Privacy Policy (GDPR)

We process personal data only to the extent necessary to provide services, fulfil contractual and statutory obligations, protect the company's rights and ensure the secure operation of the GOLDU online shop.

1. Introductory Provisions

1.1 Data controller

The controller of personal data is Baumann Group a.s. (GOLDU®)

1.2 Legal regulations

The controller processes personal data in particular in accordance with:

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),
Act No. 110/2019 Coll., on the processing of personal data,
Act No. 253/2008 Coll., on certain measures against the legalisation of proceeds of crime and the financing of terrorism,
other legal regulations of the Czech Republic and the European Union.

1.3 Data protection officer

The controller has not appointed a data protection officer, as this obligation does not arise under Article 37 of the GDPR.

2. What Personal Data We Process

The controller may process in particular the following personal data:

first name and surname,
date of birth,
residential address or delivery address,
telephone number,
e-mail address,
billing details,
bank details,
IP address,
data on orders and transactions,
communication with the customer,
data from identity documents to the extent required by law,
data necessary for the identification and control of the client under AML regulations,
camera recordings from the controller's premises for the purpose of protecting property and the safety of persons.

The provision of certain personal data is a statutory or contractual requirement. Without providing it, it may not be possible to conclude a contract, carry out a transaction, identify the client or fulfil statutory obligations.

3. Purposes of Processing Personal Data

3.1 Conclusion and performance of the contract

We process personal data for the purpose of processing the order, delivering the goods, issuing accounting documents, communicating with the customer, handling complaints and any execution of the buy-back.

3.2 Fulfilment of statutory obligations

We process personal data in particular to fulfil obligations under:

AML regulations,
accounting and tax regulations,
consumer protection legislation,
other legal regulations applicable to the controller's activities.

3.3 Verification of the client's identity

In cases stipulated by law, the client may be asked to undergo identification or verification of identity. The controller may in particular process:

data from an identity card or travel document,
information on the origin of funds,
information on the purpose and nature of the transaction,
data necessary to assess the riskiness of the transaction,
data necessary to check politically exposed persons (PEP),
data necessary for checking against sanctions lists,
other data required by law.

Copies of identity documents are made only in cases stipulated by law or where necessary to fulfil the controller's statutory obligations. Details of the AML check are provided in the AML Information for Clients.

3.4 Protection of property and security

The controller's premises may be monitored by a camera system with recording, for the purpose of:

protecting property,
protecting employees,
protecting clients,
preventing unlawful conduct,
protecting the controller's rights.

The monitored premises are marked with an appropriate information notice. Camera recordings may, in justified cases, be made available to public authorities or used to protect the controller's rights. The recordings are stored only for the time strictly necessary to achieve the purpose of their processing; in the event of a security incident, a damage event or a suspicion of unlawful conduct, they may be stored for a longer period necessary to protect the controller's rights or to hand them over to the relevant authorities.

3.5 Fraud prevention

The controller may also process personal data for the purpose of:

preventing fraudulent conduct,
protection against misuse of payment methods,
protecting the security of commercial transactions,
evaluating high-risk orders and suspicious transactions.

3.6 Marketing and commercial communications

On the basis of the data subject's consent or a legitimate interest in accordance with applicable law, the controller may send:

newsletters,
price alerts,
commercial offers,
information about GOLDU products and services.

The client may unsubscribe from commercial communications at any time. Where processing is based on consent, the client may withdraw consent at any time.

3.7 Operation of the website

The controller may process data through cookies and analytics tools for the purpose of:

the proper functioning of the website,
traffic analysis,
website security,
improving the user experience,
marketing activities.

Marketing and analytics cookies are used only on the basis of the user's consent, unless the law provides otherwise. More detailed information is provided in the separate Cookie Policy document.

4. Legal Basis for Processing

We process personal data on the basis of:

performance of the contract under Article 6(1)(b) of the GDPR,
compliance with a legal obligation under Article 6(1)(c) of the GDPR,
the controller's legitimate interest under Article 6(1)(f) of the GDPR,
the data subject's consent under Article 6(1)(a) of the GDPR.

The controller's legitimate interest may in particular be the protection of the controller's rights and property, fraud prevention, ensuring the security of commercial transactions, conducting ordinary business communication and protecting the secure operation of the online shop.

5. Retention Period of Personal Data

We store personal data only for the time necessary to achieve the purpose of their processing or for the period stipulated by law:

Accounting and tax documents: 10 years
AML identification and checks: 10 years from the execution of the transaction or termination of the business relationship
Orders and contractual documentation: 5 years, or longer to protect the controller's rights
Marketing data: until consent is withdrawn, unsubscription or an objection is raised
Camera recordings: usually a maximum of 72 hours
E-mail communication: depending on the nature of the communication, usually 3 years

In justified cases, data may be stored for the time strictly necessary to protect the rights and legitimate interests of the controller or to fulfil legal obligations.

6. Recipients of Personal Data

Personal data may be transferred only to the necessary extent to the following recipients or categories of recipients:

providers of IT services and hosting,
the operator of the e-shop solution and related technical services,
carriers and logistics partners,
accounting, tax and legal advisors,
payment service providers,
providers of AML and compliance services,
providers of identity verification services,
providers of marketing and analytics tools, where there is a legal basis,
public authorities, where required by law.

Personal data is not sold to third parties.

7. Transfer of Data to Third Countries

The controller does not ordinarily transfer personal data outside the European Union or the European Economic Area. Should a transfer of personal data to a third country occur, it takes place solely in accordance with the GDPR and using appropriate safeguards.

8. Cookies

The GOLDU website uses technical, analytics and marketing cookies. Cookies serve in particular to:

ensure the proper functioning of the website,
measure traffic,
analyse user behaviour,
personalise advertising,
secure the website.

Technical cookies may be used without consent where they are necessary for the proper functioning of the website. Analytics and marketing cookies are used only on the basis of the user's consent, unless the law provides otherwise. More detailed information on the use of cookies is provided in the separate Cookie Policy document.

9. Security of Personal Data

The controller has adopted appropriate technical and organisational measures to secure personal data. GOLDU places the utmost emphasis on protecting clients' privacy, the security of commercial transactions and the discreet handling of personal data. Access to personal data is granted only to persons who need it to perform their employment or contractual duties, to the extent necessary for the given purpose.

10. Rights of the Data Subject

The client has in particular the following rights:

the right of access to personal data,
the right to rectification of inaccurate data,
the right to erasure of personal data,
the right to restriction of processing,
the right to data portability,
the right to object to processing,
the right to object to direct marketing,
the right to withdraw consent at any time,
the right not to be subject to automated individual decision-making under Article 22 of the GDPR,
the right to lodge a complaint with the Office for Personal Data Protection.

The exercise of certain rights may be limited where the controller is obliged to further process or store personal data under legal regulations, in particular accounting, tax or AML regulations. The client may exercise their rights via the contact details.

11. Right to Lodge a Complaint

The client has the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Web: www.uoou.gov.cz

12. Automated Decision-Making and Profiling

The controller does not carry out automated individual decision-making or profiling that would have legal or similarly significant effects on the data subject.

13. Related Documents

This Privacy Policy forms part of the contractual and information framework of Baumann Group a.s. and the GOLDU® brand. Related documents are in particular:

General Terms and Conditions,
Delivery and Payment Terms,
Buy-back Conditions,
AML Information for Clients,
Cookie Policy,
Notice of risks associated with investing in precious metals.

14. Final Provisions

14.1 Updating of the document

This Privacy Policy may be updated on an ongoing basis.

14.2 Current version of the document

The current version is always available on the GOLDU website.

14.3 Governing law and language

This Privacy Policy is governed by the law of the Czech Republic. The governing language of this document is Czech; in the event of any discrepancy between language versions, the Czech version prevails.

14.4 Effectiveness of the document

This Privacy Policy takes effect on 28 May 2026.

15. Company Identification

Baumann Group a.s. (GOLDU®)

Registered office: Vyskočilova 1481/4, 140 00 Prague 4, Czech Republic
Company ID (IČO): 22263284
VAT ID (DIČ): CZ22263284
Commercial Register entry: Municipal Court in Prague, Section B, File 29197
Czech Assay Office – registration number: 15961
Web: www.goldu.cz
Data box: xtps2mn
E-mail: info@goldu.eu
Phone: +420 601 359 200