Privacy policy

Preamble

We attach great importance to safeguarding your privacy and protecting your personal data. For this reason, we are informing you about the processing of your personal data with this privacy policy so that you can safely visit our website in the knowledge and confidence that we will only process your data in accordance with this privacy policy and the statutory provisions. The declaration sets out transparently for you which types of personal data are affected and in what way, to what extent and for what purpose they are processed by us. The privacy policy is comprehensive and therefore applies to all processing activities carried out by us. You are not obliged to provide us with personal data. However, if you do, we may not be able to assess and process your request in accordance with your interests.

Personal data is all information that relates to an identified or identifiable person.

Responsible body

Below you will find information on the responsible body or the person responsible in accordance with the applicable data protection laws, as well as your contact options for data protection issues:

Gold Trust AG, Cham
E-mail: contact@gold-trust.ch

Commercial register of the Canton of Zug CH-310.4.001.317-1
UID CHE-110.040.154

This privacy policy informs data subjects about the purposes, scope and nature of the processing of personal data by the above-mentioned controller. The controller is the legal entity that decides on the means and purposes of processing personal data alone or together with other persons. The controller is the body to which you can turn if you have any questions or wish to assert your rights and to which you are entitled to a response.

We take the issue of data protection very seriously and therefore work together with certified data protection officers / data protection consultants. However, we are not legally obliged to appoint a data protection officer / data protection consultant and have therefore not appointed a data protection officer / data protection consultant. If you have any questions about data protection, please do not hesitate to contact us using the contact details provided.

Legal basis for data processing

According to the GDPR, personal data may only be processed within the EU/EEA with a legal basis in accordance with Art. 6 GDPR. In most cases, this is a legitimate interest on our part (Art. 6 para. 1 sentence 1 lit. f) GDPR) or your consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), as long as you give it. If you have a contractual relationship with us, or if such a relationship is in the offing, this also justifies the processing of personal data (Art. 6 para. 1 sentence 1 lit. b) GDPR). Furthermore, there is the possibility of compliance with a legal obligation for processing on our part (Art. 6 para. 1 sentence 1 lit. c) GDPR). The legal bases in individual cases are listed below in this privacy policy. Please also note that, depending on your place of residence or domicile, other data protection regulations, in particular national regulations, may apply.

We process personal data of data subjects from Switzerland in accordance with the Swiss Data Protection Act (DSG new CH), which comes into force on 01.09.2023. Unlike under the GDPR, the processing of personal data is generally permitted without a legal basis under the new DPA CH. In the following, however, the word legal basis is used in some places in the text for the purpose of standardization, even if this is not necessary under Swiss law, but reference is made to the appropriate DPA new CH standard. We adhere to the principles of Art. 6 DSG new CH when processing data. These are in particular the processing in good faith and for a specific and recognizable purpose, the proportionality of the processing, as well as the destruction or anonymization of the personal data as soon as the purpose of the processing ceases to apply and the processing is no longer necessary.

As this privacy policy may also be used across national borders, we use the GDPR wording for the following synonymous terms:

Term GDPR equivalent	DSG new CH
ProcessingProcessing
Personal dataPersonal	data
Legitimate interestPrevailing	interest
Special categories of personal	dataPersonal data requiring special	protection
Transfer of personal dataDisclosure	of personal data

Nature and purpose of the use of personal data and its collection and storage

General information

Depending on your use of our website, we process different personal data for different purposes.

Various purposes may include, in particular, the provision of our website, the management of our IT infrastructure, security measures, office procedures, organizational management and marketing. Furthermore, the purpose of processing may be the fulfillment of contractual obligations including the provision of a contractually owed service, as well as the communication, administration and answering of contact and other inquiries and/or the implementation of competitions.

For these purposes, we process different types of data, primarily inventory, usage, content and/or metadata, but also payment, contact, communication, location, other contractual and/or procedural data, as well as event data. The types of data processed are always limited depending on the relevant purpose.

The following categories of persons may be affected by the processing of personal data by us: Users and interested parties; customers, applicants, business and other contractual partners; other communication partners, participants in competitions or similar contests and members.

The respective purposes, data types and data subjects are also listed in detail below.

When visiting "gold-trust.ch", general data processing and data processing beyond the website

Server log files

When you visit our website, the following data is automatically processed, which is required to establish a smooth connection between your device and our website and to display the website properly:

IP address
Name and address of the website and files visited
Access time
Notification of successful retrieval
Operating system and browser used
Referrer URL
Internet provider

The processed personal data is also used to optimize and ensure the security of the website and the information technology systems.

The legal basis for the processing of this data is our legitimate interest, which provides for the processing of personal data to safeguard the legitimate interests of the controller. The legitimate interests arise from the above reasons. The data is deleted as soon as it is no longer needed, which is the case when the session ends, unless there are legitimate interests in further storage (e.g. unlawful access).

Processed data: Communication and process data (e.g. IP addresses), usage data (e.g. access times)

Affected persons: Users

Purposes of processing: Provision of an optimal online presence, IT infrastructure; security measures

Legal basis: legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) consent (Art. 6 para. 1 sentence 1 lit. a GDPR) / legitimate interest in the provision of an online offer (pursuant to Art. 6 and 8 DSG new CH), consent of the participants (Art. 31 para. 1 DSG new CH)

Guarantees: Contract data processing agreement and, if data is transferred to third countries, the application of EU standard contractual clauses and, if applicable, additional certification of the hoster/provider in accordance with the EU-US Data Privacy Framework DPF.

According to Art. 45 GDPR, all EU Member States are safe countries for the export of personal data and currently (last accessed in June 2023) the following third countries: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, Japan, the United Kingdom and South Korea have been classified by the European Commission as compliant with data protection regulations, meaning that the export of personal data from the EU to these countries is permitted.

When processing personal data from Switzerland in the EU/EEA or the United Kingdom (UK), according to the Federal Council of Switzerland, adequate data protection within the meaning of Art. 16 para. 1 FADP new CH is currently (last accessed in June 2023) guaranteed, so that data exports of personal data from Switzerland to these countries are permitted.

This website is operated on Cloudflare Pages by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the connection data listed above as our processor. A data processing agreement is in place and the EU standard contractual clauses apply to transfers to the United States.

Business performance and applications

If you are a business partner, applicant, customer or other contractual partner in a contractual or quasi-contractual legal relationship with us, we generally process your personal data to fulfill our obligations arising from this relationship - the provision of the service owed or pre-contractual measures. In addition, depending on the individual data, there may be legal obligations for processing, such as tax obligations. In addition, we regularly have a legitimate interest in the processing, in particular for the proper management and protection of business operations. Your data will only be passed on to third parties in accordance with legal requirements. The data processed in this context includes, in particular, inventory and contact data (name, address, telephone number, e-mail address) as well as payment data (bank details, invoices). If you use our website as part of the contractual relationship, corresponding usage and metadata (e.g. IP address, time and duration of access, any consents) may also be processed.

As a rule, we process this personal data after the end of the contractual relationship for as long as any statutory warranty or comparable obligations exist or for as long as statutory retention periods exist.

We would like to point out that the terms and conditions and data protection notices of third parties may also apply if they become part of the contractual relationship. This may be the case if we use or commission third-party providers to fulfill our services and obligations.

Processed data: Communication and process data (e.g. IP addresses), usage data (e.g. access times), contact data (e.g. e-mail address), payment data, inventory data (e.g. name, address)

Data subjects: Interested parties, applicants, customers, contractual and business partners

Purposes of processing: Ensuring contractual services/obligations, communication and contact requests, office and organizational procedures; security measures, administration, checking suitability for a position

Legal bases: Contractual claims (Art. 6 para. 1 sentence 1 lit. b GDPR), Legal obligations (Art. 6 para. 1 sentence 1 lit. c GDPR), Legitimate interests (Art. 6 para. 1 lit. f GDPR) / legitimate interest (pursuant to Art. 6 and 8 DSG new CH)

Web analysis with Cloudflare Web Analytics

We use Cloudflare Web Analytics, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to measure reach. Cloudflare Web Analytics works without cookies and does not store any identifier on your device. No usage profiles are created and you are not recognised across several page views or across several websites.

What is collected are aggregated details of the individual page view, such as the page requested, the referrer, country, browser and device type, along with page load metrics.

Because no cookies are set and no profiles are created, no consent is required. This website therefore shows no cookie banner.

Processed data: usage data (e.g. pages requested), communication and procedural data
Data subjects: users
Processing purposes: reach measurement
Legal bases: legitimate interests (Art. 6 (1) (f) GDPR), overriding interest under the revised Swiss FADP
Guarantees: data processing agreement, EU standard contractual clauses

Contact us by telephone, fax, e-mail and/or post

If you contact us by telephone, fax, e-mail and/or post, the personal data you provide in this context will be processed and stored by us to enable us to evaluate the communication. The data collected is limited to:

First and last name
Telephone number / e-mail address / postal address
Content of the message or other voluntarily transmitted data

The personal data collected by us in this context will not be passed on to third parties unless this is necessary for the proper processing of the matter on the basis of legitimate interests. Personal data may then be transferred to the affected customers, freelancers, cooperation partners and authorities. The legal basis for data processing is legitimate interests. In the case of contact aimed at concluding a contract, the legal basis for processing is legitimate interests.

Processed data: Communication and process data (e.g. IP addresses), content data, contact data (e.g. e-mail address)

Affected persons: Communication partner

Processing purposes: Collecting feedback, providing an optimal online presence, communication and contact requests

Legal bases: Contractual claims (Art. 6 para. 1 sentence 1 lit. b GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) / legitimate interest in effective and targeted advertising measures (pursuant to Art. 6 and 8 DSG new CH)

Guarantees: If data is transferred to third countries, EU standard contractual clauses apply and, if applicable, the provider is also certified in accordance with the EU-US Data Privacy Framework DPF.

When processing personal data from Switzerland in the EU/EEA or the United Kingdom (UK), the Federal Council of Switzerland currently (last retrieval in June 2023) guarantees adequate data protection within the meaning of Art. 16 para. 1 FADP new CH, so that data exports of personal data from Switzerland to these countries are permitted.

Contact form

When you write to us through the contact form, we process the details you enter there: your name, your e-mail address and the content of your message. We use these details only to answer your enquiry. The message is delivered to us by e-mail. We do not pass the details on to third parties and delete them once the enquiry is settled and no retention obligation applies.

To protect the form against automated input we use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you send the form, Turnstile checks that the input comes from a person and processes technical details of your browser and your IP address for that purpose. Turnstile does not recognise you across websites and creates no usage profiles. Cloudflare processes these details on our behalf; the standard contractual clauses apply to transfers to the United States.

Processed data: name, e-mail address, content of the message, IP address and technical details of the browser
Data subjects: persons who write to us
Purpose: answering your enquiry, protection against abuse
Basis: fulfilment of your enquiry; for Turnstile, the overriding interest in protection against abuse (Art. 31 para. 1 FADP)

Rights of data subjects

Rights as a data subject under the GDPR

As a data subject, you have the following rights under the GDPR:

Right to information on data processing and data subject rights

You have the right to obtain confirmation from us as to whether we are processing personal data concerning you. If this is the case, you also have the following rights. You have the right to receive information from us about your rights under Art. 13-22, 34 GDPR.

Right to withdraw consent given

You have the right to withdraw your consent to the processing of personal data from the controller at any time with effect for the future (Art. 7 para. 3, Art. 8 GDPR) without any disadvantages for you. The processing of the data originally covered by the consent may then no longer be processed by us. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

Right to information

In accordance with Art. 15 GDPR, you have the right to request information about the personal data we have stored about you. You are entitled to the following information:

Processing purposes
Categories of personal data that are processed
Recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations. In the case of third countries and international organizations, you also have the right to be informed of the appropriate safeguards pursuant to Art. 46 GDPR.
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
the existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by the controller or a right to object to such processing
Existence of a right of appeal to a supervisory authority
if the personal data are not collected from you, all available information about the origin of the data
the existence of automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for you

Right to rectification or completion

In accordance with Art. 16 GDPR, you have the right to obtain from us the rectification of inaccurate personal data concerning you and the completion of incomplete personal data. We are obliged to comply with this immediately.

Right to erasure (to be forgotten) or destruction

In accordance with Art. 17 GDPR, you have the right to demand the immediate deletion of the personal data concerned.

We are obliged to erase personal data if one of the reasons listed in Art. 17 (1) applies. This does not apply to personal data that is subject to a statutory retention and security period, which we must observe, and to the following exceptions regulated in Art. 17 para. 3 GDPR:

to exercise the right to freedom of expression and information
for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3)
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing
for the assertion, exercise or defense of legal claims

Right to restriction of processing

You have the right to demand that we restrict processing if one of the requirements of Art. 18 (1) GDPR is met.

Right to notification

You have the right to request information from us as to which recipients have been informed that personal data concerning you has been deleted, corrected or restricted.

Right to data output or transfer

In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us.

Right to object

In accordance with Art. 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interests (Art. 6 para. 1 lit. f GDPR). We may then no longer process the personal data unless we can prove compelling reasons that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to lodge a complaint with a supervisory authority

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of the federal state in which our company is based. You can find a list of data protection authorities at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

Rights to which you are entitled as a data subject under the new CH DPA

As a data subject, you are entitled to the following rights in accordance with DSG neu CH:

Right to information on data processing and data subject rights

In accordance with Art. 25 para. 1 GDPR new CH, you have the right to obtain confirmation from us as to whether we are processing personal data concerning you.

Right to information

According to Art. 25 FADP new CH, you are entitled to the following information if you are domiciled or resident in Switzerland:

Identity and contact details of the controller
Processed personal data
Processing purpose
Retention period of personal data or criteria for determining the duration
Information on the origin of the personal data, unless obtained from the data subject
the existence of automated individual decision-making and the logic on which the decision is based
where applicable, the recipients to whom personal data is disclosed and the information in accordance with Art. 19 para. 4

Right to rectification or completion

In accordance with Art. 32 para. 4 DSG new CH, you have the right to demand that we rectify any inaccurate personal data concerning you and complete any incomplete personal data. We are obliged to comply with this without delay.

Right to erasure (to be forgotten) or destruction

In accordance with Art. 32 para. 2 lit. c) DSG new CH, you have the right to demand the immediate deletion of the personal data concerned. Furthermore, pursuant to Art. 32 para. 2 lit. c) DSG new CH, you have the right to have personal data destroyed.

Right to notification

In accordance with Art. 32 para. 4 DSG new CH, you have the right to request information from us as to which recipients have been informed that personal data concerning you has been deleted, corrected or restricted.

Right to data output or transfer

In accordance with Art. 28 GDPR new CH, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from us.

Right to object

Pursuant to Art. 30 para. 2 lit. b) GDPR new CH, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on legitimate interests. We may then no longer process the personal data unless we can prove compelling reasons that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to complain

You have the right to enforce your data protection claims through the courts or to lodge a complaint with a competent data protection supervisory authority. The competent Swiss data protection supervisory authority for private controllers and federal bodies is the Federal Data Protection and Information Commissioner (FDPIC).

Storage period and deletion of personal data

Unless expressly stated in this privacy policy, we will delete your processed personal data when the reason for processing no longer applies. Statutory retention and storage periods remain unaffected in all cases (e.g. in Germany § 14b UStG, § 257 para. 1 no. 2 and 3 HGB, § 147 AO or in Austria § 1478 ff. ABGB) (e.g. in Switzerland Art. 60 OR) In these and other cases, the storage period and deletion are carried out in accordance with the legal requirements.

Changes to this privacy policy

We reserve the right to adapt and amend this privacy policy so that it complies with current legal requirements and our services. The new privacy policy will then apply from your next visit to our website.

Principle of data minimization and SSL encryption

Your personal data will only be processed if this is necessary in order to provide you with a functioning website on which all our content and services are presented in a technically correct manner. Other processing operations are only carried out regularly on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR / Art. 31 para. 1 DSG new CH, unless data processing is permitted by other statutory provisions.

For security reasons and to protect the transmission of personal data, we use SSL encryption.

We also take appropriate technical and organizational measures (TOMs) to ensure an adequate level of protection. The state of the art, implementation costs, type, scope, circumstances and purposes of the processing as well as the different probability of occurrence and severity of the risks associated with the processing for the rights and freedoms of natural persons are taken into account.

Third party data

If, in addition to your personal data, you have also provided us with the data of other persons, please inform these persons about the processing of their personal data with the help of this data protection declaration.

Personal data transfer and third country transfers

In some cases, we work with third parties to process personal data, for example with service providers in the context of embedded content such as videos or statistical analyses. Personal data may be passed on in the process. These third parties are in a contract processing relationship or as joint controllers with us. In each case, we use appropriate agreements to ensure that the protection of your personal data required by law and guaranteed by us is fully complied with. These agreements include, in particular, contracts (order processing contracts, standard contractual clauses, etc.).

Some of our contractual partners are based in third countries, which means that data may also be transferred abroad.

If we process personal data in third countries outside the EU or EEA, lawful processing is ensured by one or more of the following methods:

Transfer to a third country with a recognized level of data protection (Art. 45 GDPR): The EU Commission may determine whether a third country has a data protection concept that is sufficient for the requirements of the GDPR, which means that a transfer to such a third country can take place in compliance with the GDPR. Details can be found at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_de (last accessed on 12.08.2023). The EU Commission's current list of suitable countries can be viewed at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_de (last accessed on 12.08.2023).
Transfer subject to appropriate safeguards (Art. 46 GDPR): These safeguards include a commitment to the EU-US Data Privacy Framework (DPF), which came into force on July 10, 2023, and the EU Commission's Standard Contractual Clauses (SCCs). A list of companies that are committed to complying with the DPF can be found at https://www.dataprivacyframework.gov (last accessed on 13.08.2023). The SCCs of the EU Commission can be found at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en (last accessed on 13.08.2023).
Existence of a condition (Art. 49 GDPR): For example, the existence of your express consent, the necessity for the performance of a contract or a legal obligation.
Further principles from Art. 44-49 GDPR: The list given here is for the purposes of traceability and transparency and is not exhaustive. The basis for a lawful transfer to a third country is listed in detail below in this privacy policy.

The Federal Council has published a list of countries with an adequate level of data protection for the disclosure of personal data to third countries outside Switzerland. This can be viewed at https://www.fedlex.admin.ch/eli/cc/2022/568/de#annex_1/lvl_u1 (last accessed on 13.08.2023). If personal data is disclosed by us to a third country without an adequate level of data protection, then only in compliance with the guarantees pursuant to Art. 16 FADP new CH, in particular the use of standard data protection clauses recognized by the FDPIC. Further information on this from the FDPIC itself can be found here: https://www.edoeb.admin.ch/edoeb/de/home/datenschutz/arbeit_wirtschaft/datenuebermittlung_ausland.html (last accessed on 13.08.2023)

Alternatively, data may be disclosed to third countries with your express consent, for the performance of a contract or, for example, to protect overriding public interests (Art. 17 of the new Swiss Data Protection Act). The individual measures taken by us to ensure disclosure to third countries in accordance with the provisions of the new Swiss Data Protection Act are set out in the individual sections below.

Contact option for data protection questions

If you have any questions or comments about this privacy policy, please contact us by e-mail at contact@gold-trust.ch.