Privacy information.

This privacy notice explains how personal data is processed when visitors access and use GoldAutoTradePRO.

1. Controller

Christopher Grün
Lessingstraße 13
74226 Nordheim
Germany
Email: [email protected]

2. Hosting and delivery through Cloudflare

This website is delivered through Cloudflare Pages. The provider is Cloudflare, Inc., USA. Cloudflare provides the technical delivery, security and optimisation of the website. Technically required connection and access data may be processed, including the IP address, date and time of access, requested resource, browser and device information, referrer and security-related event data.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient delivery of the website. Cloudflare may also process data outside the European Economic Area. According to Cloudflare, transfers to the United States are supported by the EU-US Data Privacy Framework and, additionally, Standard Contractual Clauses. Further information: Cloudflare Privacy Policy.

3. Server and security data

Technically necessary log data is processed only for as long as required to deliver the website, diagnose errors, prevent abuse and protect the service. Longer retention takes place only where necessary to investigate specific security incidents or comply with legal obligations.

4. Contact by email

When you contact us through [email protected], [email protected] or [email protected], we process the transmitted information, including the sender address, subject, message content and technical metadata, in order to respond.

The business domain mailboxes are provided through IONOS. The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Messages are not forwarded to a private Gmail inbox. Further information: IONOS Privacy Information.

The legal basis is Article 6(1)(b) GDPR where the communication relates to steps prior to entering into a contract or the performance of a contract. General enquiries are processed under Article 6(1)(f) GDPR; our legitimate interest is the handling and documentation of communications.

5. Contact form

When the contact form on the product page is submitted, the entered information is transmitted over an encrypted connection to a server-side Cloudflare Worker function. Required fields are validated and the request is forwarded for processing. A transactional acknowledgement may be sent through Brevo. Technical plausibility checks and Cloudflare Turnstile are used to reduce abuse.

Turnstile evaluates technical signals to determine whether a request is likely to originate from a human visitor. Cloudflare may process the IP address, browser and device information, interaction and security data, and a short-lived verification token. The token is validated server-side through Cloudflare Siteverify and can be used only once within a limited period. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the publicly accessible form against automated abuse and spam. Further information: Cloudflare Privacy Policy.

The data processed includes the name, email address, voluntary message content, language and submission time. Article 6(1)(b) GDPR applies where the request relates to steps prior to entering into a contract; otherwise Article 6(1)(f) GDPR applies on the basis of our legitimate interest in structured request handling and abuse prevention.

6. Order, payment and license management

When an order is placed, the order and status data required for contract performance, payment, invoicing, license term and delivery are processed server-side. This includes in particular the name, email address, billing address, selected term, payment provider, and payment, license and delivery status. Website and commerce processing uses the deployed Cloudflare services, including Workers, D1 and – for protected customer files – R2.

Depending on the selected payment method, payment processing is handled through Stripe or PayPal. GoldAutoTradePRO stores provider references and payment status needed for processing, but does not store full card details or PayPal login credentials.

For technical assignment of a paid GoldAutoTradePRO license, the data required for licensing, in particular the NinjaTrader account email, Product ID 2131 and the required license period and status, is processed through the NinjaTrader Vendor/Ecosystem licensing interface. Transactional emails may also be sent through Brevo for contract processing; this involves transmitting the recipient name, email address and the order, contract, payment, license and delivery parameters required for the particular message.

Processing required for the order, payment, license activation and delivery is based on Article 6(1)(b) GDPR. Where statutory invoicing, tax or evidence obligations apply, Article 6(1)(c) GDPR also applies.

For withdrawal or cancellation declarations, we also process the information required to identify and handle the request and internal review/evidence data, such as receipt time, request type, requested end date, any voluntary reason, review status, applicable deadlines where relevant, documented decisions, and references to payment or license actions actually carried out. This processing supports contract administration, compliance with applicable legal obligations and, where necessary, the documentation, establishment, exercise or defence of legal claims under Article 6(1)(b), (c) and/or (f) GDPR according to the relevant purpose.

7. Cookies, analytics and tracking

GoldAutoTradePRO currently does not use its own analytics, advertising or tracking cookies. No web analytics or marketing service is integrated. In individual cases, Cloudflare may use technically necessary cookies or comparable security mechanisms where required for protection and delivery functions.

8. Retention and deletion criteria

We do not retain personal data for one blanket period. Data is kept only for as long as required for the relevant purpose, applicable statutory retention or evidence duties, the handling of open matters, or the establishment, exercise or defence of legal claims. Afterwards, data is deleted or, where continued retention is required, restricted from operational use or reduced to the evidence that is still necessary.

For enquiries and business correspondence, operational use generally ends when the matter has been completed; continued retention takes place only where statutory obligations, unresolved contractual matters or possible legal claims require it. Order, payment, contract, invoice, consent and legal-case data is retained in line with the applicable statutory retention and evidence requirements or until the specific evidence purpose no longer applies. Pure licence, delivery and download data is no longer required for operational use once access has ended and provider reconciliation has been completed, unless it forms part of a required contractual or security record.

For free trial and Courtesy access, operational activation, delivery and licence data is reduced to the still necessary scope after the access has ended and technical reconciliation has been completed. A minimal record used to enforce the one-trial rule may remain for as long as that rule is actually applied or where a concrete abuse, security or legal evidence purpose requires it. Normalised email addresses or derived check values remain personal data where re-identification or attribution is still possible.

Referral, commission and payout data is processed only for as long as required to operate the programme, settle outstanding payouts, meet accounting, tax or commercial-law evidence duties, or address specific legal claims. Full bank-account details are not retained once they are no longer required for payout processing or necessary evidence.

Technical security, audit and error logs are purpose-limited and periodically reviewed for necessity. Extended retention is limited to specific security incidents, suspected abuse, provider reconciliation, open legal matters or statutory duties. Data-subject requests and deletion decisions are documented only with the metadata required to demonstrate fulfilment and accountability. A documented legal hold may temporarily suspend deletion; affected data is then not used for unrelated operational purposes.

9. Recipients and international processing

Recipients of personal data may include – only to the extent required for the specific purpose – Cloudflare (hosting, Workers, D1/R2, security and form functions), IONOS (business email mailboxes), Brevo (transactional email delivery), Stripe or PayPal (payment processing), and NinjaTrader/Ecosystem (product and license assignment). Depending on the particular processing, these providers may act as processors or as independent controllers.

Where a provider processes personal data outside the European Economic Area, the transfer is made in accordance with the applicable legal requirements, in particular on the basis of an adequacy decision, the EU-US Data Privacy Framework where the recipient is appropriately certified, or suitable Standard Contractual Clauses or comparable recognised safeguards. Other disclosures are made only where required by law, necessary to establish, exercise or defend legal claims, or otherwise legally permitted.

10. Data subject rights

Subject to the GDPR, individuals have rights including access, rectification, erasure, restriction of processing, data portability and objection. Consent may be withdrawn at any time with effect for the future. Requests can be sent to [email protected].

11. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. In Baden-Württemberg, the competent authority is in particular the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

12. Status

Last updated: 11 September 2026. This notice will be updated when the services or processing flows actually used change materially.