition (if you disclose such information and/or wish to use assistant services)
l) date of birth (for children)
m) travel plan
Creating and administering membership in the OK Plus program a) first name
b) surname
c) date of birth
d) email address
e) number in the OK Plus program
f) address (for delivering the Silver, Gold, Platinum cards)
Creating and administering membership in the OK Plus Corporate program a) first name
b) surname
c) email address
d) OK Plus Corporate registration number
e) number in the OK Plus program
Creating and administering membership in the OK Plus Partner program a) first name
b) surname
c) email address
d) phone number
e) OK Plus Partner registration number
f) number in the OK Plus program
Purchase of insurance a) first name
b) surname
c) email address
d) address
e) phone number
f) date of birth
g) payment card data
Purchase of the Gourmet menu* a) first name
b) surname
c) PNR/ticket number
d) payment card data (if you use a card) 
e) email address
Additional luggage* a) first name
b) surname
c) PNR/ticket number
d) payment card data (if you use a card) 
e) email address
Participation in Plusgrade a) first name
b) surname
c) PNR/ticket number
d) payment card data
e) email address
Choice of preferred seat a) first name
b) surname
c) PNR/ticket number
d) payment card data (if you use a card)
e) email address
Purchase of entry to the airport lounge in Prague* a) first name
b) surname
c) PNR/ticket number
d) payment card data
e) email address
Sending of commercial notices a) email address (in all cases)
b) first name (only OK Plus members who give their consent)
c) surname (only OK Plus members who give their consent)
d) date of birth (only OK Plus members who give their consent)
e) address (only OK Plus members who give their consent)
f) number in a loyalty program (only OK Plus members who give their consent)
Contests with Czech Airlines The list of required personal data is always given in the terms and conditions of each contest. Most often processed personal data include:
a) first name
b) surname
c) date of birth (age)
d) email address
Service-related complaints a) first name
b) surname
c) ticket number/PNR
d) PIR (if the claim concerns luggage)
e) bank connection for paying damage compensation
f) phone number (agreement on date and place of delivering luggage)
g) other information provided by you
Ticket refund a) first name
b) surname
c) ticket number/PNR
d) email address
e) bank connection or payment card details
Issue of invoice a) first name
b) surname
c) email address
d) address
Inquiries a) first name
b) surname
c) email address
d) other information provided by you
Provision of care under Regulation (EC) 261/2004 a) first name
b) surname
c) ticket number/PNR
d) travel document number (if required for security by applicable legal regulations)
Visit to the Czech Airlines website a) IP address
b) The Czech Airlines website uses cookies and similar technologies. More information is available below.
Sending Cargo a) first name
b) surname
c) address
d) phone number
e) email address

 * These personal data are processed at the time of the purchase of a service via the Czech Airlines website. When the purchase is made at the airport, different personal data may be processed (not all of the above).

Beyond the scope defined above any other personal data may be processed only if you voluntarily provide such data to the Czech Airlines. The Czech Airlines reserve the right to destroy unwanted personal data. The data subject shall be informed on this procedure.

Conditional processing of personal data 

Some of the services offered by the Czech Airlines are made conditional upon the fulfillment of additional requirements. A typical requirement is the achievement of a certain age. Unless data subjects have reached the required age, it is not possible to provide certain services to them or process their personal data without the consent of their statutory (court-appointed) agent. For instance, the achievement of a certain age or the consent of a statutory (or court-appointed) agent is the prerequisite for the membership in the OK Plus program.

Processing of personal data for other purpose

Certain cases may involve further processing of personal data which goes beyond the purpose for which the personal data were obtained. An example may be the purchase of an air ticket, when the primary purpose is the processing of personal data for transportation. At the same time, however, the Czech Airlines have the obligation to archive the air ticket (for tax purposes) under applicable legal regulations.

Place of storing personal data

The Czech Airlines possess a large volume of data. Some of these data have the nature of personal data. To ensure their security and easy availability we use the cloud services provided by Microsoft. The data stored by Microsoft are kept in the data centers located in Dublin, Amsterdam and the USA.

Sharing of personal data

Partner airlines

In order to be able to ensure transportation to a high number of destinations, we have to share your personal data with our partner airlines. For this purpose we share your personal data with our partner airlines in the SkyTeam airline alliance. Beyond the circle of our Skyteam partners we also collaborate during transportation with other airlines, including in particular Air Baltic, Bulgaria Air, Iberia, Travel Service, Belavia, Hainan Airlines, Ural Airlines, Ukraine International Airlines, Etihad Airways, or with other air carriers which are members of the IATA. Your personal data are shared with the above-named companies whenever they actively participate in your transportation. When some of our partner airlines participate in your transportation, your personal data will be shared with its handling partners, which may be different from our handling partners.

The necessary information is transferred among the individual air carriers via global reservation and distribution systems. The Czech Airlines use the Amadeus Altéa Reservation as its primary system. It is operated by AMADEUS IT GROUP SA. This system is also used by large carriers such as Lufthansa, British Airways, Air France because it satisfies the highest security standards.

Handling partners

The Czech Airlines use a number of handling partners. Among the most important of them is Menzies Aviation (Czech), s.r.o. Sharing your personal data with these partners is necessary for the handling of passengers and their luggage. The handling partner taking care of your luggage at the destination is different depending on the destination to which you travel.

For certain destinations we check whether you meet the entry requirements (e.g. visa). This service is provided to us by our handling partners as well.

Insurance partners

If you buy a ticket with the Czech Airlines, you can also take on travel insurance. If you decide to use this service, your personal data are shared with ERV Evropská pojišťovna, a.s.

OK Plus partners

The list of our other partners is available at the Czech Airlines website. However, we do not share your personal data with these partners. These partners only inform us if you decide to use their services. You become entitled to the benefit from the Czech Airlines coming along with the use of the service and you inform our partner of this fact.

Other partners

When certain supplementary services offered by the Czech Airlines are used, personal data are processed by third parties. The conditions for the use of such service always inform you whether your personal data are processed by a third party and the Czech Airlines require a consent with these conditions. In the opposite case the service may not be provided.

State administration bodies

In certain cases it is necessary that we share your personal data with state administration bodies. This includes not only state administration bodies in the Czech Republic but in particular the authorities ensuring border control or security at destinations. Your personal data are disclosed to these authorities on the basis of a statutory obligation, because otherwise you might not be admitted for transportation or allowed entry to the given country at all. Should any extraordinary circumstance occur on board the plane or during the flight, we are in certain cases obligated to report such situation to the competent state administration bodies.

Security of personal data

Technical, organizational and other measures

Czech Airlines endeavor to ensure that the data disclosed by you are as secure as possible. To that end we have implemented a number of technical and organizational measures which protect your personal data from unauthorized or unlawful processing and from unintentional loss, destruction or damage.

Czech Airlines aim at minimizing the processing of personal data. We only process information which is indispensable or information which you provide us with your consent beyond the scope of the necessary processing. All the interfaces of our website or applications through which our services are provided are designed to offer the highest possible standard of privacy, which you can set at your desired level.

As mentioned above in these personal data protection principles, we disclose your personal data to third persons in certain cases in which we have an obligation to do so. In such cases we choose trustworthy partners of whom we can be sure they are going to apply personal data protection standards that offer at least the same level of security as those adopted by the Czech Airlines.

When personal data are transferred to state administration bodies, we always use the most suitable and the most secure options offered by the given body.

Personal data processing period

Maximum period of processing of personal data

The maximum period for which the Czech Airlines process the personal data of their clients is 10 years from the day when the legal relationship between the data subject and the Czech Airlines was terminated or 10 years from the end of the tax period in which the relevant performance was provided. The said processing period ensues from Act no. 89/2012 Coll., Civil Code, as amended by later regulations, or Act no. 235/2004 Coll., on Value Added Tax, as amended by later regulations. The reason for such processing is the statutory obligation and a legitimate interest of the Czech Airlines. After the expiry of this period your personal data will always be erased.

Other period of processing of personal data

If you submit an enquiry to our contact centre or in the case of usual interaction with the Czech Airlines your personal data are erased at a much earlier stage. Your personal data are stored for the period for which we need them to fulfill the purposes specified in these personal data protection principles or to comply with statutory obligations.

Cookies and other tracking technologies

What are cookies?

Cookies are small text files stored by web pages on your computer or your mobile device at the time when you start using the web pages. Thanks to that the pages remember for a certain time your preferences and operations (e.g. logging information, language, font size and other display preferences) so that you do not have to enter this information again and switch from one page to another. Our cookie files can not identify an individual user, they can only identify, through a randomly generated identification code, the computer or mobile device which you use.

Why do Czech Airlines use cookies and other tracking technologies?

Cookies and other tracking technologies may be used on our website and in our application in various ways, such as for the operation of the website, clickstream analysis or advertisement purposes. We primarily use cookies and other tracking technologies to be able to increase the quality and effectiveness of our services.

Cookies and other tracking technologies used by the Czech Airlines

The list of the cookies and other tracking technologies used by the Czech Airlines on its website and their exact purpose can be found here.

Cookies and other tracking technologies used by the Czech Airlines

This section of our website is currently being prepared for you.

More information on cookies, banning cookies

For more information on cookies, how cookies work, how to manage or delete them visit the web page at http://www.allaboutcookies.org/.

In the settings of some internet browsers (Internet Explorer, Safari, Chrome) cookies and other tracking technologies may be banned. Another way to manage cookies is via http://www.youronlinechoices.com/uk/your-ad-choices.

If you decide to ban certain cookies, the functionality of the Czech Airlines website may be limited.

 

Exercise of right by data subjects

Request Specification

If you request to exercise your rights, please specify which rights. We will process your request in the shortest possible turnaround time. Depending on the complexity and extent of the request, its processing may take up to several weeks.

Your personal data processing is connected with a number of responsibilities on our end, while you, as the personal data subject, have a number of rights.

Right to Revoke Consent to Personal Data Processing 

In cases where your personal data processing is conditioned by your consent, you have the right to revoke the consent at any time. The consent withdrawal does not compromise the legality of any previous data processing.

Based on your consent, we only process your personal data for the purpose of forwarding our business messages. You can revoke your consent to personal data processing via every message we sent to you.

Right to Information and Personal Data Access 

You have the right to be informed or get a confirmation as to whether or not we at Czech Airlines process your personal data. If we do, you also have the right to the following information regarding your personal data processing:

  • The purpose of processing
  • The legal basis for personal data processing
  • The categories of processed personal data
  • Recipients or recipient categories that have been or will be allowed access to personal data
  • The planned time for which personal data will be processed
  • The source in cases where your personal data are provided by subjects other than yourself
  • Whether automated processing including profiling is applied
  • The appropriate security measures applied upon personal data transfers to non-EU countries
  • Whether the provision of personal data is a statutory or contractual requirement and whether you are required to provide the information including the consequences of your failure to do so
  • Whether we intend to process your personal data for purposes other than those for which the data were collected

Our website features our contact details alongside contact details of our Privacy Officer. We will also provide you with information regarding our legitimate interests and/or the legitimate interests of a third party if we process your personal data on their basis.

Alongside the provision of the above-listed information, we are also obliged to inform you about your rights: 

  • To require the administrator (i.e. Czech Airlines) to correct or delete your personal data, to require the restriction of their processing or to raise an objection
  • To file a complaint with the Supervisory Office
  • To revoke your consent to personal data processing

You may also request to be provided with a copy of the processed personal data. Please note that in cases of repeated requests for a copy of the processed personal data, we are entitled to charge a fee in the amount of administrative costs. We cannot provide you with a copy of the processed personal data in cases where the rights and freedoms of others would be negatively influenced by our disclosure. To exercise the above-listed rights, please contact us via e-mail here. Please be advised that if we are unable to verify your identity electronically or if we have reasonable doubts regarding your identity, we will ask you to submit your ID at the Czech Airlines headquarters. Only thus we can ensure that we will not be providing your personal data to your impersonator.

Right to Rectification 

One of your rights is your right to require we correct your inaccurate personal data without undue dely. Similarly, you may also request your incomplete personal data is completed.

If your personal data correction concerns our OK PLUS frequent flyer programme, you can, in most cases, correct the data yourself after logging in to your personal profile via www.okplus.cz.

To exercise the right in other cases, please contact us via e-mail here. Please be advised that if we are unable to verify your identity electronically or if we have reasonable doubts regarding your identity, we will ask you to submit your ID at the Czech Airlines headquarters. Only thus we can ensure that we will not be correcting your personal data based on a request by a person who impersonates you.

In certain cases, we cannot perform personal data corrections. These are primarily cases in which your wrong or not updated personal data (e.g. maiden name) used on a tax receipt which we are required by law to archive.

Right to Erasure (the “Right to Be Forgotten”)

To request the deletion of your personal data in cases specified by the GDPR is another of your rights. The reason for deletion may be in particular the uselessness of personal data for the purpose for which they were collected, for example in cases of withdrawal of your consent to personal data processing. Please refer to GDPR Article 17 (1) for the list of cases providing grounds for request for deletion. It may not always be possible to delete your personal data, namely in cases where personal data processing is instrumental in:

  • Exercising the right to freedom of expression and information
  • Compliance with a legal obligation that requires personal data processing pursuant to the EU or Member State legislation to which the administrator is subject
  • Completion of a task by the administrator which is in the public interest or when exercising public power
  • Determination, exercise or defence of legal claims

To exercise the right, please contact us via e-mail here. Please be advised that if we are unable to verify your identity electronically or if we have reasonable doubts regarding your identity, we will ask you to submit your ID at the Czech Airlines headquarters. Only thus we can ensure that we will not be erasing your personal data based on a request by a person who impersonates you.

Right to Limit the Processing

Based on your request, we will limit your personal data processing, namely in cases where:

  • You notify us of incorrect personal data and we will do so for the time required to verify the data accuracy
  • Personal data processing is unlawful, and you request processing limitation instead of data deletion  
  • We no longer need the data in the capacity of personal data administrator for processing purposes
  • You raise an objection to processing

To exercise the right, please contact us via e-mail here. Please be advised that if we are unable to verify your identity electronically or if we have reasonable doubts regarding your identity, we will ask you to submit your ID at the Czech Airlines headquarters. Only thus we can ensure that we will not be limiting your personal data processing based on a request by a person who impersonates you.

Right to Raise an Objection

At any time, you may raise an objection to personal data processing in line with our legitimate interest. We will not process your personal data further unless we prove serious legitimate reasons which outweigh your interests.

To exercise the right, please contact us via e-mail here. Please be advised that if we are unable to verify your identity electronically or if we have reasonable doubts regarding your identity, we will ask you to submit your ID at the Czech Airlines headquarters.

Right to Be Notified of Corrections, Deletions and Processing Limitations

You have the right to be notified of personal data corrections, deletions and limitations to their processing. We will do so automatically with the exception of cases where corrections are made by you (for example when you change your OK PLUS profile data) or in cases where notifications prove to be impossible to facilitate or require inappropriate effort.

Right to Personal Data Portability

GDPR also entitles you to request the automatically processed personal data regarding your person with which you have provided us:

  • When entering into an agreement or
  • Based on your consent to personal data processing

We are obliged to provide you with the requested personal data in a structured form in a commonly used and machine-readable format. You can also request that we forward the data to another data administrator if a person acting on behalf of the administrator is properly identified and their authorisation can be verified.

We hereby declare that we do not perform automated personal data processing in Czech Airlines. We would like to meet our obligation thereto but based on the above statement we have no data to share or forward. Thus, the obligation does not apply. Thank you for your understanding.

Automated Individualised Decision Making and Profiling 

Based on the GDPR provisions, you have the right not to be subjected to any decision making based on automated processing only, including profiling, which would have legal effect on you or which would significantly affect you. We do not perform automated individualised decision making and profiling in Czech Airlines.

Updating personal data protection principles

The Czech Airlines keep the personal data protection principles up-to-date and in compliance with applicable legal regulations. For this reason they may be changed from time to time. We ask all our clients to pay due attention to these principles.

Liability for processing of personal data

Czech Airlines is responsible for the legality of your personal data processing. The Supervision of the personal data processing in the Czech Republic is performed by the Office for Personal Data Protection, which you can contact in case of complaints regarding your personal data processing by Czech Airlines.

DPO

To comply with all its obligations arising under the GDPR the Czech Airlines appoint as of 1 May 2018 the data protection officer (DPO). His task is to monitor compliance with the GDPR on the part of the Czech Airlines and in cooperation with the Czech Airlines employees he is your contact in the Czech Airlines for your enquiries, comments, complaints and claims regarding personal data protection.

DPO contact data:

Jan Hodek
K Letišti 1068/30,
Ruzyně, 161 00 Praha 6

Enquiries, comments, complaints and claims relating to the protection of personal data may also be submitted via this page.

Other information

The answers to the most frequently asked questions are available here.