Gold Rush
Privacy Policy
This policy explains how Gold Rush processes personal data when you visit this website or contact us.
Controller and privacy contact
Ricky Martin Mullick, operating Gold Rush as an individual business in Germany, is responsible for the processing described here. Business address: Zollerstr. 4, 93053 Regensburg, Germany. For privacy enquiries or to exercise your rights, email privacy@goldrush.markets. For general correspondence, email contact@goldrush.markets.
Website delivery and security
This website is built with Astro and hosted and delivered through Cloudflare Workers. Cloudflare processes technical request information, which may include your IP address, requested URL, request time, browser and device information, and security signals. We use this processing to deliver pages, maintain availability and prevent abuse. The lawful basis is Article 6(1)(f) GDPR: our legitimate interests in providing a reliable, secure website. Workers Observability is disabled and Cloudflare Web Analytics has not been configured. This does not prevent Cloudflare from processing operational or security information in its own systems.
Cookies, browser storage and security features
The website application does not set cookies or use browser storage for analytics or advertising. Cloudflare Browser Integrity Check and the Cloudflare Managed Ruleset are enabled; Bot Fight Mode is off. Email Address Obfuscation is enabled to help protect published email addresses from automated collection. Conditional security challenges may process device information and issue technical cookies, including cf_clearance, to recognise a successfully completed challenge. This does not mean that every visit uses these cookies or that all possible security cookies have been observed. The consent requirements for storage or access on your device must be assessed separately from the GDPR lawful basis for processing personal data. The exception in §25(2) TDDDG applies only where its conditions are met, including qualifying strictly necessary storage or access; describing a technology as a security measure does not automatically exempt every use from consent.
Email correspondence
Zoho Mail receives and stores our business correspondence. Our Zoho account uses the EU region. When you email us, we process your address, message, any name or other information you provide, and technical email metadata to handle and answer your enquiry. For general correspondence, the lawful basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in responding to enquiries. Article 6(1)(b) applies where processing is necessary for steps you request before entering into a contract; Article 6(1)(c) applies where a legal obligation requires processing, including handling applicable privacy-rights requests. Please do not send passwords, financial account credentials, identity documents or unnecessary sensitive information.
Telephone enquiries
When you call +49 173 9734762, we process your telephone number where transmitted, call-history information such as the time and duration of a call, and information you provide to handle and answer your enquiry. The business telephone uses an ordinary mobile connection, with no external VoIP service, call forwarding, voicemail or call recording. Mobile network operators process connection and call metadata to provide their telecommunications services under their own applicable legal obligations and privacy notices. For general enquiries, our lawful basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in responding to enquiries; Article 6(1)(b) applies to necessary steps you request before a contract, and Article 6(1)(c) applies where a legal obligation requires processing. Enquiry notes and business call-history entries fall under our ordinary-correspondence retention policy below; carrier retention is separate.
Current and future features
There are no active account-registration, payment, booking, newsletter or PDF-download forms. The website contact form is not operational publicly. If activated, its processing would use Cloudflare to handle requests, Turnstile to prevent abuse, Resend to deliver contact notifications and Zoho Mail to receive and answer them. Turnstile is configured in Managed mode with pre-clearance disabled, but is not loaded by an active public contact or download form. Public resource-email requests and downloads remain disabled. A limited operator-authorised test is described below; it does not make these features publicly available. Sending an email does not create an account or subscribe you to marketing. Gold Rush does not currently send marketing emails or track email opens through these website features. Public feature activation requires separate approval and updated disclosures.
Limited operator-authorised PDF email test
Subject to separate authorisation, Gold Rush may test transactional PDF delivery to one privately configured, approved recipient. For this test we process the recipient email address, selected resource, email content and temporary download link, sending and delivery information including failures, and operator-authentication and technical request data such as IP address, request time, URL and browser information. The purposes are to authenticate the operator, send the requested test email, verify delivery and download integrity, and prevent unauthorised access. The lawful basis is Article 6(1)(f) GDPR: our legitimate interest in securely testing requested transactional delivery before public release. The test creates no account or marketing subscription and does not use a public form or Turnstile challenge.
Test delivery and signed-link security
Cloudflare handles requests and private PDF storage in Workers KV; Resend sends the email. The recipient’s email provider processes the received message under its own applicable terms and privacy notice. Test emails must have open and click tracking disabled. The signed link expires 24 hours after issue and can be reused or forwarded until expiry, unless test access is disabled earlier. Test API and download responses use no-store and no-referrer protections, and application code does not log signed links or credentials. Providers, email security scanners and browser history may nevertheless process or retain the link or request metadata. Link expiry does not delete emails, provider records or already downloaded copies.
Recipients and international processing
Cloudflare and Zoho process information in connection with the active services described above; the limited email test would additionally involve Resend and the recipient’s email provider. Authorised service personnel and subprocessors may access data as required to provide and secure those services. Zoho discloses possible access by support personnel outside the European Economic Area (EEA), with contractual safeguards. An EU account region or EU PDF storage therefore does not mean EU-only processing. Cloudflare processing may also involve countries outside the EEA. Applicable transfers require a valid mechanism under Chapter V GDPR, such as an applicable adequacy decision or appropriate safeguards including standard contractual clauses. We may disclose information where required by law or necessary to establish, exercise or defend legal claims. You can request information about the safeguards applicable to your data at privacy@goldrush.markets.
Retention
Under Gold Rush’s own operating policy, we ordinarily delete routine business and privacy enquiries within 12 months of the last substantive exchange and conduct quarterly correspondence reviews. We preserve records longer where required by applicable law, unresolved matters, contractual obligations or legal claims. This is our correspondence-handling policy, not a claim that Zoho automatically enforces a 12-month deletion period. For the single restricted test, closure is when the operator records that the test has succeeded, failed or been abandoned. We manually delete the test email, downloaded test copy and diagnostics within 7 days after closure. We retain a minimal non-identifying result note for 90 days after closure and then delete it. Temporary test authentication and signing credentials are revoked manually after verification. Unresolved incidents or legal obligations may justify an exception, with a documented reason and review date. Related enquiries follow the separate correspondence policy. Provider operational, security, mailbox and backup data may follow separate retention arrangements. These manual cleanup rules do not guarantee deletion by a provider or erase already downloaded copies held by others.
Resend processing and provider retention
Plus Five Five, Inc. (Resend) would process email addresses, message content including the signed link, and delivery and security information for the limited test. Public resource-email delivery and website contact notifications remain disabled. Resend may use authorised subprocessors and fallback delivery infrastructure, including alongside its Forge service. Resend’s DPA identifies primary processing operations in the United States and incorporates Standard Contractual Clauses for applicable transfers outside the EEA. Resend publishes 30-day email/log retention on Free, Pro and Scale plans, seven-day backup retention, and deletion of remaining customer data within 90 days of account termination under its DPA; Enterprise terms may differ. These periods do not mean all provider data is deleted when a download link expires.
Resend processing, transfers and retention informationYour rights
Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw that consent at any time without affecting earlier lawful processing. Providing correspondence is voluntary, but we may be unable to answer without the information needed to handle your enquiry. We do not use this website to make solely automated decisions producing legal or similarly significant effects about you.
Complaints
You may complain to a supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the alleged infringement. For private-sector businesses in Bavaria, the relevant authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). Postal address: Postfach 1349, 91504 Ansbach, Germany.
BayLDA complaint information and online serviceChanges to this policy
This policy will be updated when the website’s processing changes. Information about new features will be provided before they are made available.