# General Data Protection Policy

> Source: https://www.investbay.com/en/general-data-protection-policy · Part of InvestBay (https://www.investbay.com) · See /llms.txt for an overview.

# Personal Data Protection Policy

## 1 Personal Data Collected on the Website

### 1.1 Introductory Information

In this policy, we explain how we handle your personal data. The controller of your personal data is INVESTBAY s.r.o., with its registered office at Zubatého 295/5, Smíchov, 150 00 Praha 5, Company ID (IČO): 17140307, file no. C 367214, registered with the Municipal Court in Prague.

### 1.2 What personal data is collected when you visit www.investbay.com?

As a general rule, we do not require registration to access www.investbay.com – however, if you take part in any of the activities or services offered on www.investbay.com, we will collect the personal data we need to provide those services. This may include, for example:

- Address and identification data (e.g. first name, surname, address);

- Contact details (e.g. telephone number, email address, postal address, or mobile phone number);

- Descriptive data (e.g. information about your interests in relation to our services).

We do not collect sensitive personal data from you through any of the websites mentioned above.

### 1.3 Technical Information

When you visit this website, we may collect technical information such as your IP (Internet Protocol) address, details of the pages you visit on www.investbay.com, other pages you visit on the site, and which browser you used to view www.investbay.com. This website collects standard internet log and technical data that measure and improve the website’s effectiveness, help diagnose problems with our server, manage this website, determine where website traffic comes from, and identify our users.

We also collect further information through the website, such as activities and preferences relating to your use of the website, also known as demographic or profile data. In this context, we use “cookies” to collect this information.

### 1.4 When do we collect personal data through the website www.investbay.com?

We collect personal data from you in the following cases:

- If you subscribe to our newsletter

- If you wish to receive current information and offers from us

- If you arrange a meeting with one of our employees

- If you ask us to contact you

- If you request that documents be sent to you

- If you contact us via live chat or through social media

- If you contact us to request further information

- If you fill in a contact form

We collect the minimum amount of information necessary to deal with your request. We will indicate where the provision of information is voluntary or mandatory. We will normally only request further information if it enables us to provide a more suitable response to your request.

### 1.5 The basis on which we handle your personal data

We must have a legal basis for processing your personal data. In most cases, the legal basis will be one of the following:

- Entering into a contract and fulfilling our contractual obligations to you

- Compliance with the legal obligations to which we are subject (in particular Act No. 256/2004 Coll., on Capital Market Undertakings, and Act No. 253/2008 Coll., on Certain Measures against the Legitimisation of Proceeds of Crime and Financing of Terrorism)

- Consent to the processing of personal data, for example when sending a newsletter or other commercial communications

- The pursuit of our legitimate interests; for example, fraud prevention, the protection of legal claims, or intra-group administration.

### 1.6 How do we use your personal data?

We only use the personal data you provide to us in order to deal with your request and to manage www.investbay.com and the services we offer you through the website. When you request materials or ask someone from our company to contact you, we will have the opportunity to obtain further information that may be relevant to your interest in our products.

## 2 Cookies

### 2.1 Introduction

We collect information about users of this website automatically, as well as when you decide to provide such information to us yourself – for example, by filling in a form on www.investbay.com. This information is treated confidentially, and INVESTBAY s.r.o. uses it only in accordance with the terms set out in this privacy notice.

We may use “cookies” to store and, at times, to track information about you. We store technical cookies that are necessary for the website to function without consent, on the basis of the exemption under Act No. 127/2005 Coll. We store and read analytical and marketing cookies exclusively on the basis of your prior consent.

### 2.2 Cookie files

Cookies are small text files that are downloaded to your computer or mobile device when you visit websites or applications. Your web browser (for example, Internet Explorer, Mozilla Firefox, or Google Chrome) sends these cookies back to the website or application on each subsequent visit, so that you can be recognised and, for example, your personal data or user preferences can be remembered. Cookies will not damage your system. You can reset your browser to refuse any cookie, or to notify you whenever a cookie is being sent.

We use cookies to administer our systems and to analyse traffic on our website in order to improve the user experience and enhance our services. This gives us information about the number of visitors to different parts of our website. INVESTBAY s.r.o. does not share this data with third parties for their own purposes.

Our cookies do not store data such as your name or address, but rather allow us to see your behaviour on the website, which helps improve your user experience. However, if you wish to restrict, block, or delete cookies from www.investbay.com or any other website, you can do so through your browser. Every browser is different, so please check the “Help” menu of your particular browser (or your mobile phone’s manual) to find out how to change your cookie preferences.

### 2.3 How to control cookies

There are various ways in which you can control and manage cookies, described in more detail below. Please bear in mind, however, that any settings you change will not affect only the cookies of www.investbay.com. These changes will apply to all websites you visit (unless you choose to block cookies only from specific websites).

### 2.4 Managing cookies in your browser

Most modern browsers will allow you to:

- See what cookies you have and delete them individually

- Block third-party cookies

- Block cookies from particular websites

- Block the sending of all cookies

- Delete all cookies when you close your browser

You should be aware that if you delete cookies, any preferences will be lost. This also applies to websites where you have opted out of cookies, since doing so requires an opt-out cookie to be set. If you block cookies, many websites will not function properly, and some features of those websites will not work at all.

### 2.5 Managing analytics cookies

We use Google Analytics, operated by Google Ireland Limited, to measure website traffic. These cookies are only stored if you give your consent to analytical cookies in the cookie banner. Data may be transferred to the USA; for details of the transfer mechanism, see Section 8.

### 2.6 More information about cookies and how to manage them

If you would like to learn more about cookies and how to manage them, please visit aboutcookies.org (please note that we cannot be held responsible for the content of external websites).

## 3 Sending Commercial Communications

We may process your personal data (first name, surname, telephone number, email address) for the purpose of sending commercial communications (newsletters, information, tips, offers, invitations, etc.). We send commercial communications in accordance with Act No. 480/2004 Coll., on Certain Information Society Services, only with your prior consent (given by signing up through the form on the website). You may withdraw this consent at any time, and you may also unsubscribe from commercial communications in any email you receive.

If you are our client, we may send you commercial communications without prior consent. In such a case, you have the option to refuse further commercial communications at any time.

## 4 Personal Data Collected by the Company Outside the Website

We may also come into contact with you outside the website and process your personal data. You may be a prospective client, a customer, our supplier, or a job applicant. In such cases, we process your personal data in order to:

- Be able to enter into a contract with you and fulfil the obligations agreed in that contract

- Ensure that our records are accurate and up to date

- Ensure the protection of our company’s property

- Comply with the legal obligations to which we are subject (in particular Act No. 253/2008 Coll., on Certain Measures against the Legitimisation of Proceeds of Crime and Financing of Terrorism).

To do so, we must have a legal basis for processing your personal data. In most cases, the legal basis will be one of the following:

- Entering into a contract and fulfilling our contractual obligations to you

- Compliance with the legal obligations to which we are subject

- Consent to the processing of personal data

- The pursuit of our legitimate interests; for example, fraud prevention, the protection of legal claims, or intra-group administration.

As part of KYC and compliance with our statutory obligations, we automatically compare your identification data against sanctions lists, databases of politically exposed persons, and other registers. This only produces an alert of a possible match; every such alert is reviewed by an authorised employee, who has the authority to dismiss it and reach a different decision based on additional information. We therefore do not make decisions to establish or terminate a business relationship solely through automated means within the meaning of Article 22 of the GDPR. You have the right to request an explanation of the screening result and to object to it at [info@investbay.com](mailto:info@investbay.com).

## 5 Rights Relating to the Processing of Personal Data

### 5.1 Your rights

You have the right to request:

- Access to your personal data

- The updating or correction of your data

- The transfer of your personal data to another controller

- To unsubscribe from further information from the company

- That your personal data be deleted from our systems

- To object to processing, where applicable

- To lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection (ÚOOÚ), with its registered office at Pplk. Sochora 27, 170 00 Praha 7, by sending an email to [info@investbay.com](mailto:info@investbay.com).

We will deal with all such requests in accordance with applicable law within one month. This response period may, in special cases, be extended by up to three months.

If, in the future, you decide that you no longer wish to receive promotional or marketing emails from us, you can let us know by sending an email to [info@investbay.com](mailto:info@investbay.com), specifying the email address you wish to have removed from our mailing list. However, your choice not to receive promotional and marketing emails does not prevent us from communicating with you – by email or otherwise – regarding matters relating to your existing relationship with us.

INVESTBAY s.r.o. will, in accordance with applicable law, exercise the relevant rights also having regard to available technology and the cost of implementing reasonable measures, including technical measures.

### 5.2 Right to withdraw consent to the processing of personal data

If you have given consent to a particular type of processing, including processing for the purpose of sending commercial communications, you may withdraw it at any time. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

## 6 How Long Do We Retain Your Personal Data?

We retain your data only for as long as is strictly necessary to fulfil your request, for the duration of the contract, and thereafter for the statutory limitation and archiving periods (typically 3 to 10 years), or for the purposes of other legitimate interests.

We typically retain data for 10 years for AML, accounting, or other statutory obligations; in the case of marketing consent, on the other hand, we retain it until such consent is withdrawn. We then securely delete the data in accordance with our data retention policy.

## 7 Sharing of Personal Data

We do not disclose your personal data to third parties unless we have a legal basis for doing so. The exception is our processors (e.g. accounting service providers, marketing agencies, IT and hosting service providers), who process personal data for us and on our behalf. All such processors are bound by written data processing agreements in accordance with the GDPR, which guarantee an adequate level of protection for your data.

We may enter into agreements with other companies or individuals in order to deal with your request or otherwise operate this website or our business activities. We may give such companies access to your personal data, acting on our behalf, in connection with these purposes. We may share your personal data within the INVESTBAY s.r.o. group. We do not provide information to third parties for their own marketing purposes, and we do not send emails on behalf of a third party.

As a result of a sale, merger, consolidation, change of control, transfer of assets, reorganisation, or liquidation of our company (a “reorganisation event”), we may transfer, sell, or assign your personal data to third parties in connection with such a reorganisation event.

Situations in which we may disclose your personal data to a third party include: where applicable law permits it, for the purpose of protecting and defending our rights, property, and legitimate interests, and where required by applicable law (for example, to public authorities, including public administration bodies).

## 8 Transfer of Data Outside the EEA

Your personal data may be transferred, stored, and processed in countries outside the European Union (EU) or the European Economic Area (EEA). In such cases, we will ensure that the transfer takes place strictly in accordance with the GDPR, either on the basis of an adequacy decision of the European Commission or through standard contractual clauses approved by the European Commission, which provide sufficient safeguards for the protection of your personal data.

## 9 Data Security

We have implemented generally recognised technological and operational security standards to protect personal data against loss, misuse, alteration, or destruction. We require all employees and representatives of our organisation to keep personal data confidential. Only authorised staff have access to this data. We will retain your personal data in accordance with our data retention policy.

## 10 Contact Us

If you have any questions or concerns about how your personal data has been used, please contact us regarding the handling of personal data at [info@investbay.com](mailto:info@investbay.com). We are committed to working with you to reach a fair resolution of any complaint or concern regarding data protection.

However, if you believe that we have not been able to help you with your complaint or concerns, you have the right to lodge a complaint with the Office for Personal Data Protection, registered office: Pplk. Sochora 27, 170 00 Praha 7, Company ID (IČO): 70837627, tel.: +420 234 665 111, website: [www.uoou.cz](https://www.uoou.cz).

## 11 Updates to This Privacy Notice

This privacy notice may be amended or updated from time to time. You will be able to see when we last updated this notice, as it will always include a revision date. Changes take effect from the date of their publication. Please review this privacy notice from time to time to check whether any changes have been made to the way we use your personal data.

**Last updated: 10 August 2026**