Privacy Notice
Last updated: 29 September 2026
This Privacy Notice explains how GP METALLUM processes personal data when you visit our website, use our online shop, contact us, purchase goods from us, subscribe to our newsletter or sell precious metals to us.
DATA CONTROLLER
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Gerd Poskowski – GP METALLUM
Marienkäferweg 38
14532 Stahnsdorf
Germany
Phone: +49 3329 690 70 21
Email: shop@gp-metallum.de
Website: www.gp-metallum.de
GENERAL PRINCIPLES OF DATA PROCESSING
We process personal data only where there is a legal basis for doing so. Depending on the processing activity, the relevant legal bases may include in particular:
- Article 6 (1) (a) GDPR – consent
- Article 6 (1) (b) GDPR – performance of a contract and pre-contractual measures
- Article 6 (1) (c) GDPR – compliance with a legal obligation
- Article 6 (1) (f) GDPR – legitimate interests
Where information is stored on or accessed from your terminal equipment, the requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG) also apply.
Personal data is generally retained only for as long as necessary for the respective purpose. Statutory retention obligations may require longer storage.
We do not sell personal data.
PROVISION OF THE WEBSITE AND SERVER LOG FILES
When you access our website, technically necessary information is processed automatically by the web server. This may include in particular:
- IP address
- date and time of access
- requested page or file
- amount of data transferred
- referrer URL
- browser type and browser version
- operating system
- information relating to the requesting internet service provider
The processing is necessary to provide the website technically, maintain the stability and security of our systems and identify technical errors or abusive access.
The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest is the secure and reliable operation of our website.
Server log data is deleted once it is no longer required for these purposes, unless security-related or statutory reasons require longer retention.
PRIVACY SETTINGS, COOKIES AND SIMILAR STORAGE TECHNOLOGIES
Our online shop uses technically necessary cookies and similar storage technologies. These may be required, for example, to provide shopping-cart functions, language settings, login status and other shop functions requested by the user.
Where access to information on your terminal equipment is strictly necessary in order to provide a digital service expressly requested by you, such access is based on Section 25 (2) TDDDG.
Services that are not technically necessary are generally activated only after you have given your consent via our privacy settings.
The legal basis for such access to your terminal equipment is Section 25 (1) TDDDG. The legal basis for subsequent processing of personal data is generally Article 6 (1) (a) GDPR.
Your selection is stored in your browser so that your privacy settings can be taken into account when you visit further pages.
You can reopen and change your privacy settings at any time or withdraw previously given consent with effect for the future.
Further details about the services currently used and their respective storage periods are also displayed directly in the privacy settings of our shop.
YOUTUBE
Individual pages of our website may contain embedded videos provided by YouTube.
YouTube content is loaded only after you have consented to activation of this service through our privacy settings.
When the service is activated, information such as your IP address, browser and device information and details of the page you are visiting may be transmitted to Google. Depending on your use of the service and whether you are signed in to a Google account, Google may process additional information.
The legal basis for activation is your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) (a) GDPR.
Further information can be found in Google's Privacy Policy .
RECAPTCHA / PROTECTION OF FORMS
Google reCAPTCHA or a corresponding Google technology for fraud and abuse prevention may be used to protect certain forms against automated submissions, spam and misuse.
Where the service is integrated through our privacy settings on the basis of consent, it is activated only after you have provided the corresponding consent.
Technically necessary information about your device and your use of the respective form may be processed in this context.
The purpose of the processing is to protect our forms and identify automated or abusive access.
Where activation is based on consent, the legal bases are Section 25 (1) TDDDG and Article 6 (1) (a) GDPR.
If a protected form cannot technically be used without activation of this service, you may alternatively contact us by email or telephone.
CUSTOMER ACCOUNT
You may create a customer account in our online shop. We process the information entered by you during registration, in particular your name, address and contact details and, where applicable, company details and VAT identification number.
The processing is carried out for the purpose of creating and managing the customer account, simplifying future orders and administering existing contractual relationships.
The legal basis is Article 6 (1) (b) GDPR.
You may request closure of your customer account. Data relating to completed transactions that must be retained by law remains unaffected.
ORDERS AND CONTRACT PROCESSING
When you place an order with GP METALLUM, we process the personal data required for the order and the performance of the contract.
This may include in particular:
- name and billing or delivery address
- email address and, where applicable, telephone number
- company information for business customers
- order, product and invoice data
- selected payment and shipping method
- communications relating to the order
The legal basis is Article 6 (1) (b) GDPR.
Where we are required to retain invoices, accounting records or business documents under commercial or tax law, further storage is based on Article 6 (1) (c) GDPR.
Under current German law, accounting vouchers are generally subject to a retention period of eight years, while commercial and business correspondence is generally retained for six years. Longer periods may apply to certain other documents.
SHIPPING SERVICE PROVIDERS
When goods are shipped, we transmit the data required for delivery to the respective parcel, shipping or valuables transport service provider.
This may include in particular your name, delivery address and any further shipping information required for the specific delivery.
Depending on the type, value, size and destination of the shipment, GP METALLUM uses in particular DHL, Deutsche Post and UPS as well as, where appropriate, suitable valuables transport service providers.
The legal basis is Article 6 (1) (b) GDPR.
PAYPAL
If you select PayPal as your payment method, the information required to process the payment is transmitted to PayPal.
The European provider is:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg
The transmitted information may include in particular your name, address, email address, order amount, order details and other information required to process the payment.
The transmission required for the PayPal payment selected by you is generally based on Article 6 (1) (b) GDPR.
PayPal processes the information transmitted to it under its own responsibility for data protection purposes and may conduct its own fraud-prevention, identity-verification and risk-assessment procedures.
Where additional PayPal functions or PayPal content are integrated into our website before a payment method is selected and consent is required for such integration, those functions are loaded only after you have given the corresponding consent through our privacy settings.
Further information can be found in PayPal's Privacy Statement .
CONTACT FORM, EMAIL AND TELEPHONE
If you contact us through our contact form, by email or by telephone, we process the information provided by you in order to respond to your enquiry.
This may include in particular your name, company, email address, telephone number and the content of your message.
If your enquiry relates to an existing or prospective contract, the legal basis is Article 6 (1) (b) GDPR.
For other enquiries, processing is based on our legitimate interest in responding to communications pursuant to Article 6 (1) (f) GDPR.
The data is deleted once the matter has been concluded and no statutory retention obligations or other legitimate reasons require further storage.
NEWSLETTER
You can subscribe to our newsletter on our website. Through the newsletter, we regularly provide information by email about our product range, new or restocked products, special offers, as well as news and information relating to GP METALLUM and physical precious metals.
We process your email address for the purpose of sending the newsletter. The legal basis is your consent pursuant to Article 6 (1) (a) GDPR.
Newsletter subscriptions are confirmed using the double opt-in procedure. After submitting your email address, you will receive an email containing a confirmation link. Your email address will only be activated for newsletter distribution once you have confirmed your subscription by clicking this link.
For the purpose of documenting your consent, we retain the registration and confirmation data required for this purpose. This may include in particular the date and time of registration and confirmation and, where technically recorded, the IP address used.
Your data is retained for newsletter distribution for as long as your subscription remains active. Information required to demonstrate that consent was validly given or subsequently withdrawn may be retained beyond this period for as long as necessary for that purpose.
You may withdraw your consent at any time with effect for the future. Each newsletter contains an unsubscribe link for this purpose.
Alternatively, you may unsubscribe by sending an email to shop@gp-metallum.de.
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
After unsubscribing, your email address will no longer be used for newsletter distribution.
EU RESELLERS AND VERIFICATION OF BUSINESS INFORMATION
Deliveries to other member states of the European Union are available only to commercial resellers who have been verified in advance.
As part of this verification process, we process the information and documents required to identify and verify the business.
This may include in particular:
- company and contact details
- VAT identification number
- information relating to authorised representatives or acting persons
- identification documents
- the signed reseller confirmation
- where appropriate, information obtained from public or official registers
The processing is carried out to determine whether the requirements for supplying the customer as a commercial reseller are met, for pre-contractual and contractual purposes and to comply with tax and other statutory obligations.
Depending on the processing activity, the legal bases are Article 6 (1) (b), (c) and (f) GDPR.
Our legitimate interests include verifying business status, preventing abusive orders and ensuring legally compliant processing of cross-border transactions.
PURCHASE OF PRECIOUS METALS AND IDENTIFICATION
If you sell precious metals to GP METALLUM, we process the information required to prepare and carry out the purchase transaction.
This may include in particular your name, address, contact details, bank account information, details of the goods offered, contractual and settlement information and any required identification data.
As part of our precious-metals purchasing process, we may require suitable proof of identity.
Where statutory identification and record-keeping obligations under the German Money Laundering Act (Geldwäschegesetz – GwG) apply, processing is based on Article 6 (1) (c) GDPR in conjunction with the applicable provisions of the GwG.
Where identification is additionally necessary for the secure handling of a purchase transaction, verification of the contracting party, fraud prevention or documentation of the origin of a shipment, processing may also be based on Article 6 (1) (b) or (f) GDPR.
Records and documents that must be retained under the German Money Laundering Act are generally subject to a five-year retention period. Unless another statutory provision requires longer retention, such records must be destroyed no later than ten years after the relevant point in time.
VIDEO RECORDING WHEN OPENING PURCHASE SHIPMENTS
Incoming shipments relating to precious-metals purchases may be recorded on video while being opened.
The purpose of the recording is to document the contents and condition of the shipment and to provide evidence in the event of discrepancies, transport damage or disputes.
The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest is the verifiable documentation of incoming goods and the establishment, exercise or defence of possible legal claims.
Where the transaction is completed without any irregularities, the recordings are deleted promptly after the shipment has been checked, the purchase credit note has been issued and payment has been made.
In the event of discrepancies, transport damage or disputes, recordings may be retained until the matter has been finally resolved or until any related legal proceedings have been concluded.
RECIPIENTS OF PERSONAL DATA
Where necessary for the relevant purpose, personal data may in particular be disclosed to the following categories of recipients:
- hosting and IT service providers
- parcel, shipping and valuables transport providers
- payment service providers
- tax advisers and accounting service providers
- banks and financial institutions
- authorities and public bodies where disclosure is required by law
- legal advisers or other parties where necessary for the establishment, exercise or defence of legal claims
- third-party providers whose services you have expressly activated through our privacy settings
Where service providers process personal data exclusively on our behalf, they are engaged as processors in accordance with applicable data protection law.
TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
In connection with individual services, personal data may also be processed outside the European Union or the European Economic Area.
Such transfers take place only where the applicable data protection requirements are met, for example on the basis of an adequacy decision by the European Commission, appropriate safeguards such as Standard Contractual Clauses or another lawful basis.
Further details regarding possible international data transfers can be found in the information provided by the respective service providers and in our privacy settings.
RETENTION PERIODS
Unless a specific retention period is stated for a particular processing activity, we retain personal data only for as long as necessary for the respective purpose.
Commercial, tax and anti-money-laundering law may require certain data to be retained for longer periods.
Once the relevant periods have expired, the data is deleted unless it remains necessary for the establishment, exercise or defence of legal claims or another legal basis permits continued processing.
DATA SECURITY
Our website is transmitted using encrypted HTTPS connections.
We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other misuse.
YOUR RIGHTS
Subject to the applicable statutory requirements, you have in particular the following rights:
- right of access pursuant to Article 15 GDPR
- right to rectification pursuant to Article 16 GDPR
- right to erasure pursuant to Article 17 GDPR
- right to restriction of processing pursuant to Article 18 GDPR
- right to data portability pursuant to Article 20 GDPR
- right to object pursuant to Article 21 GDPR
- right to withdraw consent pursuant to Article 7 (3) GDPR
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Where we process personal data on the basis of Article 6 (1) (f) GDPR, you may object to the processing on grounds relating to your particular situation.
Where personal data is processed for direct-marketing purposes, you may object to such processing at any time.
To exercise your data protection rights, please contact shop@gp-metallum.de.
AUTOMATED DECISION-MAKING
GP METALLUM itself does not make decisions based solely on automated processing within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you.
External payment service providers may conduct automated risk, fraud or creditworthiness assessments as part of their own services. The privacy information of the respective service provider applies to such processing.
RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a data protection supervisory authority.
The supervisory authority generally responsible for GP METALLUM is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany
Phone: +49 33203 356-0
Email: Poststelle@LDA.Brandenburg.de
Website: www.lda.brandenburg.de
CHANGES TO THIS PRIVACY NOTICE
We update this Privacy Notice when our processing activities, technical services used or applicable legal requirements change.
The “Last updated” date shown at the beginning of this page indicates when this Privacy Notice was last reviewed and updated.