This English text is a translation provided for your convenience. The binding version is the Czech original, Zásady ochrany a zpracování osobních údajů Stockero, available at https://stockero.com/ochrana-a-zpracovani-osobnich-udaju/. In the event of any discrepancy, the Czech version prevails.
1. Who is the controller
The controller of personal data is:
FinBits s.r.o.
registered office at Jičínská 226/17, Žižkov, 130 00 Prague 3, Czech Republic
Company ID: 19630981
registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 388729
e-mail for privacy enquiries and for exercising your rights: support@stockero.com
(hereinafter "FinBits", the "controller" or "we").
This policy explains how we process personal data when you visit the stockero.com website, place an order and use the Stockero web application (hereinafter the "Application"), when we verify eligibility for the DK Investment Club plan, and when you communicate with us.
2. Basic principles
We process personal data lawfully, fairly and transparently, only for specified purposes and to the extent necessary for them. We take care to keep data accurate, to retain it for a proportionate period and to secure it appropriately to the risk.
Stockero processes data about financial markets and publicly traded companies, analyses it with the help of artificial intelligence systems and makes the resulting analyses available to users to read. A user can create a watchlist and, by adding a stock symbol, trigger the analysis and ongoing monitoring of the relevant publicly traded company. Users can save their own notes to those analyses. We protect the information about which symbol a particular user has chosen, as well as the text of their notes, as data linked to their account. We pass only the selected symbol, separated from account identifiers, to the external AI model, together with market and company data; we do not pass the text of user notes to it.
3. What personal data we process
Depending on how you use Stockero, we may process in particular:
- Identification and contact data: first name, surname, e-mail, address and, where applicable, company name, Company ID, VAT ID and other billing details.
- Account and sign-in data: internal account identifier, information about e-mail verification, time of registration, time of last sign-in and account status. Where we use password sign-in, we store the password only in a securely one-way derived form.
- Contract, order and payment data: the plan ordered, price, currency, order date, payment method and status, transaction identifier, invoice, information about automatic renewal and its cancellation. For bank transfers also the data contained in the payment record, such as the payer's name, account number, amount, variable symbol and message for the recipient. Full payment card details are processed by Stripe, not by FinBits.
- Data required for the DK Investment Club plan: the e-mail address or membership identifier used for matching, information on whether the membership is active, the time of verification and, where applicable, the date the membership ended. We do not obtain the reason for termination of membership or any other information about the member's activity in the Club.
- Application usage data and user content: date and time of access, parts of the Application visited, watchlists created, stock symbols selected, the times they were added or removed, your own notes to analyses, operational events, user settings and data needed to maintain the session and keep the account working. Watchlists and notes may reveal your investment interests; where they are linked to an account, we treat them as personal data.
- Technical and security data: IP address, session and device identifier, browser and operating system type, language, approximate location derived from your IP address, audit, error and security logs, and information about suspicious or prohibited conduct.
- Communication and support: the content of e-mails, live chat conversations, complaints and other messages, attachments, the course of handling your request and related metadata.
- Marketing data and preferences: consent to or objection against marketing, the date and source of your choice, unsubscribe history and, where consent has been given, data about your interaction with campaigns.
- Cookies and similar technologies: online identifiers, consent choices and other data described in the Stockero Cookie Policy.
4. Where we obtain data from
We obtain personal data:
- directly from you when you place an order, register and communicate with us, and when you create watchlists, select symbols and save notes;
- automatically as you use the website and the Application;
- from Stripe, FAPI, banks and other providers involved in processing your order, payment and invoicing;
- for the DK Investment Club plan, from TradeSmart Media s.r.o., Company ID 23293551, Zbraslavská 12/11, Malá Chuchle, 159 00 Prague 5, Czech Republic (hereinafter "TradeSmart"); and
- from public registers where necessary to verify business details or to protect legal claims.
From TradeSmart we obtain only the data needed to match a person and confirm whether their membership is active, the time of verification and, where applicable, the date the membership ended. In this respect TradeSmart is the source of the data within the meaning of Article 14 GDPR. Information about this processing is contained directly in this policy and we make a link to it available when you order or activate the plan.
5. Purposes, legal bases and retention periods
A specific period may be extended where the data is needed for ongoing litigation, an inspection, a security incident or compliance with a legal obligation. Once the purpose has ended we delete the data or irreversibly anonymise it, unless further retention is required by law.
| Purpose | Typical data | Legal basis | Retention period |
|---|---|---|---|
| Registration, sign-in, account administration, activation and provision of Stockero | identification, contact, account and operational data and user settings | steps prior to entering into and performance of a contract, Article 6(1)(b) GDPR | for the term of the contract; ordinary operational account data for no more than 30 days after it ends, unless further retention is required under another item in this table; separate backups for no more than 90 days |
| Maintaining watchlists, initiating and continuously providing analyses of selected companies, and storing notes | watchlists, selected stock symbols, times of changes, notes to analyses and related settings | performance of a contract, Article 6(1)(b) GDPR | for the term of the contract; after access ends, no more than 30 days for any export or restoration, then erasure; separate backups for no more than 90 days unless longer retention is necessary under another item in this table |
| Processing orders, payments, invoicing and subscription renewals | contract, transaction and billing data | performance of a contract, Article 6(1)(b), and accounting or tax obligations, Article 6(1)(c) | contract data usually 3 years after the contract ends; accounting and tax documents for the period laid down by law, usually 5 to 10 years |
| Verifying eligibility for the DK Investment Club plan and managing the duration of access | e-mail or membership identifier, active/inactive status, end date and time of verification | steps prior to entering into and performance of a contract, Article 6(1)(b); evidencing entitlement to access and defending claims, Article 6(1)(f) | current status for the duration of access; record of the decisive verification for 3 years after access ends |
| Customer and technical support, including live chat | identification data, the content of communications including live chat conversations, and necessary technical data | performance of a contract, Article 6(1)(b), and legitimate interest in continuity of support and defence of claims, Article 6(1)(f) | for the time needed to handle the matter and usually 3 years after the request is closed |
| Complaints, withdrawal and consumer matters | identification, contract and communication data | performance of a contract, Article 6(1)(b), legal obligation, Article 6(1)(c), and defence of claims, Article 6(1)(f) | for the time needed to resolve the matter and usually 3 years thereafter; longer for the duration of ongoing proceedings or another legal obligation |
| Security, prevention of misuse, auditing and incident response | IP address, sign-ins, audit, error and security logs | legitimate interest in protecting users, the service and our rights, Article 6(1)(f); in the event of an incident also a legal obligation, Article 6(1)(c) | ordinary security and access logs for no more than 12 months; incident documentation usually 3 years after it is closed |
| Diagnostics and improving the reliability of the service without marketing tracking | limited operational, performance and error data | legitimate interest in a secure and functional service, Article 6(1)(f) | no more than 12 months; for longer-term statistics we use anonymised data |
| Bringing and defending legal claims and complying with requests from public authorities | contract, communication, transaction and audit data | legitimate interest, Article 6(1)(f), or legal obligation, Article 6(1)(c) | for the duration of the relevant limitation periods, usually 3 years; longer for the duration of ongoing proceedings |
| Operational messages, such as activation, invoice, renewal reminder, password reset or security notice | e-mail, account, contract or security event data | performance of a contract, Article 6(1)(b), legal obligation, Article 6(1)(c), or legitimate interest in security, Article 6(1)(f) | in line with the retention period of the related account, contract, document or security log |
| Offers of our own similar services to existing customers | e-mail, the customer relationship and the unsubscribe record | legitimate interest, Article 6(1)(f), and the customer exemption under the rules on electronic commercial communications | until you object or unsubscribe, and no more than 3 years after your last purchase; we keep a minimal record of your unsubscribe in order to respect your choice |
| Newsletter to persons who are not customers | e-mail and marketing preference | consent, Article 6(1)(a) | until consent is withdrawn, and no more than 3 years after the last active confirmation of interest |
| Evidencing marketing or cookie consent and respecting unsubscribes | minimal identifier, the wording and version of the choice, time and purposes | obligation to demonstrate lawfulness, Article 6(1)(c), and legitimate interest in defending claims, Article 6(1)(f) | usually 3 years after withdrawal or expiry of the choice |
| Analytics and advertising technologies of Google and Meta | online identifiers, device, visit and interaction data as described in the Cookie Policy | consent, Article 6(1)(a) GDPR; storing on or reading from your device under Section 89(3) of Act No. 127/2005 Coll. | as set out for the specific technology in the current cookie list, and no longer than until consent is withdrawn or the stated period expires |
Where the legal basis is legitimate interest, we assess its necessity and the impact on your rights. Our legitimate interests are in particular protecting accounts and infrastructure, preventing misuse, fixing technical faults, evidencing the conclusion and performance of a contract, defending legal claims and reasonably offering our own similar services to customers. You may object to such processing.
6. How Stockero uses artificial intelligence
6.1. Artificial intelligence is one of the tools FinBits uses when processing data about financial markets and publicly traded companies and when producing the finished analyses displayed to users in the Application. By adding a stock symbol to a watchlist, a user identifies the company for which the Application is to start an analysis and to monitor newly available information on an ongoing basis.
6.2. We deliberately do not pass to AI systems the name, e-mail, user account identifier, billing or payment data, DK Investment Club membership status, the text of user notes or the usage history of any individual user. The input for the AI is the selected stock symbol, technically separated from the user's account, together with market data, information about the relevant publicly traded company and technical instructions created by FinBits.
6.3. For this processing we use the business or API services of Anthropic Ireland, Limited and OpenAI Ireland Ltd. FinBits does not permit the voluntary use of the transferred data or the resulting analyses to train the providers' general models. The providers may technically process the data to the extent necessary to provide and secure their service in accordance with their terms of business and data processing agreements.
6.4. Analyses may be produced automatically and without prior human review. They may contain errors, inaccuracies or out-of-date information. They are not, however, an automated decision by FinBits about a user, nor do they constitute profiling of that user.
7. Recipients and service providers
We disclose personal data only to the extent necessary for a specific purpose. We do not sell data.
| Area | Provider and role | Purpose and data concerned | Registered office and possible place of processing |
|---|---|---|---|
| Hosting and related infrastructure | DigitalOcean, LLC, 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, USA, e-mail privacy@digitalocean.com – processor | operating the website and the Application, storing account, technical and operational data including watchlists and notes, backups and security | servers in a data centre in Frankfurt am Main (Germany, EEA); administration, support and backup may involve access from the USA on the basis of the European Commission's standard contractual clauses, or the EU–U.S. Data Privacy Framework |
| Orders and invoicing | FAPI Business s.r.o., Company ID 07671563, F. A. Gerstnera 2151/6, 370 01 České Budějovice, Czech Republic – processor | order, contact, billing and payment status data | Czech Republic; any sub-processors under FAPI's terms |
| Card payments | Stripe Payments Europe, Limited and other Stripe group companies involved – processors or separate controllers depending on the activity | executing the payment, managing the payment token, fraud prevention, security and compliance with regulatory obligations | Ireland; depending on the service also the USA and other countries, subject to appropriate safeguards |
| Bank transfers | FinBits' bank, the payer's bank and interbank service providers – usually separate controllers | identifying the payment, account details, amount, symbol and message for the recipient | depending on the banks involved in the particular payment, usually the Czech Republic or the EEA |
| AI model providers | Anthropic Ireland, Limited and OpenAI Ireland Ltd – providers of business/API services; should they exceptionally process personal data during technical operation, they act as processors within the scope of the service | producing analyses from the selected symbol separated from the account, market data and information about publicly traded companies; we deliberately do not pass them user identifiers, note text or other personal data | Ireland; sub-processors involved may also operate outside the EEA subject to appropriate safeguards |
| Verification of DK Investment Club membership | TradeSmart Media s.r.o., Company ID 23293551, Zbraslavská 12/11, Malá Chuchle, 159 00 Prague 5, Czech Republic – separate controller | limited matching of a person and confirmation of active membership, date of verification and, where applicable, end date | Czech Republic |
| Live customer support chat | Smartsupp.com, s.r.o., Company ID 036 68 681, Palachovo náměstí 799/5, Starý Lískovec, 625 00 Brno, Czech Republic – processor; data protection officer dpo@smartsupp.com | the content of the conversation, any contact details you enter into the chat, technical data about your browser and visit, and the chat session identifier | Czech Republic |
| Analytics and Google services | Google Ireland Limited – processor or separate controller depending on the specific service | measuring traffic, evaluating usage, embedded content and advertising, only to the extent covered by the consent given | Ireland; processing may also take place in the USA and other countries subject to appropriate safeguards |
| Analytics and advertising by Meta | Meta Platforms Ireland Limited – separate or joint controller depending on the specific service | measuring campaigns and conversions, building audiences and advertising, only on the basis of consent | Ireland; processing may also take place in the USA and other countries subject to appropriate safeguards |
| Sklik advertising and remarketing | Seznam.cz, a.s., Company ID 261 68 685, Radlická 3294/10, Smíchov, 150 00 Prague 5 – separate controller | website traffic measurement and remarketing in the Sklik advertising network; inclusion in advertising audiences only with your consent | Czech Republic |
| Professional services | accountants, tax advisers and lawyers – processors or separate controllers depending on the activity | data necessary for accounting, compliance with obligations and protection of rights | usually the Czech Republic or the EEA |
| Public authorities | courts, administrative authorities, the police and other competent bodies | data requested under a legal provision or needed to protect rights | depending on the authority concerned |
We conclude agreements with processors under Article 28 GDPR. Separate controllers also process data in accordance with their own legal obligations and privacy policies.
We do not pass to Google or Meta, through analytics or advertising tools, the contents of watchlists, the symbols associated with an account, the text of notes or the specific analyses displayed to a signed-in user.
8. The DK Investment Club and the position of both companies
In this processing, FinBits and TradeSmart are two separate controllers. TradeSmart independently operates the DK Investment Club and maintains records of its members. FinBits independently operates Stockero and needs to verify whether a particular person meets the condition for activating and continuing the discounted plan.
TradeSmart allows FinBits limited access or automated verification only to the extent of: the e-mail address or membership identifier needed for matching, the status of active membership, the time of verification and, where applicable, the date the membership ended. FinBits does not obtain the reason why a membership ended or any further details of the membership relationship. Conversely, TradeSmart does not obtain information about how a user uses Stockero, nor their payment data, with the exception of technical information necessary to resolve a specific verification error.
FinBits uses the result of the verification for steps prior to entering into and for the performance of a contract with a prospective or existing user under Article 6(1)(b) GDPR, and to evidence entitlement to access under Article 6(1)(f) GDPR. TradeSmart is responsible for the lawfulness and transparency of maintaining its membership records and of their limited disclosure to FinBits.
9. Transfers outside the European Economic Area
Some suppliers or their sub-processors may process data outside the European Economic Area (EEA), in particular in the USA. We carry out such a transfer only where an appropriate legal mechanism is in place, in particular:
- a European Commission adequacy decision;
- the EU–U.S. Data Privacy Framework, where the specific U.S. recipient is validly certified for the type of data concerned; or
- the European Commission's standard contractual clauses, supplemented where necessary by a risk assessment and further measures.
We will provide you on request with information about the specific safeguard used, or a copy of it; we may remove parts protected by trade secrecy or security requirements.
10. Cookies and similar technologies
We use strictly necessary technologies without consent only to the extent needed for the transmission of communication or for a service you have requested. We activate analytics, advertising and other optional technologies of Google and Meta only after your prior consent. The live customer support chat loads automatically on the basis of our legitimate interest in providing support; details are set out in the Cookie Policy.
The current list of technologies, their purposes, providers and lifetimes is set out in the Stockero Cookie Policy at https://stockero.com/en/cookies/. You can change your choice at any time through the "Cookie settings" link in the footer of the website and the Application.
11. Commercial communications
11.1. If you are our customer, we may send offers of our own similar products and services to the e-mail address obtained at the time of purchase, where the rules on electronic commercial communications allow this. We give you the opportunity to refuse such messages when we obtain your e-mail address and in every message.
11.2. If you are not our customer, or where the offer does not concern a similar service of FinBits, we send electronic marketing only on the basis of prior consent.
11.3. You can refuse such messages at any time free of charge using the link in the e-mail or by writing to support@stockero.com. Unsubscribing from marketing does not prevent us from sending necessary operational messages, such as access details, an invoice, a renewal reminder or a security notice.
12. Automated verification of membership
12.1. For the DK Investment Club plan, the system automatically compares the identifier used in the order with the limited membership information made available by TradeSmart. The verification works only with the match of the identifier and the membership status; it does not assess personal characteristics, financial situation or user behaviour.
12.2. The result may affect your ability to order the Club member plan and, after the minimum guaranteed period has elapsed, the continuation of that special access. The verification is necessary for entering into or performing the contract. If you believe the result is incorrect, write to support@stockero.com. A human will review the result, we will give you the opportunity to express your point of view, and we will correct any incorrect data or decision without undue delay.
12.3. Stockero does not carry out any other decision-making based solely on automated processing that would have legal or similarly significant effects on a user within the meaning of Article 22 GDPR.
13. Your rights
Subject to the conditions set out in the GDPR, you have the right:
- to obtain confirmation as to whether we process your data, and access to it;
- to have inaccurate data corrected and incomplete data completed;
- to request erasure of your data where it is no longer needed, where you withdraw consent, where you successfully object or where it is processed unlawfully;
- to request restriction of processing;
- to obtain the data you have provided to us, including watchlists and your own notes, in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where the processing is based on consent or a contract and is carried out by automated means;
- to withdraw consent at any time, without affecting the lawfulness of processing carried out previously;
- to object to processing based on legitimate interest; where you object to direct marketing, we will no longer process the data for that purpose;
- to request human review of the result of the automated membership verification, to express your point of view and to contest the result; and
- to lodge a complaint with a supervisory authority.
These rights are not absolute and may in a particular case be limited by a statutory exemption or by the rights of others.
Send your request to support@stockero.com or to our registered office. So that we do not disclose data to an unauthorised person, we may verify your identity to a reasonable extent. We will reply without undue delay, usually within one month; for a complex or numerous request the period may be extended by a further two months under the conditions set out in the GDPR. The request is free of charge unless it is manifestly unfounded or excessive, in particular because it is repetitive.
14. Complaint to a supervisory authority
You have the right to lodge a complaint, in particular with the supervisory authority of the state of your habitual residence, place of work or the place of the alleged infringement. In the Czech Republic the supervisory authority is:
the Office for Personal Data Protection
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
e-mail: posta@uoou.gov.cz
data box: qkbaa2n
web: https://uoou.gov.cz/verejnost/stiznost-na-spravce-nebo-zpracovatele
We would be glad if you contacted us first so that we can address the matter; this is not, however, a condition for lodging a complaint.
15. Mandatory and voluntary data
The data marked as mandatory in the order or registration form is needed in order to enter into and perform the contract, verify payment or membership and comply with legal obligations. Without it, it may not be possible to create an account, accept an order or provide the service.
Creating a watchlist, adding a particular symbol and saving a note are voluntary. Without adding a symbol, however, the Application cannot start monitoring and analysing the company you have chosen; without a note, only that supplementary feature will go unused.
Marketing and analytics consents are voluntary. Refusing them does not affect your ability to order and use Stockero.
16. Security
We adopt appropriate technical and organisational measures corresponding to the nature of the data and the risk of the processing. We limit access to personal data to persons who need it for their work or contractual task and who are bound by a duty of confidentiality or an equivalent contractual obligation. We review the measures on an ongoing basis and adapt them as risks evolve.
No system can be described as absolutely secure. If you suspect an incident or misuse of your account, contact us without delay at support@stockero.com. Where a security breach presents a high risk to your rights and freedoms, we will inform you without undue delay to the extent required by the GDPR.
17. Children
Stockero is not intended for persons under 18 years of age. If we find that we have obtained the data of a minor contrary to this policy, we will take reasonable steps to remove it and secure the account.
18. Changes to this policy
We may update this policy in particular when the service, our suppliers or legal requirements change. We always publish the current version together with its effective date. We will give you reasonable notice of any material change that significantly affects your rights or extends the purpose of processing, for example by e-mail or a notice in the Application. Where new processing requires consent, we will ask for it in advance.
19. Contact
Please send privacy enquiries, requests and objections to:
support@stockero.com
FinBits s.r.o., Jičínská 226/17, Žižkov, 130 00 Prague 3, Czech Republic