Hinweise zum Datenschutz

Version 1.0 dated November 1, 2026

This English version is a translation; in case of any discrepancy, the Czech version prevails.

1. Introductory information

This Privacy Policy describes the processing of personal data when you visit the website https://www.un-alyze.com and use the related application and UNALYZE services (the “Portal”). The original domain unalyze.cz may redirect to the Portal. This Privacy Policy is intended for visitors, users, prospective customers, and partners.

In particular, this Privacy Policy explains:

• –

  what personal data we process;

• –

  why and on what legal basis we process it;

• –

  how long we keep it;

• –

  to whom we may disclose it;

• –

  what rights the persons whose data we process have.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (the “GDPR”), and Act No. 110/2019 Coll., on Personal Data Processing.

2. Controller of personal data

The purposes and means of processing are determined by our company UNALYZE s.r.o., Company ID No. 29853575, with its registered office at Nové sady 988/2, Staré Brno, 602 00 Brno (“we” or the “controller”).

You can contact us with questions about processing and requests to exercise your rights via the contact form at:

info@un-alyze.com or via the contact form on the Portal

or in writing at the address of our registered office.

3. Sources and categories of personal data

We obtain identification, contact, login, and billing data, account settings, the content of messages, and the data in a partner application directly from you.

Technical data on the device, the connection, and the use of the Portal is generated when the Portal is visited or used.

If you choose to log in through an external account, we receive from the login provider the account identifier, the email address, and the profile data made available.

We obtain data on the trading account, its transactions, and its development from the broker or trading account provider you have connected, through the service that provides the connection.

We obtain information on the execution or refund of a payment and the related payment identifiers from the payment service provider.

For a partner application, we may verify the profile and audience details you provide against the publicly available profile you link to.

We verify the identification and billing data of business customers and partners in public registers.

For a person acting on behalf of a customer or partner, we may also obtain their work contact details and authority to act from the person they represent. The scope of the data used for the individual purposes of processing is set out below.

4. Purposes of processing

Setting up and managing the user account

For registration, login, identity verification, access recovery, settings management, and the delivery of messages necessary to provide the service, we process your identification and contact data, login and verification data, profile settings, the selected plan, and data on the duration of the account and the subscription. Account messages include, for example, the registration confirmation and password reset.

The legal basis is the conclusion and performance of a contract under Article 6(1)(b) GDPR.

Correctly completing the mandatory registration data is our contractual requirement; without it, the account cannot be created or made available. You provide optional profile data voluntarily. We process account data for as long as the account exists, subject to subsequent limited retention for the purposes set out below.

Connecting trading accounts and analyzing results

To connect MT4 or MT5 accounts, synchronize their history, and display results, we process:

• –

  the identification of the trading account and the broker, the server, and the access credentials that allow data to be read;

• –

  the history of trades and transactions, traded instruments, direction, volume, times, prices, costs, and results of trades;

• –

  balances, the development of the account value, and derived metrics, calendars, and performance reports;

• –

  derived evaluations of results, scores, experience points, levels, and milestones achieved.

We use this data to provide the analytical features agreed with you, on the basis of the performance of a contract within the meaning of Article 6(1)(b) GDPR. Connecting an account is voluntary, but without the account identification, access credentials, and trading history, the account cannot be synchronized and analyzed. When you connect through an external integrator, its operational systems may also receive the read-only access credentials. When you connect directly using the local installation assistant, we process the data transferred from your device according to the selected feature; during installation, we will tell you its exact data flow and the permissions it needs. Neither the master password nor trading permissions are intended for the service.

We keep the access credentials for as long as the trading account is connected. When the trading account is removed, we stop synchronization and request deletion from the connection supplier. We keep the trading history, derived metrics, and reports for as long as the relevant feature is provided in the user account, at the latest until the account is closed or this data is deleted earlier. The scope of the history made available depends on the plan.

Creating a shared report and verifying a trade

If you use the trade sharing feature, we process data on the selected closed trade, in particular its result, instrument, and direction, and link it to a unique verification code. The purpose is to create a shared report and enable its origin to be verified.

The legal basis is the performance of a contract under Article 6(1)(b) GDPR to the extent of this feature you requested.

Sharing is optional. We keep the verification record for as long as the sharing is active, at the latest until the user account is closed. If the sharing ends earlier, we remove the record. Copies that recipients have made outside the Portal are not automatically removed as a result.

Subscription and settlement of payments

To agree on a plan, charge the price, record payments, and make refunds, we process identification, contact, and billing data and data on the subscription, amounts, currency, payment identifiers, and payment status.

The processing is necessary for the performance of a contract under Article 6(1)(b) GDPR and takes place for the duration of the contractual relationship and the settlement of payments. Without the necessary data, the paid service cannot be provided.

You enter your payment card details directly with the payment service provider, which processes them. This provider is the recipient of the billing and payment data. For its own legal obligations, fraud prevention, and other purposes of its own, it acts as an independent controller and informs data subjects of the processing separately.

Providing access to the user community

When you use the community associated with the Portal, we process your community identifier, display name, the content of your posts and communications and, where applicable, information on your entitlement to access under your plan.

Providing the agreed community access is based on the performance of a contract under Article 6(1)(b) GDPR.

Community management, in particular dealing with breaches of its rules, is based on our legitimate interest in the proper and secure functioning of the community under Article 6(1)(f) GDPR. You may object to this form of processing at any time.

Participation in the community is voluntary. Without a community identifier, the relevant access cannot be managed. Posts can be seen by the members of the communication space concerned and by the operator of the community platform, which acts as an independent controller for its own purposes.

We keep the data for managing access for the duration of the membership, and posts for as long as they are published, at the latest until they are removed or the community space concerned is closed. We keep records of a specific breach of the rules in accordance with the section on the protection of legal claims.

Handling inquiries and providing support

When communicating with you, we process your name, contact details, the subject and content of the message, attachments, and a record of how it was handled. We use the data to respond and to resolve the request.

For sales inquiries and customer support, the processing consists of steps taken prior to entering into a contract or the performance of a contract under Article 6(1)(b) GDPR. For other inquiries, the basis is our legitimate interest in handling the communication under Article 6(1)(f) GDPR. You may object to this form of processing at any time.

You provide the data voluntarily; without contact details and a description of the request, we may not be able to respond. We keep the communication until it has been handled and then for no more than 1 year, unless a specific record is needed to prove a contract, to comply with a legal obligation, or to protect a legal claim.

Partner program and commission settlement

When assessing an application and managing the partner cooperation, we process identification and contact data, the main communication channel, a link to the profile, the size and description of the audience, data on the assigned partner link and recorded referrals, and the data necessary to calculate and pay the commission. For an accepted partner, this also includes billing and payment data.

For applicants and partners who are natural persons, the legal basis for processing is taking steps prior to entering into a contract and the performance of that contract under Article 6(1)(b) GDPR.

For contact persons of legal entities, the legal basis is the legitimate interest in establishing and managing business cooperation under Article 6(1)(f) GDPR. You may object to this form of processing at any time.

Without the mandatory data, the application cannot be assessed or the commission paid. The additional description of the audience is optional.

We keep unsuccessful applications for no more than 6 months after they are handled. We process the data of accepted partners for the duration of the cooperation and the settlement of commissions. Subsequent records of accounting documents and legal claims are governed by the purposes set out below.

To attribute a customer to a referral and calculate the commission, we process the referral identifier and data on the registration and the qualifying subscription.

With respect to the referred customer, the legal basis is the legitimate interest in the correct settlement of accounts with partners under Article 6(1)(f) GDPR. You may object to this form of processing at any time.

We keep the records for as long as the entitlement to the relevant commission exists and until it is settled. We make available to partners only the data needed to substantiate their commission, not the customer’s trading history.

Operation and security of the Portal

To deliver content, keep you logged in, remember your privacy choices, prevent attacks, detect misuse, and fix errors, we process the IP address, technical data on the device and browser, session and account identifiers, access and task logs, the approximate login location, and error information. The logs are also used to display logged-in devices and to protect the account.

The legal basis is the necessity for the performance of the contract under Article 6(1)(b) GDPR and our legitimate interest in the functional and secure operation of the Portal and the protection of users under Article 6(1)(f) GDPR. You may object to this form of processing at any time.

Technical data is generated automatically, and its necessary processing is a condition for the relevant part of the service to function. We keep regular operational, error, and security logs for no more than 90 days from the event. We keep data on active sessions until they end. Data relating to a specific incident may be kept to protect legal claims.

To be able to restore operations, we keep backup copies for no more than 30 days from their creation. After deletion from the operational systems, data may remain only in these backups until they are routinely overwritten; it is not used for any other ordinary purposes.

Sending commercial communications

We may also use the email address obtained in connection with registration and the provision of the Portal’s services to send commercial communications concerning our own similar services.

These may include, in particular, information about:

• –

  new features of the Portal;

• –

  services intended for users;

• –

  professional events organized by the operator of the Portal;

• –

  paid or extended features of the Portal;

• –

  other services of our own closely related to the use of the Portal.

The legal basis for processing personal data is our legitimate interest in direct marketing under Article 6(1)(f) GDPR. The sending of commercial communications itself takes place under the conditions of Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services.

During registration, you can opt out of receiving them, in particular by ticking the relevant box, “I don't want to receive app news.” If you do not use this option, you can opt out at any time later through the unsubscribe link, the account settings, or the controller’s contact details.

You may object at any time to the processing of personal data for direct marketing purposes. Once we receive an objection, we will no longer use the personal data for this purpose.

Traffic measurement and marketing

If we turn on analytics or marketing tools on the Portal, we will use them to the extent of the consent given, which can be withdrawn at any time in the privacy settings. We list the tools currently in use, their providers, purposes, identifiers, retention periods, and any transfers in the Cookie Policy. Without consent, we run neither optional traffic measurement nor marketing tags.

We process browser or user identifiers, page visits, actions taken, the source of the visit, technical data on the device, the language and performance of the application and, for tools that use this function, the approximate location derived from the IP address.

The basis is consent under Article 6(1)(a) GDPR. Giving it is voluntary and is not a condition for registration or the provision of the service. You can withdraw your consent at any time in the cookie settings on the Portal or through the controller’s contact details. The withdrawal does not affect the lawfulness of processing before the withdrawal.

You can find a current overview of the tools and the option to change your choice in our Cookie Policy on the Portal.

Accounting and tax records and handling statutory requests

We process the identification, billing, and transaction data on documents to keep accounts and fulfill tax obligations under Article 6(1)(c) GDPR, that is, because such processing is necessary for compliance with legal obligations, in particular those arising from Act No. 563/1991 Coll., on Accounting, and the relevant tax legislation.

We keep accounting documents for 5 years from the end of the accounting period to which they relate. If a document is subject to a retention obligation under Act No. 235/2004 Coll., on Value Added Tax, the period is 10 years from the end of the tax period in which the supply took place. Longer retention applies only where the law requires it, for example in connection with pending proceedings.

Data subject requests

When handling data subjects’ requests to exercise their rights under the GDPR, we process identification and contact data, the content of the request, and a record of how it was handled, in order to comply with obligations under Article 6(1)(c) GDPR. Without the data necessary to identify the request and verify the requester, we may not be able to comply with the request.

After the request has been handled, we keep the necessary record to demonstrate compliance with our obligations for no more than 3 years on the basis of legitimate interest under Article 6(1)(f) GDPR. You may object to this form of processing at any time.

Protection of legal claims

For the establishment, exercise, and defense of legal claims, we keep the necessary contractual, payment, and communication records, evidence of consents, and data on specific incidents or breaches of the rules. The basis is the legitimate interest in protecting our rights under Article 6(1)(f) GDPR. You may object to this form of processing at any time.

We keep the data for the duration of the relevant limitation period, usually 3 years from the time the right could first have been exercised. In the event of a dispute or proceedings, we keep the related records until they are finally concluded and any related claims are settled. This purpose does not justify the blanket retention of the entire trading history or of access passwords after the service has ended.

5. Recipients of personal data

Depending on the features used and the nature of the request, we make the necessary data available to the following categories of recipients:

Providers of payment, external login, and community services may also process data as independent controllers for their own purposes.

Transfers outside the European Economic Area may occur depending on the supplier actually used and its settings. For transfers to a country covered by a European Commission adequacy decision, including transfers to a certified recipient in the United States under the EU-U.S. Data Privacy Framework, we rely on that decision; in other cases, we use appropriate safeguards, in particular standard contractual clauses, and supplementary measures where necessary. Information on the mechanism used and a copy of the relevant safeguards can be requested through our contact details. We will verify the specific recipients and transfer routes before deploying a new service.

6. Automated evaluation

The analytical features automatically evaluate historical results and generate metrics, scores, and levels.

Where they relate to an identified user, they may constitute profiling. However, the profiling serves solely to display the user’s results and progress.

Solely on the basis of profiling, we do not make any automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR.

7. Rights of data subjects

In connection with the processing of your data, the GDPR grants data subjects rights under which you may:

• –

  request confirmation as to whether we process your data, and obtain access to it, including a copy;

• –

  request the rectification of inaccurate data and the completion of incomplete data;

• –

  request the erasure of data or the restriction of its processing in the cases provided for by the GDPR;

• –

  receive the data you have provided to us and that we process by automated means on the basis of consent or a contract, in a structured, commonly used, and machine-readable format, and transmit it to another controller, or request that it be transmitted directly where technically feasible;

• –

  withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal;

• –

  lodge a complaint with the Office for Personal Data Protection, www.uoou.gov.cz, or with another competent supervisory authority, in particular in the place of your habitual residence, your place of work, or the place of the alleged infringement of the GDPR.

You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. We will then no longer process the data for that purpose unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or grounds for the establishment, exercise, or defense of legal claims.

You can exercise your rights through the contact form or at the address of the registered office given in the section on the controller. Erasure cannot be carried out to the extent that further processing is necessary, in particular, to comply with a legal obligation or to protect legal claims.

If we wish to use the data for another purpose, we will inform you of the new purpose and other related information required by the GDPR before starting such processing.

8. Changes to this Privacy Policy

We may change this Privacy Policy from time to time, in particular in response to changes to the Portal, the engagement of new suppliers, changes in legislation, or recommendations of supervisory authorities.

The current version will always be published on the Portal. If there is a material change in the way data is processed, we may also inform you of the change through the user account or by email.

This Privacy Policy applies from the date of its publication on the Portal.