Privacy policy

Your privacy matters to us. This privacy policy explains which personal data GoldexPay collects when you use our website, why we do so, how long we keep it and what rights you have. We collect as little data as possible and never sell your personal data.

1. Who is responsible for your data

The controller of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

• Goldexpay
• Gorterplaats 26a-8, 6531 HZ Nijmegen, the Netherlands
• Email: [email protected]

2. What GoldexPay does – and does not do

GoldexPay is a comparison website. You can use the calculator and read our content without creating an account. We do not exchange money, hold funds or process transactions. If you decide to use a provider, you go to that provider's website and share your data directly with them. The provider's own privacy policy then applies; we have no control over how providers handle your data.

3. Which data we process, why and on what legal basis

3.1 Clicks to providers (click logs)

Links to providers go through a redirect on our domain (/go/{provider}). When you click one, we record:

• the provider you clicked on;
• the currencies or assets and the amount entered in the calculator;
• the language and the page you clicked from;
• a random click ID (subid), which we pass to the affiliate network;
• a hashed version of your IP address (SHA-256, salted with a secret value and the date; the hash changes every day and we do not store your actual IP address);
• your browser's user agent and the referring page (referrer).

Purpose: settling affiliate commissions with affiliate networks and providers, and detecting and preventing fraud and abuse.
Legal basis: our legitimate interest in being paid for referrals and protecting our website against fraud (Article 6(1)(f) GDPR). We limit the data to what is needed and do not store your raw IP address.
Retention: 24 months.

The click ID itself contains no personal data about you. The affiliate network and the provider may combine it with data they collect themselves when you visit their website, under their own privacy policy.

3.2 Analytics (Google Analytics 4)

We use Google Analytics 4 to understand how visitors use our website, for example which pages are visited and how the calculator is used. Google Analytics places analytics cookies (_ga and _ga_<ID>) to recognise returning visitors and sessions. Advertising features are switched off, and Google Analytics 4 does not log or store IP addresses.

Purpose: statistical analysis to improve the website.
Legal basis: our legitimate interest in understanding and improving our website (Article 6(1)(f) GDPR). You can object at any time; see section 7.
Retention: the analytics cookies are stored for up to 2 years; the statistics are kept in line with the data retention setting of our Google Analytics property, at most 14 months. See our cookie policy for details.

3.3 Security and server logs

Like any website, our servers process technical data such as IP address, time of request, requested page and user agent to deliver the website and protect it against attacks and abuse.

Legal basis: our legitimate interest in a secure and properly functioning website (Article 6(1)(f) GDPR).
Retention: no longer than necessary for security purposes, after which the logs are deleted.

3.4 Emails you send us

If you email us, we process your email address, name (if provided) and the content of your message to answer your question.

Legal basis: the performance of a contract or steps prior to it, where your message relates to one (Article 6(1)(b) GDPR), and otherwise our legitimate interest in answering questions and feedback (Article 6(1)(f) GDPR).
Retention: as long as necessary to handle your message and any follow-up, after which we delete it, unless a legal obligation requires us to keep it longer.

3.5 Admin area

Our admin area (/admin) is only used by our staff. It uses functional session and security (CSRF) cookies for logged-in staff only. These cookies are not set for visitors of the public pages.

4. Who we share data with

We do not sell your personal data. We share data only where necessary:

• Affiliate networks and providers – the random click ID is passed on when you click to a provider, so a commission can be matched.
• Google – for website statistics (Google Analytics 4). Google acts as a processor for us. Data may be transferred to the United States; Google relies on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
• Hosting – our website is self-hosted on servers in the European Union.
• Authorities – if we are legally required to do so.

When fetching exchange rates (from currency-rates.github.io, CoinGecko and the Frankfurter API), our server makes the requests. No personal data of visitors is shared with these sources.

5. Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashing of IP addresses in click logs, restricted access to the admin area and hosting within the EU.

6. Your rights

Under the GDPR you have the following rights:

• Right of access – to know which personal data we process about you.
• Right to rectification – to have incorrect data corrected.
• Right to erasure – to have your data deleted ("right to be forgotten").
• Right to restriction – to have the processing of your data restricted.
• Right to data portability – to receive your data in a structured, commonly used format.
• Right to object – to object to processing based on our legitimate interest.

Please note: because we only store a daily changing hash of your IP address and no name or account, we usually cannot link click logs to you. In that case we may be unable to fulfil a request concerning those logs (Article 11 GDPR), unless you provide additional information that allows identification.

To exercise your rights, email [email protected]. We respond within one month. We may ask you to verify your identity.

7. Objecting to analytics

You can object to the use of Google Analytics at any time by emailing [email protected], by deleting or blocking the analytics cookies in your browser, or by blocking Google Analytics with a browser extension or content blocker. This does not affect how the website works. More information can be found in our cookie policy.

8. Complaints

If you are not satisfied with how we handle your data, please contact us first. You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). You can also contact the supervisory authority in the EU country where you live.

9. Children

Our website is not aimed at children under 16. We do not knowingly collect personal data from children.

10. Changes

We may update this privacy policy, for example when we add new features or the law changes. The date shown on this page indicates when it was last changed. For significant changes, we will make this clear on our website.

See also our cookie policy, terms of use and affiliate disclosure.