Privacy Notice

GULD.COM is operated by Reserva Europe AB, corporate registration number 559536-2806, registered in Sweden. We are the controller of the personal data described in this notice within the meaning of Regulation (EU) 2016/679 (GDPR).

Questions about this notice, or any request concerning your data, can be sent to privacy@guld.com.

• Account and contact details — your name, email address, telephone number, delivery and billing addresses, and, for business customers, company name and VAT number.
• Order and payment records — what you bought, when, at what price, in which currency, and the payment status returned by our payment provider. We do not store full card numbers.
• Identity-verification data — images of your government-issued identity document, a selfie or liveness video, date of birth, nationality, and the result of sanctions and politically-exposed-person screening. This is collected through Sumsub, which acts as our processor.
• Vault holdings — the metal held on your behalf, its allocation, and any delivery or release instruction you give.
• Site usage — pseudonymised analytics about how the site is used, collected only if you accept the measurement category in our consent tool.
• Technical records — server and application logs needed to operate the site securely, including IP address and request metadata.

Every processing operation rests on one of the following legal bases.

• Performance of a contract (Art. 6(1)(b) GDPR) — to create and maintain your account, take and fulfil your orders, arrange payment, provide vault storage, and handle delivery, release and support.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR) — identity verification, transaction monitoring and record-keeping required under anti-money-laundering law, and retention of accounting records under tax law.
• Consent (Art. 6(1)(a) GDPR) — analytics cookies and marketing communications. You can withdraw consent at any time, without affecting processing carried out before you withdrew it.
• Legitimate interests (Art. 6(1)(f) GDPR) — securing the platform, preventing and detecting fraud, and establishing or defending legal claims. We balance these against your rights and use the least intrusive means available.

Identity documents and biometric checks used in verification are processed to meet our statutory anti-money-laundering obligations. Without them we cannot lawfully complete your order.

We do not sell personal data. We share it only with processors acting on our documented instructions under a data-processing agreement concluded pursuant to Article 28 GDPR, and with public authorities where the law requires it — in particular reports of suspicious transactions under anti-money-laundering law.

Our current processors handle identity verification, payments, hosting and email delivery, and analytics. The full list, with the purpose, data categories and location for each, is published on our compliance page.

Our infrastructure is hosted in the European Union. Where a processor handles data outside the European Economic Area, the transfer is made under a safeguard permitted by Chapter V GDPR — an adequacy decision of the European Commission, or Standard Contractual Clauses supplemented where necessary by additional technical and organisational measures. You can request a copy of the relevant safeguard from privacy@guld.com.

• Identity-verification records and supporting documents are retained for the statutory 10-year anti-money-laundering period and then deleted.
• Account data is retained for as long as your account is open, and deleted when you close it, except where a statutory retention period requires us to keep part of it.
• Order and accounting records are retained for the period required by Swedish bookkeeping and tax law.
• Analytics data is pseudonymised and is deleted once it is no longer needed for the purpose it was collected for. The cookies that carry it expire after no more than 12 months.

Under the GDPR you have the following rights over your personal data.

• Access — to be told whether we process your data and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted, where we have no overriding legal obligation to retain it.
• Restriction — to have processing limited while a dispute about accuracy or lawfulness is resolved.
• Portability — to receive the data you provided to us in a structured, commonly used, machine-readable format.
• Objection — to object to processing based on our legitimate interests, and at any time to processing for direct marketing.
• Withdrawal of consent — to withdraw consent to analytics or marketing at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, write to privacy@guld.com. We may need to verify your identity before acting on a request. We respond within one month, and will tell you if we need longer.

If you believe we have handled your data unlawfully, we would like the chance to put it right. You also have the right to lodge a complaint with the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), or with the supervisory authority in the EU member state where you live or work.

We update this notice when our processing changes. The version published on this page is the one that applies.