Privacy Policy

This policy describes what personal data we process about you when you use the Invest Control service, why we do so, to whom we disclose it and what rights you have. It is based on Regulation (EU) 2016/679 (GDPR).

1. Controller

The controller of personal data is GS West s.r.o., company ID 09300554, with its registered office at třída Vítězství 13/14, Hamrníky, 353 01 Mariánské Lázně, Czech Republic, registered in the Commercial Register kept by the Krajský soud v Plzni (Regional Court in Plzeň), file no. C 39521.

For matters concerning the protection of personal data, contact us at info@invest-control.eu.

Given the scope and nature of our processing, we have not appointed a data protection officer — the law does not impose that obligation on us.

2. What data we process

Account data

E-mail address, username, optionally your real name, language, time zone, your password in the form of an irreversible hash, two-factor authentication settings and information about a linked Google or Apple account if you sign in through them.

Billing data

Organisation name, billing e-mail, address, country, company ID and VAT ID, entity type and whether you are a VAT payer. Also the payment card type and its last four digits — we never see the full card number, it is processed by the payment gateway.

Data about your investments

Portfolios, transactions, dividends, watched assets and tax output settings. If you link a broker account, also the access key (stored encrypted) and the data downloaded from that account — positions, trades and dividends.

Technical and operational data

IP address, browser and device identification, the time and result of sign-in attempts, records of changes to your data (who changed what and when) and records of e-mails sent, including whether the e-mail was delivered, opened and whether you clicked a link in it.

Content you create

Community posts, requests sent to the helpdesk and conversations with the AI assistant.

3. Why we process the data and on what basis

Commercial communications

We send messages about news and improvements to the service to the e-mail address registered with your account on the basis of legitimate interest under Section 7 of Czech Act No. 480/2004 Coll. You can turn the subscription off at any time — via the link in the footer of every e-mail or in your account settings, where individual message types can be switched on and off separately. Operational and transactional e-mails (registration confirmation, password reset, payment information, security alerts) are part of the service and cannot be turned off.

4. To whom we disclose the data

We never sell your data. We disclose it only to processors who help us operate the service, and only to the extent necessary:

Transfers to the United States are covered, for the recipients named, by the European Commission's adequacy decision (EU-US Data Privacy Framework) or by standard contractual clauses.

We may also disclose data to public authorities where required to do so by law.

Market data providers (Twelve Data and others) receive only queries about specific securities — not data about you or about your portfolio.

5. How long we retain the data

After you cancel your account you have 30 days to export your data and to reconsider your decision. Once that period expires we erase the account and the related data.

Records of data changes are not erased but are detached from your identity — they serve to evidence history and to defend legal claims. Accounting documents are likewise retained, since the retention period for them is set by law.

6. Your rights

In relation to your personal data you have the right:

• of access — to know what data we process about you and to obtain a copy of it;
• to rectification — to have inaccurate data corrected or incomplete data completed (most of it you can edit yourself in your account settings);
• to erasure — to have the data deleted if we have no other lawful ground for processing it;
• to restriction of processing — for the period during which we review your objection or the accuracy of the data;
• to data portability — to obtain the data in a machine-readable format;
• to object to processing based on legitimate interest, in particular to the sending of commercial communications;
• to withdraw consent where processing is based on consent (cookies) — withdrawal does not affect processing carried out before it.

You can exercise your rights at info@invest-control.eu. We will handle them within one month at the latest.

You also have the right to lodge a complaint with the supervisory authority, which is the Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz (site in Czech).

7. Security

All communication with the service is encrypted. We store passwords only as irreversible hashes and we encrypt access keys to broker accounts. Access to production data is limited to the necessary circle of people. You can additionally protect your account with two-factor authentication.

No measure is absolute. Should a personal data breach occur that presents a high risk to your rights, we will inform you.

8. Automated decision-making

We do not carry out automated decision-making producing legal effects concerning you, nor profiling for that purpose. The AI assistant works with your queries, but its outputs are informative and have no legal consequences for you.

9. Cookies

The use of cookies and consent settings are described on a separate page, Cookie settings.

10. Changes to this policy

We may amend this policy, in particular when introducing new features or changing processors. We will inform you of any substantial change by e-mail or by a notice within the service. The effective date and version are stated at the end of this page.

This policy is drawn up in the Czech, English and German languages. In the event of a discrepancy between the language versions, the Czech version shall prevail.