Privacy Policy
This is a translation of the Czech version. In case of any discrepancy, the Czech version prevails.
We protect your data and process it only to the extent necessary to provide the TradeStreet application and operate the website. This policy explains what data we process, why, for how long, and what rights you have. It is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and Act No. 110/2019 Coll., on the Processing of Personal Data.
1. Who Is the Controller
The controller of personal data is FinBits s.r.o., with its registered office at Jičínská 226/17, Žižkov, 130 00 Praha 3, Company ID (IČO): 19630981, registered in the Commercial Register maintained by the Municipal Court in Prague (Městský soud v Praze), Section C, Insert 388729 (“we” or “us”).
For all matters relating to personal data protection, please contact us at podpora@tradestreet.cz or by post at the address of our registered office. We have not appointed a data protection officer, as we are not legally required to do so.
2. What Data We Process and Why
2.1 User Account, Trial Period and Subscription
Data: first and last name, e-mail, login credentials (we store passwords only in encrypted form), selected plan, payment and invoice history, billing address, Company ID and VAT ID for business users, and in-app settings such as watchlists and notifications.
Purpose: creating and maintaining the account, providing the application, the trial period, charging the subscription, notifying you of the end of the trial period or of a subscription renewal, customer support and handling complaints.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Retention period: for the duration of the account and thereafter for a maximum of 3 years in case of claims arising from the contract.
2.2 Accounting and Taxes
Data: billing details and payment details.
Purpose and legal basis: compliance with legal obligations under the Accounting Act and the VAT Act (Art. 6(1)(c) GDPR).
Retention period: 10 years from the end of the year in which the payment was made.
2.3 Security and Account Protection
Data: IP address, device and browser information, login times and technical records (logs).
Purpose: securing the application, detecting account misuse and shared access, resolving technical errors.
Legal basis: our legitimate interest in the secure operation of the service (Art. 6(1)(f) GDPR).
Retention period: usually 12 months; when a specific incident is being dealt with, until it is closed.
2.4 Commercial Communications to Customers
Data: name and e-mail.
Purpose: sending news about the application and our similar services (e.g. the Academy, webinars).
Legal basis: legitimate interest under Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services. Each e-mail contains an unsubscribe link; you can also unsubscribe at any time by e-mail.
Retention period: until you unsubscribe, for a maximum of 3 years after the end of the subscription.
2.5 Newsletter and Webinars for Non-Customers
Data: name and e-mail that you provide to us in the sign-up form.
Purpose and legal basis: sending the newsletter or webinar invitations based on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time via the link in the e-mail.
Retention period: until consent is withdrawn, for a maximum of 3 years from the last time you opened one of our e-mails.
2.6 Inquiries and Customer Support
Data: e-mail, name and the content of the communication.
Purpose and legal basis: handling your inquiry; before the conclusion of a contract, at your request (Art. 6(1)(b) GDPR); otherwise, based on our legitimate interest in responding to you (Art. 6(1)(f) GDPR).
Retention period: 3 years from the last communication.
2.7 Cookies, Analytics and Advertising
On the website, we use strictly necessary cookies and, with your consent, also analytics, functional and marketing cookies. Details can be found in the Cookie Policy; you can change your consent at any time in the cookie settings.
We also measure website traffic using our own anonymous, cookieless statistics: from the IP address and browser type, we create a hash with a daily rotating salt, which we delete at the end of the day, and we retain only aggregate figures. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Details can be found in the Cookie Policy.
We do not use personal data for automated decision-making or for profiling that would produce legal effects concerning you or similarly significantly affect you. We do not process payment card data; it is processed directly by the payment gateway operator.
3. Who We Share Data With
We do not sell data. We share it only with processors who help us operate the service, only to the extent necessary and on the basis of a data processing agreement:
- payments: Stripe Payments Europe, Ltd. (Ireland),
- invoicing: Fapi Business s.r.o. (Czech Republic),
- e-mailing: Drip (Leadpages (US), Inc., USA),
- hosting and cloud infrastructure for the application and the website,
- external accountants and tax advisers (Czech Republic),
- analytics and advertising (only with your consent): Google Ireland Ltd., Meta Platforms Ireland Ltd., Seznam.cz, a.s.
We may also disclose data to public authorities where required to do so by law.
Transfers outside the EU. Some processors (e.g. Drip, Google, Meta) may process data in the USA. Such transfers take place on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) for certified companies, or on the basis of standard contractual clauses approved by the European Commission.
4. Your Rights
In connection with the processing of personal data, you have the right:
- of access to your data and to obtain a copy of it,
- to rectification of inaccurate data,
- to erasure of data if it is no longer needed or the processing has no legal basis,
- to restriction of processing,
- to data portability for data you have provided to us on the basis of a contract or consent,
- to object to processing based on legitimate interest, and to object to commercial communications at any time and without giving reasons,
- to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
You can exercise your rights by e-mail to podpora@tradestreet.cz. We will respond without undue delay and in any event within one month. To avoid disclosing data to the wrong person, we may ask you to verify your identity.
If you believe that we are processing your data in breach of the regulations, you may lodge a complaint with the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
5. Security
We use appropriate technical and organizational measures: encrypted transmission (HTTPS), encrypted passwords, access to data restricted to authorized persons only, and contractual confidentiality obligations for processors.
6. Changes to This Policy
We may update this policy, for example when processors or legislation change. The current version is always published on this page. We will inform registered users of material changes by e-mail.