Controller
Tobias Schlegel
Mühlenweg 15
54636 Hüttingen an der Kyll
Germany
E-Mail: info@wertmacher24.de
Scope and legal bases
This information applies to the publicly available pages, contact forms and protected GP area, including the precious metals investment simulator. Unless stated otherwise below, processing is carried out to provide a functional and secure website on the basis of Art. 6(1)(f) GDPR. The legitimate interest is the secure, economical and needs-based provision of the online service.
Hosting and Server Log Files
This website is hosted by STRATO. STRATO is used as a processor for hosting. Each visit causes the web server to process technically necessary data, in particular the IP address, date and time, page or file accessed, amount of data transferred, referrer URL, browser identifier, operating system and HTTP status code. Processing serves delivery, defence against attacks, error analysis and website stability.
The retention of server log files is governed by the deletion periods applicable to STRATO hosting. Where webspace log files are provided in the customer area, they are generally available for up to six weeks. The legal basis is Art. 6(1)(f) GDPR; processing by a processor is governed by Art. 28 GDPR.
Contact forms and email
When you submit a contact form, we process your name, email address, where applicable your telephone number and country of residence, selected interest and request, message, form source, time of submission and any affiliate code provided. The form transmits these details to info@wertmacher24.de so that we can process your request.
Processing is used to answer your request, initiate a contract and assess a career or affiliate cooperation. The legal basis is Art. 6(1)(b) GDPR where your request is directed at a contract, otherwise Art. 6(1)(f) GDPR. Please do not send identity documents, credentials or other particularly confidential financial information through the form or unencrypted email.
Cookie settings and affiliate attribution
When you first visit, you can choose your cookie settings and change them later through the “Cookie settings” link in the footer. A technically necessary cookie wm24_cookie_settings stores your selection for 180 days. It is required so that your decision can be respected.
With your optional consent, we store the selected site language in browser storage (convenience), maintain data-minimised usage statistics in the protected central CRM (statistics), or store an affiliate code in the cookie wm24_affiliate_ref for no more than 90 days (affiliate attribution). The code is used solely to attribute a later contact request to an affiliate. Without consent, you can still enter the code manually in the contact form. Server-side counting when an official affiliate referral link is opened is independent of this and does not require an affiliate cookie. Separate Marketing consent controls whether Google Ads may store or access advertising data.
When an official affiliate referral link is opened, the affiliate code, destination page and time are recorded server-side in a protected CRM event log. For a validly attributed and successfully submitted inquiry, the affiliate code, form source and submission time are also recorded. This separate affiliate event log does not contain names, email addresses, telephone numbers, message content, IP addresses, cookies or persistent visitor identifiers. The purpose is transparent attribution and evaluation of affiliate cooperation. The legal basis is Art. 6(1)(f) GDPR; the legitimate interests are verifiable referral attribution and orderly management of the cooperation. The data are deleted after 90 days.
Google Ads campaign measurement
The Google Ads tag from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is implemented using Google Consent Mode. If you consent to the Marketing category, it may store or access advertising data and is used to measure the success of our Google Ads campaigns and visits to the confirmation page after a successfully submitted contact request. We do not transmit the content of contact forms, names, email addresses or telephone numbers to Google Ads.
Depending on your browser and Google settings, Google may process cookie or online identifiers, technical browser and device information, IP address, referrer information, the page URL and advertising click parameters. The legal basis for storage, access and full advertising measurement is your consent under Art. 6(1)(a) GDPR. Before Marketing consent, the Google tag operates with advertising storage, advertising user data and advertising personalisation denied; no Google Ads cookies are read or written. In this technical mode Google may receive cookieless pings containing consent status and technical request data. You can withdraw your consent at any time through Cookie settings; known first-party Google Ads cookies are then deleted. Further information about Google's processing, storage periods and possible international data transfers is available in Google's Privacy Policy and information on advertising technologies. Google-Datenschutzerklärung und den Informationen zu Google-Werbetechnologien.
Central CRM, sales documentation and affiliate management
wertmacher24 is connected to a central CRM. It consolidates contact procedures, the documentation required for sales activities and affiliate cooperations. Where necessary to process an inquiry, contact and request details may be added to the CRM from the contact email. This can include name, contact and communication details, country of residence, selected interest and request, information from the message, affiliate code, processing status and the necessary contact, task and attribution notes.
The CRM is used to initiate, carry out and document inquiries, customer relationships, sales activities and affiliate cooperation. A successfully submitted contact form also creates a technical processing record in the CRM with the form source, time, path, landing page, language and, where applicable, affiliate attribution. This record does not contain the message content or the form fields. The legal basis is Art. 6(1)(b) GDPR where processing is necessary to initiate or perform a contract, and Art. 6(1)(f) GDPR for orderly customer and cooperation management, communication, traceability and the protection of legal claims. The CRM is protected from public access. No automated decision-making or profiling takes place.
Protected GP area
To manage GP accounts, we process email address, name, account identifier, role, account status, blocking notices, any administrative notes, dates of the last login and dates of confirmation of the EULA and confidentiality agreement. Passwords are verified exclusively on the server and stored only in hashed form. After a successful login, older password hashes may be migrated to a current hashing standard.
After login, a technically necessary session cookie is set. It serves secure authentication and is deleted on logout, after 30 minutes of inactivity or no later than after eight hours. Account data are stored until the account is deleted and are then deleted or anonymised unless statutory retention obligations or legitimate security interests prevent this. The legal bases are Art. 6(1)(b) and (f) GDPR.
Successful logins, delivered downloads and the opening of the simulator are documented in the protected administration log with account email address, time and action. This serves access control, the provision of internal documents and traceability within the protected area. These logs are deleted after 90 days.
To protect against automated login attempts, failed logins are rate limited for a limited time. For this purpose, the time and identifiers derived with a secret server key from the technical connection address and entered email address are stored, but not the plain IP address or entered password. These protection data are removed no later than after 24 hours.
Website statistics in the central CRM
With your consent, the central CRM records a data-minimised usage overview: event type, time, accessed path and page title, link destination, landing path, referrer host and path, the stated affiliate code, selected language, screen and viewport dimensions, as well as the browser and operating-system category derived from the user agent. Where present, the campaign parameters utm_source, utm_medium, utm_campaign, utm_content and utm_term are also recorded. The CRM receives no raw IP address. A daily changing, salted hash derived from the technical IP address and user agent, plus a session identifier stored only in browser session storage and transferred as a hash, are used to distinguish technical events within a session. The user agent is retained in the CRM event log. Analytics and marketing cookies are not used for this purpose.
The statistics start only after you consent in the cookie settings and are based on Art. 6(1)(a) GDPR. If the browser signals Global Privacy Control, it does not send page or link events to the central CRM. The CRM event data are used to analyse website use, improve the website, measure affiliate referrals and ensure traceable sales documentation. They are deleted after 90 days. The technical processing record created for a successfully submitted contact form is independent of this consent and is described in the central CRM section. The separate counting of official affiliate referral links is described in the section Cookie settings and affiliate attribution. Server logs independent of these events are described in the Hosting section.
Local storage and the simulator's offline function
The website stores the selected site language in browser web storage only after consent to the comfort setting. Independently, the simulator can store settings, inputs, profile names, saved scenarios, view, language and EULA confirmation locally in the browser. Depending on the chosen storage location, saved states can also be imported or exported as a JSON file on your device. These local data are not automatically sent to the site operator and can be removed through browser settings or by deleting the file.
The simulator uses a service worker and browser cache to keep its own application files and local price files available for offline use. The storage serves the simulator function you requested. Cache data can be deleted from the website data in browser settings.
The bundled price data is loaded locally. If an online price source or online currency conversion is expressly selected and the corresponding price interface is configured, the simulator requests only the price symbol and period through that service. Saved-setting content, investment amounts, special purchases and payouts are not transmitted. Depending on the configuration, the operator of the selected price source, for example Yahoo Finance, may process technical access data.
External links
The website contains links to external offerings, including PKM Digital, the Sutor Bank customer portal, TimeTree, Zoom and app stores. These offerings are not embedded in the website. A connection to the respective provider is made only when you actively click a link; from that point, its privacy policy applies. The optional use of online price sources in the simulator is described in the previous section.
Recipients and disclosure
Recipients of personal data are the controller, STRATO as the technical hosting and email provider, and service providers involved in the protected operation of the central CRM where they process data on the controller's instructions. If you give Marketing consent, Google Ireland Limited receives the technical and usage data described in the Google Ads section for campaign measurement. Data are otherwise disclosed only where necessary to process your inquiry, manage customer, sales or affiliate relationships, provide technical services, fulfil legal obligations or enforce legal claims. Where online price sources are expressly selected and configured, their operator may receive technical request data; that provider's privacy terms apply. No social-media services are embedded.
Storage Period
Contact requests and CRM entries created to process them are deleted after final processing unless statutory retention obligations or legitimate interests in further documentation apply. Affiliate master data and cooperation records in the CRM are stored for the duration of the cooperation and deleted after it ends unless statutory retention obligations or legitimate interests, in particular to defend or enforce legal claims, prevent this. Account data are processed as described in the GP area section. Cookie settings are deleted after 180 days and affiliate cookies no later than after 90 days. Central CRM event logs and affiliate referral event logs are deleted after 90 days. Google Ads storage periods are determined by Google according to its settings and policy. Local browser and cache data remain on your device until you delete them.
Your Rights
Within the statutory requirements, you have the right of access, rectification, deletion, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. You also have the right to lodge a complaint with a data protection supervisory authority.
The supervisory authority responsible for the controller is the Data Protection and Freedom of Information Commissioner for Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, www.datenschutz.rlp.de. To exercise your rights, simply send a message to info@wertmacher24.de.
Obligation to provide data and automated decisions
Providing data in the contact form is voluntary. However, a response is generally not possible without contact details. Data for a GP account are required only to use the protected area. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
Status: September 17, 2026