Information on the processing of personal data of passengers using public transport in Kraków on the basis of personal tickets

Bearing in mind the provisions of Article 13 (1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR”, we set out below the information and rules for processing your personal data.

  1. The Data Controller, i.e. the entity which decides how your personal data will be used, is the Public Transport Authority in Kraków (hereinafter referred to as: ZTP) with its registered office at 1 Wielopole St., 31-072 Kraków, phone number: 12 616 86 00, e-mail address: sekretariat@ztp.krakow.pl, Electronic Mail Box address: /ZTPK/SkrytkaESP.
  2. In all matters concerning the processing of personal data by ZTP, you can contact the Data Protection Officer appointed for this purpose, e-mail address: iodo@ztp.krakow.pl, by letter to the address of the ZTP headquarters indicated above or in person at the ZTP headquarters.
  3. Your data will be processed on the basis  of Article 6(1)(b) of the GDPR for purposes related to:
    • taking, at the request of the KMK passenger, actions before concluding the contract of carriage with the Public Transport in Kraków (hereinafter: KMK) and the fulfillment of contractual obligations related to the passage of KMK passengers on the basis of a KMK personal ticket;
    • maintaining a database of KMK system users and their operations, including the website for KMK users, which allows passengers to read information related to the carriers of periodic tickets;
    • considering grievances, requests, complaints and conducting current correspondence in the field of KMK;
    • keeping material and value records of ticket sales;
    • issuing VAT invoices to KMK ticket buyers.
  4. ZTP entrusts your personal data to MPK Kraków S.A. with headquarters at 13 Wawrzyńca St., 31-060 Kraków, for the purposes of processing indicated above.
  5. ZTP processes the following data:
    • first name and last name;
    • home address or correspondence address;
    • series and number of the identity card;
    • PESEL number;
    • date of birth;
    • health data, in the case of people entitled to reduced or free travel;
    • data on property status, in the case of persons entitled to reduced or free travel;
    • payment environment data;
    • time and place of the transaction;
    • image (photo);
    • information about KMK carrier.
  6. Providing the data is obligatory, and failure to do so will result in the inability to use KMK on the basis of a personal ticket.
  7. You have the right of access to the content of your data and the right to rectify or complete them, request their erasure or restrict their processing, in the cases provided for by law.
  8. In order to exercise the rights mentioned above, you should address your request to the following e-mail address: iodo@ztp.krakow.pl, in writing to the address of ZTP’s registered office, via the Electronic Mail Box: /ZTPK/SkrytkaESP or submit it in person at the ZTP headquarters. Before we can exercise your rights, we will need to confirm your identity in a manner individually tailored to the request.
  9. If you consider that the processing of your personal data by ZTP violates the provisions of the GDPR, you have the right to lodge a complaint with the President of the Office for Personal Data Protection, 2 Stawki St., 00-193 Warsaw.
  10. The recipients of your personal data are or may be entities, in particular:
    • servicing ZTP or MPK equipment through which personal data are processed;
    • providing and maintaining software used for the processing of data of which ZTP is the Controller;
    • providing advisory and control services commissioned by ZTP or MPK (e.g. auditing companies, certifying companies);
    • courier companies through which correspondence may be carried out.
  11. Your data may also be made available to public authorities or entities entitled to obtain data on the basis of applicable law, e.g. courts, law enforcement agencies or state institutions, when they make a request, based on an appropriate legal basis.
  12. Your personal data will not be transferred to countries outside the European Economic Area and will not be transferred to international organisations.
  13. ZTP will not use automated decision-making, including profiling, against you.
  14. Personal data will be stored until the expiry of the statute of limitations for mutual claims and for the archiving period resulting from the office instructions.