Privacy Statement

Holland Gold

1. Introduction

Holland Gold B.V. is an online platform for the purchase, sale and storage of physically allocated precious metals. When you visit our website, use the Holland Gold app (available on iOS and Android), or subscribe to our newsletters or commercial mailings, we process and store certain personal data.

We attach great importance to protecting your personal data and we respect your privacy. In this privacy statement we explain how we collect, use and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and, where applicable, the local privacy legislation of the countries in which we operate within the European Union.

2. Controller

In this privacy statement, ‘we’ refers to Holland Gold B.V., the controller of your personal data:

3. Data we collect

We collect personal data through various channels, depending on how you use our services.

3.1 Website and app visitors (via cookies and tracking)

• IP address
• Browser type and version
• Operating system and device type
• Pages viewed and screens visited in the app
• Time on pages and session duration
• Links clicked and actions performed (app events)
• Advertising ID (IDFA on iOS / GAID on Android) — only with your consent
• Network information (connection type, provider)
• Other data provided by cookies or similar technologies

3.2 Newsletter and mailing subscribers

• Name
• Email address
• Click, open and reading behaviour
• Consent records

3.3 When creating an account

• Name and username
• Email address
• Password
• Consent records for newsletters and commercial mailings

3.4 When using the platform (purchase, sale, storage)

• Name and username
• Address
• Email address and telephone number
• Gender and date of birth
• A copy of your identity document, type of ID, expiry date
• Invoicing and contract details
• Transaction history (purchases, sales, shipping and delivery)
• Identification of the physical precious metals you own, linked to your account
• Payment and bank account details (IBAN, BIC, account holder name)
• Correspondence with our customer service or sales department

3.5 For orders placed through the webshop

• Name and address
• Email address
• Invoicing details and orders placed
• Delivery information
• Payment and bank account details
• Correspondence with our sales department

3.6 Special categories of personal data and the citizen service number (BSN)

As part of the legally required client identification (KYC), we collect a copy of your identity document. That document may show special categories of personal data, such as your nationality and, in some cases, your Dutch citizen service number (BSN). For the technical execution of identity verification we use Rabobank Identity Services as a processor, which in turn engages Fourthline B.V. as a sub-processor. Fourthline processes your identity document and carries out a liveness check for verification purposes. This may involve the processing of biometric data (Article 9 GDPR). The legal basis for this is Article 9(2)(g) GDPR (substantial public interest) in conjunction with the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft).

Your BSN is processed only to the extent required by law under the Wwft and Article 87 GDPR in conjunction with the Dutch GDPR Implementation Act (UAVG). We take additional measures to limit the processing of special categories of personal data, including:

• Masking irrelevant data on copies of identity documents where possible
• Restricting access to authorised employees charged with KYC tasks only
• Encrypted storage of identity documents

4. Purposes and legal bases for processing

We process your personal data for the following purposes:

* Legitimate interest — further explanation (direct marketing)

We process the email addresses of existing customers for direct marketing on the basis of legitimate interest (Article 6(1)(f) GDPR, see also recital 47). Customers may reasonably expect their contact details to be used for this purpose, provided they have not objected. We always offer a simple opt-out and keep the frequency of communication at a reasonable level. You have the right to object to direct marketing at any time.

If you do not provide us with certain personal data that is necessary for the performance of a contract, we may not be able to supply certain services to you.

5. Use of the Meta SDK

Holland Gold uses the Meta SDK and related technologies from Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland), including the Meta Pixel and the Meta Conversions API.

5.1 What is collected and shared

With your consent, the following data is processed through the Meta SDK and shared with Meta:

• Advertising ID (IDFA on iOS / GAID on Android)
• App events, such as app opens, screen views, product views and purchases
• Device data (model, OS version, screen resolution, language)
• Network information (connection type, mobile provider)
• IP address
• Information about pages viewed and actions performed on our website

5.2 Purpose

Meta uses this data to display personalised advertising on Facebook and Instagram, and to measure and optimise the effectiveness of our advertising campaigns.

5.3 Legal basis

The legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time through the cookie and privacy settings in the app or through the cookie banner on the website. On iOS we also request your permission through Apple’s App Tracking Transparency (ATT) framework.

5.4 Transfers outside the EEA

Data processing by Meta also takes place in the United States on the basis of Standard Contractual Clauses (SCCs). We have carried out a Transfer Impact Assessment (TIA). Meta privacy policy: facebook.com/privacy/policy

6. Use of Google services

Holland Gold uses services provided by Google LLC (Mountain View, CA, USA), including Google Tag Manager, Google Analytics 4, Google Ads and Firebase.

6.1 Google Tag Manager

GTM manages tracking and marketing scripts centrally. GTM does not itself place cookies or collect personal data, but it does trigger other tags (such as GA4 and Google Ads) that may do so.

6.2 Google Analytics 4 (GA4)

GA4 analyses how visitors use the website and the app. The data collected includes anonymised IP address, device and browser information, pages viewed, session duration, click behaviour and conversions. IP anonymisation is enabled. Legal basis: consent.

6.3 Google Ads and remarketing

With your consent, the following is processed for advertising purposes: cookie ID, pages visited and conversions, audience segments based on browsing behaviour, and email address for Google Customer Match. Legal basis: consent.

6.4 Firebase Analytics

Firebase Analytics analyses user behaviour in the app. The data collected includes device ID and advertising ID (only with consent), app events, device type, OS version and country/region. Legal basis: consent.

6.5 Firebase Crashlytics

Crashlytics detects crashes and technical errors in the app. No names or email addresses are collected. Legal basis: legitimate interest. You can disable this collection through the privacy settings in the app.

6.6 Transfers outside the EEA

Processing by Google also takes place in the USA on the basis of SCCs. Google privacy policy: business.safety.google/privacy

7. Chat functionality

Holland Gold uses a chat function provided by Intercom, Inc. for customer service through the app and the website. Data collected: name and email address, the content of chat messages, IP address and device information, pages visited before the chat, and the time and duration of the conversation. Legal basis: legitimate interest (Article 6(1)(f) GDPR). Retention period: a maximum of 2 years. Data is stored within the EEA. A DPA has been concluded with Intercom. Privacy policy: intercom.com/legal/privacy

8. Cookies and similar technologies

Holland Gold uses cookies and similar technologies to improve the user experience, analyse app usage and enable personalised advertising.

• Essential cookies: necessary for the proper functioning of the website and app. No consent required.
• Analytical cookies: analysis of visitor behaviour. Data is anonymised as far as possible. Legal basis: consent.
• Marketing cookies and tracking: with your consent, for personalised advertising via Google Ads and Meta.

You can manage your consent through the cookie banner on the website, the privacy settings in the app, the ATT screen on iOS, or on Android via Settings > Google > Ads.

9. Data sharing and transfers

We do not sell your personal data to third parties. We share personal data only where necessary for the provision of our services, to comply with legal obligations, or to protect our rights.

Your personal data is stored primarily within the EEA. Transfers outside the EEA take place solely on the basis of Standard Contractual Clauses (SCCs).

10. Data processing agreements (DPAs)

Under Article 28 GDPR, we conclude a written data processing agreement (DPA) with every processor, setting out, among other things, the purpose and nature of the processing, the security measures and the conditions for engaging sub-processors.

Sub-processors may be engaged only with the prior written consent of Holland Gold B.V. For questions: klantenservice@hollandgold.nl

11. Retention periods

We do not keep your personal data longer than is necessary for the purposes for which it was collected.

Once the retention period has expired, your personal data is securely deleted or anonymised.

12. Your rights

Under the GDPR you have the following rights:

To exercise your rights, please contact us at klantenservice@hollandgold.nl. We respond within 1 month. For complex requests, or where several requests are made at the same time, we may extend this period by a maximum of 2 months; we will inform you of this within the first month (Article 12(3) GDPR).

If you believe that we are acting in breach of privacy legislation, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl

13. Withdrawing consent

Where the processing of your personal data is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Consent can be withdrawn through:

• The unsubscribe option at the bottom of newsletters or commercial mailings
• The cookie and privacy settings in the Holland Gold app
• The cookie banner or the cookie preference centre on our website
• On iOS: Settings > Privacy > Tracking
• On Android: Settings > Google > Ads
• By email: klantenservice@hollandgold.nl

14. Automated decision-making and profiling

Holland Gold does not take decisions about you based solely on automated processing that produce legal effects or similarly significant effects (Article 22 GDPR). We do use audience segmentation for marketing purposes (via Google Customer Match and Meta), but this does not lead to automated decisions with legal or similarly significant effects. You have the right to object to profiling for direct marketing at any time (see section 12).

15. Security

The security of your personal data receives our continuous attention and priority. We apply technical and organisational measures, including:

• Encrypted data transmission (TLS/SSL) between users and our platform
• Access restricted to authorised employees, with additional verification
• Multiple layers of technical security
• Periodic independent audits and penetration tests

15.1 Data breaches and the duty to notify

Holland Gold has an internal procedure for detecting, assessing and handling data breaches. Where a data breach is likely to result in a risk to your rights and freedoms, we report it to the Dutch Data Protection Authority within 72 hours of discovery (Article 33 GDPR).

Where the data breach is likely to result in a high risk, we will also notify you personally without undue delay (Article 34 GDPR). In that notification we will inform you of the nature of the breach, its possible consequences and the measures taken.

16. Changes to this privacy statement

We may amend this privacy statement from time to time, for example because of new services, changes in legislation or adjustments to our data processing practices. We always publish the latest version on our website and in the app.