Skip to main content Skip to search Skip to navigation

Privacy Notice

Last updated: 30 September 2026

1. Controller

The controller responsible for processing personal data under the General Data Protection Regulation (GDPR) is:

GP METALLUM
Proprietor: Gerd Poskowski
Marienkäferweg 38
14532 Stahnsdorf
Germany

Phone: +49 3329 690 70 21
Email: shop@gp-metallum.de

2. General Information on Data Processing

We process personal data only where this is necessary to provide our website, respond to enquiries, process orders and precious-metal purchases, comply with legal obligations or on the basis of valid consent.

Depending on the processing activity, the legal basis may in particular be Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract and pre-contractual measures), Article 6(1)(c) GDPR (legal obligation) or Article 6(1)(f) GDPR (legitimate interests).

We do not sell personal data.

3. Access to our Website and Server Log Files

When you access our website, technically necessary information transmitted by your browser is processed. This may include in particular:

  • IP address,
  • date and time of access,
  • requested page or file,
  • amount of data transferred,
  • referrer URL,
  • browser type and version,
  • operating system, and
  • technical information relating to the request.

This processing is necessary to provide the website, maintain its stability and security and detect or prevent misuse and security-related attacks. The legal basis is Article 6(1)(f) GDPR.

Server log data is retained only for as long as necessary for operation, security and the investigation of specific security incidents. It is then deleted or anonymised unless a legal or other legitimate reason requires longer retention.

4. Encryption

Data transmitted between your browser and our online shop is encrypted using HTTPS/TLS. This applies in particular to registration, login and the ordering process.

5. Technically Necessary Cookies and Local Storage

Our online shop uses technically necessary cookies and comparable storage technologies to provide essential shop functions.

JTL-Shop uses the technically necessary session cookie JTLSHOP. Among other things, it enables a browser session to be assigned correctly and is required for functions such as the shopping cart and customer account.

Your choices in the privacy and consent manager are stored in the Local Storage of your device so that they can be taken into account during subsequent visits.

Where storage of information on your device or access to information already stored there is strictly necessary to provide a digital service expressly requested by you, this is carried out in accordance with Section 25(2) TDDDG. Where consent is required, storage or access is based on Section 25(1) TDDDG and the associated processing of personal data is based on Article 6(1)(a) GDPR.

You can change or withdraw your consent at any time using the privacy settings in the shop.

6. Customer Account and Registration

You may create a customer account in our online shop. We process the data entered in the registration form. This may include in particular:

  • name and, where applicable, company details,
  • billing and delivery address,
  • email address and telephone number,
  • VAT identification number where provided,
  • other voluntarily provided information, and
  • login data required to manage the customer account.

The data is processed to create and manage your customer account and to prepare and process orders in accordance with Article 6(1)(b) GDPR.

You may request deletion of your customer account. Data that must continue to be retained due to statutory retention requirements or existing contractual obligations is not affected by such a request.

7. Orders and Contract Processing

When you order goods from GP METALLUM, we process the data necessary to perform the contract. This includes in particular:

  • name and contact details,
  • billing and delivery address,
  • order and product information,
  • payment information,
  • shipping information, and
  • communications relating to the order.

The legal basis is Article 6(1)(b) GDPR. Where data must be processed and retained to comply with tax, commercial or other statutory obligations, Article 6(1)(c) GDPR also applies.

8. Verification of Commercial Resellers in Other EU Member States

Deliveries to other Member States of the European Union are made only to previously verified commercial resellers.

For verification and approval, we may process company and contact details, VAT identification numbers, the reseller declaration and the supporting documents specified in that declaration.

For the subsequent manual creation of an order, we also process the information sent to us by email and, where applicable, the screenshot of the shopping cart or order overview.

Processing is carried out for pre-contractual measures and contract performance under Article 6(1)(b) GDPR and, where required, for compliance with legal obligations under Article 6(1)(c) GDPR.

9. Shipping Service Providers

Where necessary to deliver an order, we transmit the required data to the shipping provider used for the respective shipment. These may include Deutsche Post/DHL, UPS and, where applicable, other transport or high-value logistics providers used for the respective shipment.

Only data required to process the shipment is transmitted, in particular the recipient's name, delivery address and shipping information.

The legal basis is Article 6(1)(b) GDPR.

Additional contact details such as an email address or telephone number are transmitted only where this is necessary for the chosen shipping service or otherwise permitted by law.

10. Payment Processing and PayPal

For payments by bank transfer, we process the bank and payment information required to identify and record the payment.

Where PayPal is available for the respective order and you choose PayPal as your payment method, the data required to process the payment is transmitted to PayPal. This may include your name, address, email address, order information, invoice amount and other information required for payment processing.

The European provider of PayPal services is generally PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.

Data required for the selected payment method is transmitted for the performance of the contract in accordance with Article 6(1)(b) GDPR. PayPal may process data for its services under its own responsibility under data protection law.

Additional PayPal content on our website, for example Express Checkout or other PayPal displays, is loaded only after your consent through the consent manager where technically applicable. The legal basis is Article 6(1)(a) GDPR.

11. Contact by Email, Telephone or Contact Form

If you contact us by email, telephone or contact form, we process the information you provide in order to respond to your enquiry.

If the enquiry concerns a contract or pre-contractual measures, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in responding to enquiries pursuant to Article 6(1)(f) GDPR.

The data is deleted once the matter has been finally resolved unless statutory retention requirements or other legitimate reasons require further retention.

12. Newsletter

If you subscribe to our newsletter, we process your email address and any additional information provided during registration for the purpose of sending the newsletter.

Subscription uses a double opt-in procedure. After registering, you will receive an email asking you to confirm your subscription. The time and technical information relating to registration and confirmation may be stored as evidence of your consent.

The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link contained in every newsletter.

After unsubscribing, your address is removed from the active newsletter distribution list. Information required to demonstrate previously granted consent may be retained for the applicable limitation period.

Where the legal requirements of Section 7(3) UWG are met, we may use an email address received in connection with a sale to advertise our own similar goods or services. You may object to such use at any time without incurring any costs other than the transmission costs according to the basic rates.

13. Google reCAPTCHA

Google reCAPTCHA may be used to protect forms against automated entries and spam.

reCAPTCHA is loaded on our website only after you have consented to the corresponding entry in the consent manager. In this context, information such as your IP address, browser and device information and other technical usage data may be transmitted to Google.

The provider for users in the European Economic Area is generally Google Ireland Limited.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

14. YouTube

Individual pages may contain videos provided by YouTube. YouTube content is loaded only after you have given consent through our consent manager.

When YouTube content is loaded, information such as your IP address, device and browser information and information about access to the video may be transmitted to Google.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

15. Sale of Precious Metals to GP METALLUM

If you offer or sell precious metals to GP METALLUM, we process the personal data required to prepare, perform and settle the purchase.

This may include in particular:

  • name and contact details,
  • address,
  • bank account details,
  • information relating to the items offered or sold,
  • price and contractual information,
  • shipping and receipt information,
  • communications relating to the purchase, and
  • where required by law, identification and verification data.

Processing is carried out in particular for pre-contractual measures and performance of the purchase contract pursuant to Article 6(1)(b) GDPR and for compliance with statutory obligations pursuant to Article 6(1)(c) GDPR.

16. Identification and Anti-Money Laundering Obligations

Where GP METALLUM is required under the German Money Laundering Act or other statutory provisions to identify a person or to record or retain information, we process the personal data required for those purposes.

This may include in particular name, date and place of birth, address, nationality, information contained in an official identification document and other information or evidence required by law.

Where copies or images of identification documents are processed, this is done only where legally permissible and necessary for the relevant identification or verification purpose.

The legal basis for processing required by law is Article 6(1)(c) GDPR in conjunction with the applicable statutory provisions, in particular the German Money Laundering Act.

17. Video Recording when Opening Purchase Shipments

Incoming shipments containing precious metals offered for purchase are generally documented by video when opened. The recording is used in particular to document the contents and condition of a shipment on receipt and to clarify discrepancies, transport damage or disputes.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in reliable documentation of incoming shipments, protection against unjustified claims and the ability to substantiate legitimate claims against transport providers, insurers or contractual partners.

Where the transaction is completed without any irregularities, recordings are deleted promptly after inspection of the goods, preparation of the purchase credit note and payment.

Where there are discrepancies, transport damage, loss, authenticity, insurance or other disputes, the relevant recording may be retained until the matter has been finally resolved and, where necessary, for the establishment, exercise or defence of legal claims.

18. Transfers to Third Countries

The use of individual external services may involve the transfer of personal data to countries outside the European Union or the European Economic Area.

Such transfers are made only where the requirements of Articles 44 et seq. GDPR are met, for example on the basis of an adequacy decision of the European Commission or appropriate safeguards such as standard contractual clauses.

Further information about the respective providers is available in the providers' privacy information linked through our consent manager.

19. Recipients and Processors

We use service providers where necessary for our business operations. These may include hosting and IT service providers, payment providers, shipping and transport companies and other technical service providers.

Where required by law, personal data may also be disclosed to authorities or other legally designated recipients.

Where a service provider processes personal data solely on our behalf, this is carried out under a data processing agreement pursuant to Article 28 GDPR.

20. Retention Periods

We retain personal data only for as long as it is required for the respective processing purpose or statutory retention obligations apply.

Business records and tax-relevant documents are subject in particular to statutory retention requirements under German commercial and tax law. The specific retention period depends on the type of document and the legally applicable starting point of the respective retention period.

Retention beyond the regular period may be necessary where documents remain relevant for taxes for which the applicable assessment period has not yet expired, or where documents are still required in connection with ongoing audits, legal remedies or the establishment, exercise or defence of legal claims.

Records and other documents subject to the German Money Laundering Act are subject to the special retention and deletion periods laid down in that Act. Such records must generally be retained for five years unless other statutory provisions require longer retention; records and documents retained pursuant to the Money Laundering Act must in any event be destroyed no later than ten years after the relevant statutory starting point.

Once the respective processing or retention purpose no longer applies, personal data will be deleted or, where technically and legally permissible, anonymised.

21. Your Rights

Subject to the applicable statutory requirements, you have in particular the following rights:

  • right of access under Article 15 GDPR,
  • right to rectification under Article 16 GDPR,
  • right to erasure under Article 17 GDPR,
  • right to restriction of processing under Article 18 GDPR,
  • right to data portability under Article 20 GDPR,
  • right to object under Article 21 GDPR, and
  • right to withdraw consent under Article 7(3) GDPR.

Withdrawal of consent applies only for the future. It does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact shop@gp-metallum.de.

22. Right to Lodge a Complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us is in particular:

The State Commissioner for Data Protection and Access to Information Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

23. Provision of Personal Data

Certain personal data is required if you wish to create a customer account, place an order, sell precious metals to us or use another service requested by you.

Mandatory information is identified accordingly in the relevant forms or results from statutory requirements. Without the required information, the respective service may not be available or a contract may not be concluded or performed.

24. Changes to this Privacy Notice

We may update this Privacy Notice if our processing activities, services used or the applicable legal framework change.

The version currently published on this website applies.