Information on the processing of personal data obtained as part of video monitoring with the use of cameras installed in public transport vehicles of MPK Kraków S.A.

Bearing in mind the provisions of Article 13 (1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR”, we set out below the information and rules for processing your personal data.

  1. Data Co-controllers i.e. entities deciding how your personal data will be used to the extent necessary for the implementation of public public transport, are:
    • Kraków Municipality, Public Transport Authority in Kraków (hereinafter referred to as: ZTP) with its registered office at 1 Wielopole St., 31-072 Kraków, phone number: 12 616 86 00, e-mail address: [email protected], Electronic Mail Box address: /ZTPK/SkrytkaESP;
    • MPK Kraków S.A. – (hereinafter referred to as: MPK) with its registered office at 13 Św. Wawrzyńca St., 31-060 Kraków.
      Data Co-controllers signed an agreement concluded on July 18, 2019 for the co-administration of personal data.
  2. Each of the Data Controllers listed above has appointed a Data Protection Officer who can be contacted:
  3. The administrators have designated a common contact point at: [email protected], where you can contact us in all matters relating to the processing of personal data.
  4. Your personal data may be processed in order to ensure the required safety conditions for persons (including the administrator’s own employees) and the luggage of KMK in Kraków, consideration of complaints, correspondence regarding the functioning of KMK in Kraków and control and distribution of tickets in public transport in Kraków, considering applications, providing explanations, for the purpose of controlling the quality of work performed by entities acting on behalf of the administrator and public property or third parties, in order to protect the administrator’s property, public and municipal property, pursuing claims and optimizing the functioning of KMK.
  5. Using video monitoring the Co-controllers process the following scope of personal data:
    • for the purpose of “considering complaints or correspondence regarding the functioning of KMK in Kraków, considering applications, providing explanations”: name/names, surname, PESEL number, correspondence address (if provided), e-mail address (if provided), phone number (if provided), health condition (if required in connection with the case), other personal data held by the Data Controller than those specified above by the data subjects;
    • for other purposes: image and health (if applicable).
  6. In connection with the processing of personal data, the data subjects have the following rights:
    • the right to access personal data (on the terms set out in Article 15 of the GDPR);
    • the right to rectify (correct) personal data – if the data are incorrect or incomplete;
    • the right to delete personal data (on the terms set out in Article 17 of the GDPR);
    • the right to limit data processing (on the terms set out in Article 17 of the GDPR);
    • the right to object for reasons related to a particular situation (on the terms set out in Article 21 of the GDPR).
  7. The rights listed above may be exercised towards each of the Co-controllers in person, by letter, via an Electronic Mail Box or to a common contact point. Before exercising the rights, the Co-controllers is obliged to confirm the identity of the person exercising the rights in a manner individually adapted to a given request.
  8. If you consider that the processing of your personal data by ZTP violates the provisions of the GDPR, you have the right to lodge a complaint with the President of the Office for Personal Data Protection, 1A Moniuszki St., 00-014 Warsaw.
  9. Only authorized employees and associates have access to your personal data within the organizational structure of the Co-controllers – only to the extent necessary for the proper performance of tasks. Your personal data may be disclosed by the Co-controllers to recipients outside our structure. The recipients of your personal data are, among others entities entrusted by the Controllers with the processing of personal data on the basis of concluded contracts, which are:
    • companies providing e-mail hosting services that process personal data sent via supported e-mail;
    • companies maintaining and servicing IT systems, including devices through which the Co-controllers may process personal data;
    • entities responsible for servicing devices and software related to monitoring;
    • entities providing inspection services in public transport vehicles;
    • entities providing legal services toData Controllers;
    • companies providing property security services;
    • entities to which the Data Controllers can provide documentation for destruction purposes after the end of the storage period in the archive.
  10. Your data may also be made available to public authorities or entities entitled to obtain data on the basis of applicable law, e.g. courts, law enforcement agencies or state institutions, when they make a request, based on an appropriate legal basis.
  11. Your personal data will not be transferred to countries outside the European Economic Area and will not be transferred to international organisations.
  12. Your personal data recorded with the help of video monitoring are stored for 14 to 90 days. A purpose-driven entitlement allows data to be collected by:
    • 90 days, while technical limitations for some of the recording devices limit this time to 14 days, which implies an administrative priority requirement during the operation of these devices, or
    • until the completion of activities related to recorded events of which the passenger or third party is a participant.
  13. If the recording constitutes evidence in court or administrative proceedings, then the data will be stored until the final conclusion of these proceedings.
  14. In the case of other processing purposes, your data will be stored for archival purposes (this is an obligation resulting from the Act on the National Archival Resource and Archives) in accordance with the Unified Material List of Administrator’s Files, specifying the storage periods of individual categories of files (e.g. accounting documents, complaints).