We take the protection of your personal data very seriously. This Privacy Policy informs you about the processing of your personal data under the GDPR (EU), the revised Swiss Data Protection Act (revFADP) and other applicable data protection laws.
As of: 30. May 2026 | Version 2.0 | Controller: Winify AG
The controller within the meaning of the GDPR and the revised Swiss Data Protection Act for the processing of personal data on this platform is:
Winify AG
Churerstrasse 65b
8808 Pfaeffikon SZ
Switzerland
UID CHE-495.341.743
Website: www.goldkurs.ch
Email: privacy@goldkurs.ch
Privacy requests: privacy@goldkurs.ch
For all privacy-related enquiries, access requests or the exercise of your rights, please contact us directly at: privacy@goldkurs.ch
We process personal data only within the framework of legal requirements. Processing is based on the following legal bases (Art. 6 GDPR):
We collect only the data necessary for the respective purpose (data minimisation, Art. 5(1)(c) GDPR).
| Data category | data | Purpose | Legal basis |
|---|---|---|---|
| Identification | Email address, automatically generated username | Account creation, login, communication | Art. 6 Abs. 1 lit. b DSGVO |
| Security | Password hash (bcrypt, not plain text) | Authentication | Art. 6 Abs. 1 lit. b DSGVO |
| Profile (optional) | First name, last name, country, preferred language | Platform personalisation | Art. 6 Abs. 1 lit. b DSGVO |
| Settings | Preferred currency (EUR/CHF), language | Price display, localisation | Art. 6 Abs. 1 lit. f DSGVO |
| Data category | data | Purpose |
|---|---|---|
| Access data | IP address, browser type, operating system, referrer URL, access time | Security, error analysis, geolocation for currency recognition |
| Session data | Session ID, login timestamp, last login | Authentication, Security |
| Portfolio data | Entered precious-metal holdings, purchase prices, quantities | Portfolio tracking function |
| AI chat data | Inputs in the AI assistant, responses, timestamps | Commission of the AI service, quota management |
| Data category | data | Purpose |
|---|---|---|
| Subscription | Plan key, status, start/end date, trial information | Subscription management, access control |
| Stripe reference | Stripe customer ID, subscription ID (no payment data) | Payment processing via Stripe |
| Invoices | Invoice amount, date, status | Accounting (statutory retention obligation of 10 years) |
Users of Pro Team and Institutional plans may invite team members and clients. Email addresses of invitees are processed and invitation tokens are generated. Invited persons are informed about data processing before accepting the invitation.
Marketing emails are sent only with the user’s explicit consent (double opt-in). Consent can be withdrawn at any time (unsubscribe link in every email or by email to privacy@goldkurs.ch).
Payment processing is carried out exclusively via Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA). GoldKurs.ch stores no credit card numbers, bank details or other payment method information. These are processed directly by Stripe.
Stripe is a certified PCI-DSS Level 1 provider. During payment processing, your data is transmitted to Stripe, which is responsible for secure processing. Stripe’s privacy policy applies: stripe.com/de/privacy
From Stripe we receive only:
Legal basis for transmission to Stripe: Art. 6(1)(b) GDPR (performance of contract) in conjunction with Art. 49(1)(b) GDPR (US data transfer necessary for contract performance). Stripe contractually undertakes to process data in compliance with data-protection law through EU Standard Contractual Clauses (SCCs).
GoldKurs.ch uses technically necessary cookies and session cookies that are essential for operating the platform. These cookies cannot be disabled without impairing the platform’s functionality.
| Cookie | Purpose | Billing cycle |
|---|---|---|
| PHPSESSID | Session management, authentication | Session (until browser is closed) |
| currency | Storage of preferred currency (EUR/CHF) | 1 year |
GoldKurs.ch currently uses no third-party analytics tracking tools (such as Google Analytics, Facebook Pixel, etc.). Access data is stored exclusively in server-side log files and deleted after 30 days.
The platform uses Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) as CDN and DDoS protection. Cloudflare processes IP addresses as a processor for security and performance purposes. Cloudflare’s privacy policy applies: cloudflare.com/privacypolicy. Transmission is based on EU Standard Contractual Clauses.
GoldKurs.ch processes market, macro and price data server-side. Users generally do not establish a direct connection to market data providers; display takes place through our platform and may be delayed, cached or model-compressed.
| Recipient/category | Purpose | Note |
|---|---|---|
| Market and macro data providers | Commission of price, index and economic data | Server-side processing; no direct client connection |
| ip-api.com | IP geolocation for currency recognition | See §7; country/currency only, no permanent plain-text IP storage |
| Cloudflare CDN | Security, performance and delivery of static resources | Possible IP transmission to Cloudflare |
| Stripe | Payment processing | See §4 |
| AI service providers | Processing of AI requests | See §8; do not enter sensitive data in chat |
Market data is generally processed server-side by GoldKurs.ch and delivered to you. Your IP address is generally not passed directly to market data providers.
GoldKurs.ch automatically determines your approximate location from your IP address for currency display (EUR or CHF). In this process:
Geolocation serves exclusively currency display (CHF for Swiss users, EUR for all others) and is not a tracking measure. You can change the currency manually at any time using the EUR/CHF switch on the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correct price display).
When you use the AI assistant, the following data is processed:
Chat messages are stored to provide the service and manage the monthly message quota. Chat history is visible in your account. Messages are automatically deleted after 12 months automatically.
The AI assistant is based on a language model. Your inputs may be transmitted to external AI providers for processing. Details will be added for the specific implementation. Please do not enter sensitive personal data (account data, passwords, etc.) in the AI chat.
| Data category | Retention period | Reason |
|---|---|---|
| Account data (active) | Until account deletion | Performance of contract |
| Account data (after cancellation) | 30 days after cancellation | Restoration upon request, then deletion |
| Invoice and accounting data | 10 years | Statutory retention obligation (CO/HGB) |
| Server logs (IP addresses) | 30 days | Security, error analysis |
| IP geo cache | 7 days | Performance optimisation for currency recognition |
| AI chat history | 12 months | Service provision, quota tracking |
| Team invitations (expired) | 30 days after expiry | Then automatically deleted |
| Newsletter consents | Until withdrawal + 3 years | Proof of consent |
We generally do not disclose your data to third parties unless:
Disclosure to third parties for advertising purposes does not.
Some of our service providers are based in the USA (Stripe, Cloudflare, possibly AI providers). Transfers to the USA are based on:
For Swiss users, transfers to the USA are based on Switzerland’s adequacy decision or appropriate safeguards under the revised FADP.
You have the following rights with respect to your personal data:
| Right | Description | Legal basis |
|---|---|---|
| Access | What data we have stored about you | Art. 15 DSGVO / Art. 25 revDSG |
| Rectification | Correction of inaccurate data | Art. 16 DSGVO |
| Deletion | Deletion of your data (where no retention obligation applies) | Art. 17 DSGVO |
| Restriction | Restriction of processing | Art. 18 DSGVO |
| Data portability | Export of your data in machine-readable format | Art. 20 DSGVO |
| Objection | Objection to processing based on legitimate interest | Art. 21 DSGVO |
| Withdrawal | Withdrawal of consent (e.g. newsletter) | Art. 7 Abs. 3 DSGVO |
| Complaint | Complaint with a supervisory authority | Art. 77 DSGVO |
To exercise your rights, please contact us by email at: privacy@goldkurs.ch. We respond to requests within 30 days.
GoldKurs.ch uses the following technical and organisational measures (TOMs) to protect your data:
In the event of a data breach that results in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and affected users without undue delay (Art. 33/34 GDPR).
GoldKurs.ch is directed at persons aged 18 and over. We do not knowingly collect personal data from persons under 18. If you become aware that a minor has created an account with us, please inform us at privacy@goldkurs.ch.
This Privacy Policy may be updated at any time to reflect changes to our services, legal requirements or new data protection practices. In the event of material changes, we will inform registered users by email. The date of the last update is stated at the beginning of this policy. The current version is always available on this page.
Questions about privacy? Write to us at any time at: privacy@goldkurs.ch – we respond within 48 hours.