Privacy Policy
Version 2.0 · effective 29 August 2026.
1. Controller
Operator: TenetBuy, a sole trader (self-employed entrepreneur) registered in the Czech Republic.
Business ID (IČO) and registered address: available on request at support@tenetbuy.com and stated on every invoice
E-mail: support@tenetbuy.com | Phone: +420 606 385 024 | Telegram: @tenet_com
Website: https://tenetbuy.com (the “Website”)
TenetBuy is the controller of the personal data described below. Questions about data protection: support@tenetbuy.com (subject “Privacy”).
2. What data we process, why and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data: e-mail, nickname, password (hashed), language, country | Creating and operating your account, delivering orders, support | Art. 6(1)(b) – contract | Life of the account + 3 years |
| Order data: products, amounts, payment method, payment reference, status, time-stamps | Performing the contract, accounting | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (Czech accounting and tax law) | 10 years from the end of the tax year |
| Order chat messages and attachments | Delivering credentials, support, evidence of performance and complaint handling | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest in defending claims | 3 years after the order is closed (longer while a dispute is open) |
| Consent record at checkout: time, IP address, browser (user agent), Terms version | Proof that you requested immediate delivery and accepted the Terms | Art. 6(1)(c) – obligation to prove consumer consent; Art. 6(1)(f) | 3 years after the order |
| Payment data (processed by Stripe / Cryptomus): card details, wallet addresses, payment status, fraud signals | Payment processing, fraud prevention, refunds | Art. 6(1)(b); Art. 6(1)(f) | As required by the payment providers and accounting law |
| Technical data: IP address, device and browser, pages visited, referrer, marketing parameters (UTM, Google click ID) | Security, rate limiting, measuring which channels bring orders | Art. 6(1)(f) legitimate interest; cookies for analytics/advertising only with consent (Art. 6(1)(a)) | Server logs 90 days; attribution cookie 30 days; analytics up to 14 months |
| Newsletter e-mail | Sending news and offers | Art. 6(1)(a) consent – withdraw any time via the link in each e-mail | Until you unsubscribe |
| Reviews and public nicknames | Displaying reviews on the Website | Art. 6(1)(f) | Until removed |
3. Recipients (processors and independent controllers)
- Stripe Payments Europe Ltd. (Ireland) – card payments, fraud prevention, dispute handling.
- Cryptomus – cryptocurrency payments.
- Google Ireland Ltd. – Google Analytics 4, Google Tag Manager and Google Ads (conversion measurement and remarketing); Google Sheets for our internal order log. Google may transfer data to the USA under the EU–US Data Privacy Framework and standard contractual clauses.
- Zoho Corporation B.V. (Netherlands) – our support mailbox.
- Telegram – internal notifications to our team about new orders and messages (order number and e-mail only).
- Our hosting provider – server infrastructure where the Website and database run.
- Public authorities, courts and payment networks where we are legally obliged or need to defend a claim.
We do not sell personal data and we do not use it for automated decisions with legal effects.
4. Cookies and similar technologies
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| sessionId | Keeps you logged in and holds your cart | Strictly necessary | 7 days |
| language | Remembers your language | Strictly necessary | 1 year |
| tb_attr | Remembers how you found us (search, ad, link) so we can attribute your order | Analytics (first-party) | 30 days |
| cookie_consent | Stores your cookie choice | Strictly necessary | 1 year |
| _ga, _ga_* | Google Analytics – anonymous usage statistics | Analytics | up to 2 years |
| _gcl_aw, _gcl_au | Google Ads – links your visit to the ad you clicked | Advertising | 90 days |
Analytics and advertising cookies are set only after you accept them in the cookie banner; you can change your choice at any time from the banner or by deleting cookies in your browser.
5. Your rights
You have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting processing before withdrawal). Write to support@tenetbuy.com; we answer within one month.
You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or with the supervisory authority of your own EU country.
6. Security
Passwords are stored as salted hashes, traffic is encrypted (HTTPS), access to the database is restricted, daily backups are kept, and payment card data never touches our servers.
7. Children
The Website is not intended for children under 16. If you believe a child has provided us with data, contact us and we will delete it.
8. Changes
We will publish any changes to this Policy on this page with a new version number and date.