Processing of personal data
1. Introduction
Člověk v tísni o.p.s. / People in Need (hereinafter referred to as “PIN” or the “Controller”) processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation – GDPR), Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable legal regulations. On this page, you will find information about the personal data we process, why we need it, the legal basis on which we process it, with whom we may share it, and your rights in relation to the processing of your personal data.
PIN operates both in the Czech Republic and abroad and implements a wide range of social, educational, humanitarian and development programmes. Therefore, the way in which we process personal data may vary depending on how you interact with us or which of our services you use. This page provides general information on the processing of personal data. If you apply for a specific programme, request assistance, enter into a contract with us, or use any of our services, we will, where necessary, provide you with more detailed information relating to the specific processing of your personal data.
When processing personal data, we ensure that personal data are processed only to the extent necessary for the specified purpose, are protected by appropriate security measures, and are retained only for as long as necessary or for the period required by applicable legal regulations.
2. Who Processes Your Personal Data
The Controller of your personal data is:
Člověk v tísni, o.p.s.
Šafaříkova 635/24, 120 00 Praha 2, Id No. 25755277
If you have any questions concerning the processing of your personal data or wish to exercise your rights under the GDPR, please contact us using the e-mail addresses below.
Our internal contact person for data protection matters is:
Martina Zikmundová
e-mail: gdpr@clovekvtisni.cz
Our Data Protection Officer (DPO) is:
Eva Lipovská, společnost Equica, a.s.
e-mail: dpo@clovekvtisni.cz
3. What Personal Data We Process
The scope of the personal data we process depends on how you interact with us and which of our services or activities you use. Depending on the specific circumstances, we may process, in particular:
- identification data (e.g. first name, surname, date of birth);
- contact details (e.g. address, e-mail address, telephone number);
- data provided in applications, registration forms or other forms;
- data contained in our mutual communications;
- technical data collected when you use our website, such as your IP address, information about your device and browser, records of website usage, and data collected through cookies or similar technologies. More detailed information about the use of cookies, including their current settings and the possibility to change or withdraw your consent, is available in the cookie settings on our website;
- other data necessary for the provision of a specific service, the implementation of a project, or compliance with our legal obligations.
We obtain personal data primarily directly from you. In justified cases, we may also obtain personal data from our partners, funding providers, public authorities, or publicly available sources, where permitted by applicable law or where necessary for the provision of our services. In such cases, we will, of course, inform you of the processing of your personal data in due time.
The provision of personal data is voluntary in most cases. However, where personal data are necessary for the conclusion of a contract, the provision of a service, the processing of an application, or compliance with a legal obligation, we may not be able to provide the relevant service or carry out the relevant activity without such data.
4. When We Process Your Personal Data
The scope of the processing of personal data depends on how you interact with us. Below, you can select the situation that applies to you to view more detailed information about the processing of your personal data. If you have any questions, please contact us using the e-mail addresses provided above.
Visit the Website
What data we process
When you visit our website, we may process technical data relating to your device, browser and use of the website, such as your IP address, cookie identifiers, information about the pages you have visited, your cookie consent preferences, and data provided through web or contact forms.
Why we need the data
We use this data primarily to ensure the operation and security of our website, remember your preferences, respond to your enquiries and requests, and, where you have given your consent, to measure website traffic, analyse the use of our website, personalise content, or display relevant communications and advertising.
Legal basis
We use technical cookies that are necessary for the operation of the website without your consent where they are strictly necessary for the provision of the service you request as a user of the website. Other cookies and similar technologies, in particular analytical and marketing cookies, are used on the basis of your consent provided through the cookie banner. If you complete a form on our website or send us an enquiry, we process your personal data according to the nature of your request, in particular for the purpose of responding to your request, performing a contract, complying with a legal obligation, or on the basis of our legitimate interests.
How long we retain the data
We retain cookies and the data collected through them for the periods specified in the current cookie settings on our website. Data collected through contact forms or other web forms are retained for as long as necessary to deal with your request and, where applicable, for the period required by applicable legal regulations or necessary for the establishment, exercise or defence of legal claims.
Contacted People in Need
What data we process
Identification and contact details, and the content of our mutual communications.
Why we need the data
To respond to your enquiry, request or other submission, and for any subsequent communication.
Legal basis
Steps taken at the request of the data subject prior to entering into a contract, legitimate interests, or compliance with a legal obligation.
How long we retain the data
For as long as necessary to deal with your request and, where applicable, for the establishment, exercise or defence of legal claims.
5. General Information on the Processing of Personal Data
Legal Basis for Processing Personal Data
We process personal data only where we have an appropriate legal basis under the GDPR. Depending on the specific circumstances, this legal basis may include the performance of a contract, compliance with a legal obligation, the protection of vital interests, the performance of a task carried out in the public interest, where an appropriate legal basis exists for the specific processing, our legitimate interests, or your consent. The specific legal basis for each processing activity is always indicated in the relevant section of the previous chapter.
Who May Receive Personal Data
We disclose personal data only to the extent necessary for the purpose for which they were collected. Access to personal data is limited to our employees and associates who require it for the performance of their duties. Where justified, personal data may also be disclosed to our contractual partners and service providers (such as providers of IT, accounting, legal or audit services), project partners, or funding providers, where this is necessary for the implementation of a specific project or for compliance with our contractual or legal obligations. We may also disclose personal data to public authorities where required to do so by applicable law.
Transfers of Personal Data Abroad
PIN implements humanitarian, development and other programmes both in the Czech Republic and abroad. In connection with these activities, it also processes personal data in the countries where its programmes are implemented. As a general rule, we do not transfer the personal data of individuals who interact with us in the Czech Republic, such as donors, event participants or job applicants, outside the European Union (EU) or the European Economic Area (EEA), unless such transfer results from a specific service, supplier, tool or programme, about which you will be informed in the relevant detailed privacy information. Where the operation of our website, the use of IT services, analytical or communication tools, social media platforms, or a specific programme involves transfers of personal data outside the EU/EEA, such transfers will always be carried out in accordance with the GDPR and with appropriate safeguards to ensure an adequate level of protection for personal data.
How Long We Retain Personal Data
We retain personal data only for as long as necessary to fulfil the purpose for which they were collected. The retention period depends in particular on the nature of the specific activity, our legal obligations, the requirements of funding providers, or the period necessary for the establishment, exercise or defence of legal claims and the protection of our legitimate interests. After the relevant retention period has expired, we securely delete or anonymise the personal data, unless applicable law requires their further retention.
6. How We Protect Your Personal Data
We consider the protection of personal data to be an important part of our activities. We implement technical, organisational and personnel measures to help ensure the confidentiality, integrity and availability of personal data and to protect them against unauthorised access, loss, misuse or other unauthorised processing.
Access to personal data is restricted to employees and associates who require it for the performance of their duties. All persons who process personal data are bound by confidentiality obligations and are regularly made aware of the rules governing the protection of personal data and the importance of maintaining their security. We apply the same requirements to our contractual partners and service providers who process personal data on our behalf. Where we engage external processors, we select them carefully and enter into data processing agreements with them in accordance with the GDPR. We regularly review our security measures and adapt them to technological developments, the nature of our activities, and evolving risks.
7. Your Rights and How to Exercise Them
The GDPR grants you a number of rights in relation to the processing of your personal data. If you wish to exercise any of these rights or have any questions concerning the processing of your personal data, you may contact us at any time.
Your Rights
- Depending on the specific circumstances, you may, in particular:
- request information about the personal data we process concerning you;
- request the rectification of inaccurate or incomplete personal data;
- request the erasure of your personal data, where the conditions set out in the GDPR are met;
- request the restriction of the processing of your personal data;
- object to processing based on our legitimate interests;
- request the transfer of your personal data in cases where the GDPR grants you the right to data portability;
- withdraw your consent at any time where the processing of your personal data is based on your consent.
If you believe that we are processing your personal data in breach of applicable law, you have the right to lodge a complaint with the Data Protection Authority.
How to Exercise Your Rights
You may submit your request by e-mail to gdpr@clovekvtisni.cz or contact our Data Protection Officer directly at dpo@clovekvtisni.cz. We will respond to your request without undue delay and, in any event, within one month of receiving it, unless applicable law provides otherwise.
Verification of Identity
As we are committed to protecting your personal data against unauthorised disclosure, we may ask you to verify your identity before processing your request. The method of verification will always be appropriate to the nature of your request and the manner in which it was submitted.
Automated Decision-Making
PIN does not carry out decision-making based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects the data subject within the meaning of Article 22 of the GDPR.
Changes to This Document
We may update this Privacy Notice from time to time, in particular where there are changes to applicable legislation, our activities, or the way in which we process personal data. The current version of this document is always available on the PIN website.
Last updated: July 1, 2026