Skip to main content
philoro

+43 (0) 505 79 1000

Privacy Policy

Here, you can adjust the settings you have made in our Cookie Consent Tool:

1. Declaration on the Duty to Inform

1.1. General

The website and the online store contained therein are operated by philoro EDELMETALLE GmbH (contact details can be found below). We are committed to full compliance with data protection regulations. Your data will therefore be processed, in particular, in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the Data Protection Act (DSG), and the Telecommunications Act 2021 (TKG 2021). Our employees are obliged to comply with data protection regulations and to maintain the highest level of discretion as an inherent customer interest. In this Privacy Policy, we inform you about the most important aspects of data processing in the context of our online presence:

1.2. Purposes of Data Processing on the Website

We process your personal data (date and time of access, the page/URL accessed, browser type and version, the operating system used and the referrer URL) for the following purposes:

  • to provide and continuously improve and develop this website,

  • to generate usage statistics, and

  • to detect, prevent and investigate attacks on our website.

The legal basis for processing your personal data is our overriding legitimate interest (Article 6 (1) (f) GDPR), which consists in ensuring the technical functionality, stability and security of the website, identifying and rectifying errors and analyzing the use of the website. Your data will be stored for 30 days from the date of your visit to our website.

1.3. Purchase and Sale of Precious Metals

Through our online store, you have the option to purchase precious metals from us or sell them to us. For contacting you and processing purchase contracts, we require the following information: first and last name, date of birth, telephone number, mailing address, email address and your bank details. Data processing is carried out on the legal basis of Article 6 (1) (c) GDPR (contractual or pre-contractual measures). If the purchase process is aborted, the data stored by us will be deleted. In the event of a contract being concluded, all data from the contractual relationship will be stored for the legally required business and tax retention period (7 years). Additionally, your name, address, purchased goods and purchase date will be stored until the end of the product liability period (10 years).

Please note that, for the purpose of simplifying the purchase process and enabling subsequent contract processing, the IP data of the connection owner as well as the data provided by you, specifically your name, email address and mailing address, are stored in cookies. The legal basis for processing this personal data is our overriding legitimate interest (Article 6 (1) (f) GDPR), which consists in making the purchase process more convenient for you by temporarily storing your selection in the virtual shopping cart for the duration of your visit and for subsequent page visits.

1.4. User Profile in the Online Store

In the philoro online store, you can place orders as a guest or create a personal user profile (customer account). In your user profile, you can save your first and last name, email address (= username), your mailing address, telephone number and a password of your choice for future orders. You can update your information at any time after logging in. After registration, you will receive an email with a link that you must click to activate your user profile. Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR (your consent). You have the right to withdraw this consent at any time and delete your user profile. Your data will be stored until you withdraw your consent or delete your user profile.

For authentication when logging into your customer account, we use the Google Identity Platform provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In this process, customer data (e.g. email address, password hashes, telephone number and login information) is processed and transmitted to the service provider engaged by us. The legal basis for processing this personal data is our overriding legitimate interest (Article 6 (1) (f) GDPR), which consists in ensuring secure, reliable and seamless authentication when logging into your customer account.

1.5. Contacting Us

If you contact us via the form on our website or by email, the data you provide (salutation, first and last name and email address are required fields when contacting us via the website; title and telephone number may be provided voluntarily) will be processed by us for the purpose of handling your request and any follow-up questions. Data processing is carried out on the legal basis of Article 6 (1) (f) GDPR (legitimate interest). Our legitimate interest consists in responding to your request and any follow-up questions. Your data will be stored by us for six months after receipt of your request.

1.6. Online Appointment Booking / Appointment Confirmation / Appointment Reminder / Appointment Cancellation

We use the technologies of eTermin GmbH (“eTermin”) to provide a simple appointment booking process for in-person consultations at your local branch or telephone consultations. The service provider is: eTermin GmbH, Im Wiesengrund 8, 8304 Wallisellen, Switzerland. When you fill out the appointment form, this data will be processed by eTermin exclusively for the purpose of scheduling an appointment and sending appointment-related information (e.g. appointment confirmation, appointment reminder) and automatically transmitted to us via encrypted connections. After booking an appointment, we will send you a confirmation email to the email address provided and, if requested, an appointment reminder. Data processing is carried out on the legal basis of Article 6 (1) (f) GDPR (legitimate interest). Our legitimate interest consists in the efficient handling of appointment bookings, appointment confirmations and, where applicable, appointment cancellations. Data processing for appointment reminders is carried out on the legal basis of Article 6 (1) (a) GDPR (your consent). You have the right to withdraw this consent at any time. The data is stored and processed solely for the purpose of handling appointments. The transfer of data to eTermin constitutes a transfer of data to a third country (Switzerland) and is based on the adequacy decision for Switzerland adopted by the European Commission (Article 45 GDPR). eTermin does not disclose this data to third parties for advertising or other commercial purposes.

Your data will be deleted as follows:

  • Retention period for appointment records after the appointment: 1 day

  • Retention period for contact information after the last booked appointment: 14 days

1.7. Newsletter

We also offer the option to subscribe to a newsletter. The newsletter provides information about our products and topics related to our business activities (e.g. event invitations, company news). To subscribe to the newsletter, only an email address is required (no names or other personal data are required when registering). The subscription process follows a “double opt-in” procedure. This means that, after registering on our website, you will receive a confirmation email containing a link. You will only be registered for the newsletter once you click this link. The newsletter is sent on the legal basis of Article 6 (1) (a) GDPR (your consent). You can unsubscribe from the newsletter at any time by telephone or electronically (contact details can be found below). Each newsletter also gives you the option of unsubscribing by clicking a link. Withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. Subscribing and unsubscribing are, of course, free of charge.

We use the service provided by Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, to send the newsletter. Your data will be stored until you withdraw your consent.

1.8. Website Content Management

For our website, we use the Headless Content Management System provided by Storyblok GmbH, Peter-Behrens-Platz 2, 4020 Linz, Austria. In particular, the images contained on our website are hosted and provided via the systems of this provider. In this process, your IP address is transmitted to Storyblok and retained there for up to seven days due to the way the system operates. Data processing is carried out on the legal basis of Article 6 (1) (f) GDPR (legitimate interest). Our legitimate interest consists in ensuring the technically error-free, stable and secure provision and optimized delivery of the content of our website and in ensuring IT security.

2. Cookies

Our website uses so-called cookies. These are small text files stored on your device through your browser. These cookies do not cause any harm. We use cookies to make our services more user-friendly. Cookies are used to facilitate navigation on our website, to enable you to return to the point where you left off during your last visit and to store your preferences and settings. Cookies also allow us to recognize your browser upon your next visit.

Cookies cannot access, modify or read any other files on your device. Most of the cookies used on this website are so-called session cookies. These are automatically deleted when you leave our website. Some cookies remain stored on your device until you delete them or until their storage period expires.

If you generally do not wish to allow cookies, you can configure your browser to notify you before a cookie is set and allow cookies only on a case-by-case basis. Disabling cookies may limit the functionality of our website.

The processing of personal data when using cookies is carried out on the following legal bases:

  • Technically necessary cookies are generally processed on the basis of an overriding legitimate interest pursuant to Article 6 (1) (f) GDPR. Details of our specific legitimate interest can be found in our Cookie Settings.

  • Cookies that are not technically necessary are processed on the basis of your explicit consent pursuant to Article 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021.

Details of which cookies are used in each case, for what purposes and for how long they are stored can be found in our Cookie Settings.

2.1. Instructions for deleting cookies in popular browsers can be found here:

Microsoft Internet Explorer: Instructions

Mozilla Firefox: Instructions

Google Chrome: Instructions

Apple Safari: Instructions

Opera: Instructions

3. Web Analytics

3.1. Google Analytics

Our website uses functions of the web analytics service Google Analytics (Google LLC, Gordon House, St. Dublin 4, Ireland). Cookies are used for this purpose to enable analysis of how users use the website. When the cookies are used, your IP address (user data) is collected but immediately pseudonymized. This means that only approximate localization is possible. The information generated in this way is transmitted to and stored on the provider’s servers. Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021 (your consent). You can prevent the use of these cookies by configuring your browser so that no cookies are stored or by not consenting to the use of these cookies. We have entered into an appropriate agreement with the provider regarding data processing on our behalf. User data is retained for a period of 14 months. Information on possible transfers of data to third countries is provided in Section 4.

3.2. Hotjar

We use Hotjar, provided by Content Square SAS, 7 rue de Madrid, 75008 Paris, France, to better understand our users’ needs and to optimize the experience and offerings on this website. Hotjar’s technology helps us gain a better understanding of our users’ experiences (e.g. how much time users spend on particular pages, which links they click, what they like and dislike, etc.), which helps us tailor our services in line with user feedback. Hotjar uses cookies and other technologies to collect data about the behavior of our users and their devices, in particular the device’s IP address (which is collected and stored only in anonymized form during your use of the website), screen size, device type (unique device identifiers), information about the browser used, location (country only) and preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually prohibited from selling the data collected on our behalf. Further information can be found in the “About Hotjar” section on Hotjar’s Help Page.

Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021 (your consent). You can prevent the use of these cookies by configuring your browser so that no cookies are stored or by not consenting to the use of these cookies. User data is retained for a period of 12 months. Information on possible transfers of data to third countries is provided in Section 4.

3.3. Google Remarketing

Our website uses the Remarketing function provided by Google LLC (Google LLC, Gordon House, St. Dublin 4, Ireland). This function is used to display specific advertisements to visitors to our website within the Google advertising network. For this purpose, your browser stores cookies on your device. If you do not wish to use Google Remarketing, you can disable it (www.google.com/settings/ads).

Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021 (your consent). You can prevent the use of these cookies by configuring your browser so that no cookies are stored or by not consenting to the use of these cookies. User and event data is retained for a period of 14 months. Information on possible transfers of data to third countries is provided in Section 4.

3.4. Google Maps

We use the Google Maps API service on our website. This service is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. By integrating this service into our website, at least the following data is transmitted to Google LLC: IP address, time of the website visit, the visitor’s screen resolution, website URL (referrer), browser identifier (user agent) and search terms. The data transfer takes place regardless of whether you have a Google user account through which you are logged in or whether you do not have a user account. If you are logged in, this data will be assigned directly to your account. If you do not wish the data to be associated with your profile, you must log out before activating the button (and therefore before giving your consent). Google LLC stores this data as user profiles and uses it for advertising, market research and/or the customized design of its website. You have the right to object to the creation of these user profiles, whereby you must contact Google LLC to exercise this right.

Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021 (your consent). Information on possible transfers of data to third countries is provided in Section 4. Further information on the purpose and scope of data collection and processing by Google LLC can be found at https://policies.google.com/privacy.

3.5. Online Social Media Presence

3.5.1. Integration of Social Media Icons on Our Website

Our website contains icons from social media providers (Facebook, Instagram, YouTube and LinkedIn). We use these icons solely as passive links to the respective providers’ websites. We do not use any social media plug-ins on our website that would result in data being transmitted directly to social media providers. By clicking the relevant “social media button”, you will be redirected to the website of the respective social media provider. Only when you actively access the respective provider’s website will that provider receive information about you, such as your IP address. If you do not click the “social media buttons”, no data will be exchanged. Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR (your consent). Further information on data processing by the platform provider and your corresponding rights can be found in the privacy policy of the respective provider (see Section 3.5.2). [A1.1]

3.5.2. Our Social Media Channels

We operate the following publicly accessible social media channels:

Responsibility for data processing in connection with visits to and use of our social media channels lies partly with us and partly with the respective providers of the social media platforms. For certain processing activities, we and the platform providers also act as joint controllers within the meaning of Article 26 GDPR. Information on possible transfers of data to third countries is provided in Section 4.

a. Processing by Social Media Providers

We have only limited influence over data processing by the providers of the social media platforms (e.g. data processing in connection with the administration of members and shared information). Where we are able to exert influence, we seek, within the scope of the options available to us, to ensure that data is handled in compliance with data protection requirements. The respective platform provider operates the entire IT infrastructure of the service, has its own privacy policy and has its own relationship with you (provided that you are registered with the social media service). In addition, the provider is solely responsible for all matters relating to the data contained in your user profile. Further information on data processing by the platform provider and your corresponding rights can be found in the privacy policy of the respective provider:

b. Processing by Us

Our social media channels serve as a means of communication and information for interested parties and customers. The processing of users’ personal data is carried out on the legal basis of our legitimate interests in effectively providing information to users and communicating with them pursuant to Article 6 (1) (f) GDPR.

Data that you enter on our social media pages (e.g. comments, videos, images, likes, public messages) is published by the social media platform for these purposes and is not used or processed by us at any time for purposes other than those stated above. We expressly reserve the right to delete unlawful content or content that infringes copyright, personality rights or criminal law.

All public posts that you enter on our social media channels remain on the relevant page indefinitely unless we delete them for one of the reasons stated above or you delete the post yourself. We have no influence over the deletion of your data by the operator of the social media platform itself. The privacy policy of the respective provider therefore applies in this regard (see Section 3.5.2).

c. Joint Controllership

In some cases, we have a relationship with the providers of the social media channels pursuant to Article 26 (1) GDPR (joint controllership). This applies in particular to the web tracking methods used by the provider of the social media platform. As a rule, user data is processed for market research and advertising purposes, e.g. for the creation of user profiles. These user profiles may, among other things, be used to display advertisements corresponding to users’ interests. For this purpose, cookies are stored on the user’s device, with the aid of which user behavior and interests are stored. In addition, user data may also be stored across devices in the user profiles (this applies in particular to users who are logged into the respective platform). We are able to display targeted advertising and carry out an anonymized analysis of the use of our online presence.

The processing of users’ personal data is carried out on the legal basis of Article 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021 (your consent) or on the legal basis of Article 6 (1) (f) GDPR (legitimate interest). Our legitimate interest consists in improving the user experience when visiting our social media channels in a manner tailored to the relevant target group and in measuring the reach of the content. Information on data recipients, retention periods, data subject rights, etc. can be found in the above-mentioned privacy policies of the platform providers (see Section 3.5.2). We have no influence over this.

3.5.3. Integration of YouTube Videos on Our Website

We have integrated YouTube videos on our website, which are stored on “www.youtube.com” and can be played directly from our website. These videos are all embedded in so-called “privacy-enhanced mode”, which means that no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos will YouTube cookies be stored on your device and data transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the operator of YouTube. When playing videos stored on YouTube, at least the following data is transmitted to Google Ireland Limited: IP address and cookie ID, the specific address of the page accessed on our website, browser language setting, system date and time of access and browser identifier. Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021 (your consent). Information on possible transfers of data to third countries is provided in Section 4.

Please note that the data transfer takes place regardless of whether you have a Google user account through which you are logged in or whether you do not have a user account. If you are logged in, this data will be assigned directly to your account. If you do not wish the data to be associated with your profile, you must log out before activating the button. Google Ireland Limited, as the operator of YouTube, stores this data as user profiles and uses it for advertising, market research and/or the customized design of its website. Such analysis is carried out in particular, including for users who are not logged in, for the purpose of providing customized advertising and informing other users about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google Ireland Limited as the operator of YouTube to exercise this right. Further information on the purpose and scope of data collection and processing by Google Ireland Limited can be found in the above-mentioned privacy policy of the platform provider (see Section 3.5.2). We have no influence over this.

3.6. Microsoft Ads (UET Tag)

When you visit this website, personal data is processed. The categories of data processed include data relating to the use of the website and the recording of clicks on individual elements. The purpose of the processing is to examine user behavior, analyze the effectiveness of online marketing measures and select online advertising on other platforms, which is automatically selected by means of real-time bidding based on user behavior.

Data processing is carried out on the legal basis of Article 6 (1) (a) GDPR (your consent). Data is transmitted to the independent controller Microsoft Ireland Operations Limited, One Microsoft Place South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. This may also involve the transfer of personal data to a country outside the European Union. Data is transferred to the USA on the basis of Article 45 GDPR in conjunction with the European Commission’s adequacy decision C(2023) 4745, as the data recipient has undertaken to comply with the data processing principles of the Data Privacy Framework (DPF).

4. Data Transfer

In order to achieve the processing purposes described above, it is necessary, among other things, for us to disclose your personal data to individual recipients. In certain cases, we have already informed you about the recipients of data in the sections above.

In addition, data is transmitted to the following recipients/categories of recipients:

  • IT service providers engaged by us, e.g.

    • TIMETOACT GROUP Österreich GmbH for software development and maintenance with access to production data;

    • Google Identity Platform for authentication

    • Brevo for transactional emails and newsletters

    • Twilio for SMS verification

    • OneTrust for consent management

    • Cloudflare in connection with CDN/WAF/DNS

    • Google Tag Manager;

    • hosting providers,

    • advertising providers,

    • analytics service providers,

  • social media providers;

  • legal representatives and tax advisors;

  • courts and public authorities.

The technical hosting of our website is provided by Google Cloud and Amazon Web Services (AWS), with server locations in the EU.

As part of the transfer of your personal data to the above-mentioned recipients, personal data may also be transferred to third countries (i.e. countries outside the EU/EEA). In certain cases, we have already informed you in the sections above about the relevant legal bases. In the event of any further transfers of data to third countries, we will in all cases ensure that European data security standards are maintained. Personal data is transferred only to countries for which the European Commission has determined that an adequate level of data protection exists (cf. Article 45 GDPR), or we implement measures pursuant to Article 46 GDPR to ensure that recipients maintain an adequate level of data protection (e.g. by concluding Standard Contractual Clauses). We will be happy to provide further information on transfers of data to third countries upon request.

The service providers engaged by us who qualify as processors (in particular IT service providers and cloud service providers) process your personal data solely on our behalf and in accordance with our instructions in order to fulfill the processing purposes stated above. Where personal data is transferred to third countries in connection with the engagement of processors, the above provisions apply accordingly.

5. Your Rights Regarding Personal Data

You are entitled to (i) obtain information as to whether and which of your personal data we process and to receive copies of this data (right of access), (ii) request the correction or deletion of your personal data if it is incorrect or is not processed in accordance with the law (right to rectification and erasure), (iii) request that we restrict the processing of your personal data (right to restriction of processing), (iv) under certain circumstances, object to the processing of your personal data (in particular where processing is based on our legitimate interest; right to object) or withdraw consent previously given for processing (right to withdraw consent), (v) request the transfer of your personal data (right to data portability) and (vi) lodge a complaint with the competent authority (in Austria, the Data Protection Authority, https://www.dsb.gv.at).

6. Contact Details

You can reach us using the following contact details:

philoro EDELMETALLE GmbH
Währinger Straße 26
1090 Vienna
Austria

Tel.: +43 (0) 505 79 1000
Fax: +43 1 997 14 72 100

Email: kontakt@philoro.com

As of: October 2026