GoldAlps
PLContact

Documents

GoldAlps Privacy Policy

How GoldAlps processes the personal data of people using the website, the contact form and the free materials.

Last updated: 14 September 2026

1. Data controller

The controller of personal data processed through the GoldAlps website, available at https://goldalps.com, is:

Rafał Petrykowski
Zawidzkiego 10/6
32-600 Oświęcim
Poland

For any matter concerning privacy and personal data: contact@goldalps.com

In the remainder of this document the controller is referred to as “GoldAlps” or “the Controller”.

2. Scope of this policy

This Privacy Policy describes how personal data is processed for people using the GoldAlps website, in particular those who:

  • use the website,
  • get in touch through the contact form,
  • download free materials, including the e-book,
  • give consent for analytics or marketing tools,
  • contact GoldAlps in connection with an offer, the storage of precious metals or other services.

3. Data we may process

Data provided directly:

  • full name or first name,
  • email address,
  • telephone number,
  • country,
  • message content,
  • data provided voluntarily in subsequent correspondence.

Technical and usage data:

  • IP address,
  • browser and device type,
  • user agent,
  • pages visited,
  • referrer,
  • time and manner of use,
  • UTM parameters,
  • first-touch and last-touch source,
  • technical identifiers of analytics and advertising tools, once the relevant consent has been given.

In the case of Meta this may include fbp and fbc. In the case of Google Analytics, identifiers relating to the session and to use of the website.

4. Contact form

Data from the contact form is processed in order to:

  • respond to an enquiry,
  • conduct correspondence,
  • provide information about services,
  • prepare for a conversation or consultation.

The legal basis may be:

  • steps taken at the request of the data subject prior to entering into a contract,
  • the legitimate interest of the Controller in handling correspondence and enquiries,
  • consent, where required.

Providing data is voluntary, but the data marked as required is necessary in order to handle the enquiry.

5. Free e-book

In order to provide the e-book we may process:

  • first name,
  • email address,
  • source and referrer,
  • UTM parameters,
  • technical data from the form.

Purposes:

  • handling the request,
  • providing the e-book,
  • sending information relating to the download,
  • form security.

Downloading the e-book does not in itself constitute consent to future marketing, unless the user gives separate, explicit consent.

6. Lead storage and CRM

Data from the forms is first stored in the GoldAlps WordPress-based system as private records that are not publicly accessible.

The data may then be transferred to HubSpot CRM.

The CRM may hold, among other things:

  • contact details,
  • language,
  • source,
  • campaign information,
  • the originating form,
  • the date the contact was created.

HubSpot may process data outside the EEA in accordance with the applicable legal mechanisms and the provider’s documentation.

7. Google Analytics 4

GA4 is used to analyse:

  • visits,
  • traffic sources,
  • pages,
  • interactions with forms,
  • use of materials.

GA4 is loaded only after analytics consent has been given.

In our configuration we do not send to GA4:

  • first name,
  • surname,
  • email address,
  • telephone number,
  • message content.

The legal basis is the user’s consent. Consent can be changed through “Cookie settings”.

8. Meta Pixel and Conversions API

Once marketing consent has been given, GoldAlps may use:

  • Meta Pixel,
  • Meta Conversions API.

The following may be processed:

  • IP address,
  • browser data,
  • URL,
  • fbp,
  • fbc,
  • event_id,
  • on the server side, contact details transformed using a cryptographic hash function, where they are used to match an event.

The legal basis is marketing consent.

9. Cookies and similar technologies

Categories:

  • Necessary — operation of the site, security, storing the privacy preference, forms.
  • Analytics — GA4; only after consent.
  • Marketing — Meta; only after consent.

The user may:

  • accept all,
  • reject the optional categories,
  • customise the selection,
  • change the decision later.

Rejecting analytics and marketing does not block the core functions of the site.

10. Traffic source data

GoldAlps records UTM parameters and first-touch and last-touch source in order to:

  • assess campaign effectiveness,
  • establish the source of an enquiry,
  • improve marketing activity,
  • report on it.

We do not use this data for decisions producing legal effects concerning the user, or similarly significant effects, based solely on automated processing.

11. Security

We may process the IP address, submission time and request identifiers in order to counter spam and abuse.

The measures we apply include:

  • rate limiting,
  • a honeypot field,
  • duplicate detection,
  • server-side validation.

The legal basis is the legitimate interest of the Controller in the security of the website.

12. Recipients of the data

Data may be entrusted to, among others:

  • the WordPress hosting provider,
  • the frontend hosting provider,
  • HubSpot,
  • Google,
  • Meta Platforms,
  • the email provider,
  • the Redis/KV provider,
  • IT and maintenance providers,
  • Auvesta Edelmetalle AG — where necessary to carry out the purchase process, to conclude and perform a contract, or to service the products and services chosen by the client.

Only to the extent necessary to deliver the services.

12a. Cooperation with Auvesta Edelmetalle AG

Rafał Petrykowski cooperates with Auvesta Edelmetalle AG in the area of products and services relating to precious metals.

Data submitted through the GoldAlps forms may be stored and processed in the CRM system used within this cooperation. This applies in particular to data submitted through the contact form and through the form for receiving the free educational material.

This data may be used to handle the enquiry, arrange contact, provide the requested material and conduct further communication relating to an interest in the offer.

Should a client decide to purchase products or use services delivered by Auvesta, the data necessary to carry out the sales process and to conclude and perform the contract is also processed by:

Auvesta Edelmetalle AG
Industriestr. 4
D-83607 Holzkirchen
Germany

To the extent that Auvesta Edelmetalle AG independently determines the purposes and means of processing data relating to the conclusion and performance of the contract, the purchase or sale of precious metals, storage, settlements and legal obligations, it acts as a separate controller of personal data.

13. Transfers outside the EEA

Some providers may process data outside the EEA, in particular in the United States.

Transfers take place using the appropriate legal mechanisms, depending on the provider, including:

  • adequacy decisions,
  • the EU–US Data Privacy Framework,
  • the European Commission’s standard contractual clauses.

14. Retention periods

  • contact form / lead: as a rule 24 months from the last contact or material activity;
  • e-book lead with no further contact: as a rule 12 months from the last activity;
  • where an e-book lead develops into a commercial relationship — the retention applicable to that relationship;
  • HubSpot and the WordPress lead store: the same rules;
  • GA4 user- and event-level data: 14 months;
  • technical security data: as a rule no longer than 30 days, unless needed to investigate an incident;
  • consent records: for as long as needed to demonstrate compliance and to defend against claims.

Where a contract, a legal obligation or the need to secure claims arises, retention may be longer in accordance with the applicable law.

After the applicable period the data is deleted or anonymised, unless another legal basis for further storage exists.

15. Your rights

To the extent provided by law, the user has the right to:

  • access,
  • rectification,
  • erasure,
  • restriction of processing,
  • data portability,
  • object,
  • withdraw consent,
  • lodge a complaint with the competent supervisory authority.

In Poland the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

16. Whether providing data is required

Providing data is voluntary, but some data is required in order to:

  • respond to an enquiry,
  • provide and send the e-book,
  • deliver a given function of the website.

17. Automated decision-making

GoldAlps does not use data from the forms for decisions based solely on automated processing that would produce legal effects concerning the user or similarly significantly affect them.

18. Changes to this policy

This policy may be updated to reflect changes in:

  • the law,
  • how the website works,
  • providers,
  • services.

The current version is published on the GoldAlps website together with the date of the last update.