Privacy Policy

Last updated: October 6, 2026

This policy explains which personal data we process on mineralica.com, why we do so, on what legal basis, and which rights you have.

1. Controller

Mineralica
Owner: Maximilian Schiller
Klosterholz 5
94491 Hengersberg
Germany

Postal address: Mineralica, Postfach 86 06 47, 81633 München, Germany
Phone: +49 89 2153 7111
Email: info@mineralica.com

2. Visiting the website

When you open our pages, our server processes the data your browser sends: IP address, date and time, the address requested, the page you came from, and your browser's identifier. We need this data to deliver the page, to find faults, and to fend off attacks. We delete these logs after 30 days at the latest.

The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

Our servers and our database are located in Frankfurt am Main, Germany, with Amazon Web Services and MongoDB. Both companies process the data on our behalf (section 15).

3. Cookies

We use our own cookies and, in addition, the cookies of Google Analytics (section 4).

Cookie	Purpose	Lifetime
`jwt_access_token`	keeps you signed in	30 minutes, renewed while you use the site
`csrf_token`	protects forms against misuse	until you close your browser
`print_cart`	your cart in the print shop	30 days
`print_checkout_ids`	lets you reopen your order as a guest	1 day
`country`	your country, so that we show prices in the right currency	1 year
`vid`	random identifier for our own visitor statistics (section 4)	1 year
`_ga`, `_ga_…`	random identifier for Google Analytics (section 4)	2 years

We need the cookies for sign-in, form protection, cart, and order for the functions you use (Section 25 (2) no. 2 of the German TDDDG). On the payment pages, our payment provider Stripe sets its own cookies to secure payments and detect fraud (section 8). On pages with a map, Google Maps may set its own cookies (section 9).

4. Visitor statistics

We would like to know how many people read our pages, which countries they come from, and which articles are read. For this we keep our own statistics on our own servers and also use Google Analytics.

Our own statistics

We do not pass the data of our own statistics on. How it works:

On your first visit, your browser receives a random identifier (cookie vid, valid for one year). The identifier itself contains no information about you.
Under this identifier we store the time of your first visit, the first page you opened, the page you came from, your browser language, and your approximate location: country, region, city, and coordinates rounded to about seven miles. We derive the location from your IP address using a database stored on our own server. Your IP address is not sent to anyone in the process.
We store which pages were last opened under this identifier (50 at most) and count page views per page and day.
We keep the link between IP address and location for 30 days. We delete the data stored under the identifier from the running system 90 days after your last visit. In our statistics, the first visit and the daily counts are kept permanently so that we can compare developments over several years.
We do not count automated access, for example by search engines.

When you create an account, we copy the details of your first visit to your account: time, referring page, first page, country, region, city, and browser language. This shows us how new readers find us.

Google Analytics

Google Analytics is an analytics service provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It loads when you open our pages. We do not ask for your consent for this.

Google Analytics sets cookies with a random identifier in your browser (_ga and _ga_…, valid for two years). The service uses them to tell whether a visit is new and which page views belong together.
With every page view, Google receives the address and title of the page, the page you came from, date and time, details of your browser, device, screen, and language, and your IP address, plus individual actions on the page: clicks on links to other websites, downloaded files, and how far you scroll. According to Google, the IP address is not stored and is only used to determine your approximate location.
We see aggregated reports, such as visitor numbers, countries of origin, the most-read pages, and the ways visitors find us. We cannot identify individuals in them. We do not use the advertising features of Google Analytics.
Google Analytics deletes data linked to individual identifiers after 14 months.
Google processes the data on our behalf, including on servers in the United States (section 15).

Google's privacy policy: https://policies.google.com/privacy

Legal basis and objection

The legal basis for both kinds of statistics is our legitimate interest in measuring the use of our site and in shaping it accordingly (Art. 6 (1) (f) GDPR). You may object to this processing at any time (section 17).

To do so, delete the vid, _ga, and _ga_… cookies in your browser and block them for mineralica.com, or write to us.

You can also turn off Google Analytics with a browser add-on from Google: https://tools.google.com/dlpage/gaoptout

5. Account

To create an account we need your email address and a password. We do not store the password in plain text, only as a hash. We send you a link to confirm your address. In your account you can add your form of address, name, and language as well as shipping and billing addresses with a phone number, and as a business your VAT identification number. We also store when you registered and when you last signed in.

The same account works for everything on mineralica.com. We have carried over accounts from our previous website.

The legal basis is the contract on the use of the account (Art. 6 (1) (b) GDPR). We store the data until you ask us to delete your account. A message to us is enough. Data we must keep for contracts and invoices remains stored until the statutory periods end (section 16).

6. Subscription

When you subscribe, we process your name, email address, shipping and billing addresses, your phone number if you provide one, the edition and language you chose, the term, the status of payments, and the issues we have sent you. We record when you agreed to which terms, and we keep the emails we send you about your subscription, such as the contract confirmation and the confirmation of a cancellation. This allows us to document the contract.

If you subscribe with an order form or at a show, we create an account for you.

For shipping, we pass your name and address on to the carrier that delivers your issues: Asendia, Deutsche Post, DHL, or Hermes. For deliveries to countries outside the European Union, the postal and customs authorities of the destination country also receive these details.

The legal basis is the subscription contract (Art. 6 (1) (b) GDPR) and, for keeping invoices and records, a legal obligation (Art. 6 (1) (c) GDPR).

Cancellation and withdrawal: If you use the pages "Cancel contracts here" or "Withdraw from contract here," the details you enter reach us by email, and you receive a confirmation at the address you provided.

7. Print shop

You can order issues as a guest or with your account. We process your name, email address, shipping and billing addresses, the issues ordered, and the status of payment and shipping. As a guest you receive a link by email that lets you reopen your order. We issue an invoice for every order and keep it.

For shipping, we pass your name and address on to the carrier that delivers your order: Deutsche Post, DHL, Hermes, or Asendia. For deliveries to countries outside the European Union, the postal and customs authorities of the destination country also receive these details.

The legal basis is the purchase contract (Art. 6 (1) (b) GDPR) and, for keeping the invoice, a legal obligation (Art. 6 (1) (c) GDPR).

8. Payment

Payments are handled for us by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You enter your payment details, such as your card number or bank account, directly with Stripe. We neither see nor store them. We send Stripe your name, email address, postal address, language, and the amount, and Stripe tells us whether the payment succeeded and with which payment method.

If you pay with PayPal, Apple Pay, Google Pay, by direct debit, or by bank transfer, the respective provider and the banks involved also receive the data needed for the payment.

Stripe also processes data as a controller in its own right to prevent fraud and to meet its own legal obligations, and may transfer data to the United States for this purpose. See Stripe's privacy policy for details: https://stripe.com/privacy

The legal basis is our contract with you (Art. 6 (1) (b) GDPR) and our legitimate interest in secure payment processing (Art. 6 (1) (f) GDPR).

9. Google Maps

On the pages of our show directory we show a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you open such a page, your browser loads the map directly from Google. We do not ask for your consent for this. Google receives your IP address and information about your browser and may set its own cookies. Google processes this data as a controller in its own right, including in the United States.

The legal basis is our legitimate interest in showing you the location of a show on a map (Art. 6 (1) (f) GDPR). You may object to this (section 17). If you do not want a connection to Google, you can block content from Google in your browser. The pages of the directory then remain usable without the map.

Google's privacy policy: https://policies.google.com/privacy

10. Protecting our forms

We protect our public forms against automated submissions with a method that runs on our own server: when you submit a form, your browser solves a small computational puzzle in the background. We set no cookie for this and pass no data on.

The legal basis is our legitimate interest in preventing misuse (Art. 6 (1) (f) GDPR).

11. Contact

When you write to us or call us, we process your details to handle your request. Depending on the request, the legal basis is our contract with you or our legitimate interest in answering inquiries (Art. 6 (1) (b) or (f) GDPR).

We only send you emails about your account, your orders, and your subscription. There is currently no newsletter.

12. Show directory

We publish dates of mineral shows with organizer, venue, and website. The information comes from publicly accessible sources, such as organizers' websites, registers, and the press, and from the organizers themselves. If the organizer is a private individual, we process their name and the contact details they have published themselves. For our work on the directory we also store organizers' contact persons with contact details and notes on our correspondence. We do not publish this information.

The legal basis is our legitimate interest, and that of collectors, in a reliable directory (Art. 6 (1) (f) GDPR). Organizers may have their entry corrected or deleted at any time and may object to its publication. A message to info@mineralica.com is enough.

13. Editorial content

In articles, captions, and on contributor pages we name people such as authors, photographers, collectors, and interviewees. Where we process data for journalistic purposes, only some provisions of the GDPR apply (Art. 85 GDPR, Section 23 of the German Interstate Media Treaty, Art. 38 of the Bavarian Data Protection Act, Art. 11 of the Bavarian Press Act). The rights of access, erasure, and objection apply there only to a limited extent.

If you believe that an article portrays you incorrectly or infringes your rights, please write to us. We review every report.

We run profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and a page of links on Linktree (Linktree Pty Ltd, 1-9 Sackville Street, Collingwood VIC 3066, Australia). When you visit them, the operator processes your data as a controller in its own right: Meta also for advertising and also in the United States, Linktree also in Australia and the United States. We receive aggregated statistics about visitors to our profiles from the operators, from which we cannot identify individuals. For these statistics on Facebook ("Page Insights"), Meta and we are joint controllers. Meta has undertaken to inform you about this and to fulfill your rights: https://www.facebook.com/legal/terms/page_controller_addendum

The legal basis is our legitimate interest in reporting on our work and staying in conversation with readers (Art. 6 (1) (f) GDPR). You can assert your rights against the operator and against us.

Privacy notices of the operators: https://privacycenter.instagram.com/policy · https://www.facebook.com/privacy/policy · https://linktr.ee/s/privacy

We do not embed social media content on mineralica.com itself. There are only links.

15. Recipients and transfers to other countries

Your data is only received by parties we need for the purposes described:

Amazon Web Services EMEA SARL, Luxembourg: servers, storage, and email delivery, located in Frankfurt am Main; our email mailbox, located in Ireland
MongoDB Limited, Ireland: database, located in Frankfurt am Main
Stripe Payments Europe, Limited, Ireland, and, depending on the payment method, other payment providers and banks
Deutsche Post, DHL, Hermes, and Asendia: shipping
Google Ireland Limited: visitor statistics (Google Analytics) and maps (Google Maps)
our tax advisor and lexoffice, our accounting software
service providers who support us in operating and developing our software
public authorities where we are legally obliged

Some of these companies belong to groups based in the United States or process data there. Such transfers are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's standard contractual clauses.

16. Storage periods

Server logs: 30 days
Visitor statistics: as described in section 4
Account: until you ask us to delete it
Records of orders and subscriptions, including the related emails: three years after the end of the contract, counted from the end of the year
Invoices and accounting records: eight years; business letters and emails: six years (Section 147 of the German Fiscal Code, Section 14b of the German VAT Act)
Entries in the show directory: as long as the show or the organizer is relevant to the directory

17. Your rights

You may ask us for access to your data (Art. 15 GDPR), have incorrect data corrected (Art. 16), have data erased (Art. 17), have processing restricted (Art. 18), and receive the data you gave us in a commonly used format (Art. 20). You may withdraw consent at any time with effect for the future (Art. 7 (3)).

For any of this, a message to info@mineralica.com or to our postal address is enough.

You may also lodge a complaint with a data protection supervisory authority, for example where you live. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

18. Required information and automated decisions

For an account, an order, or a subscription we need the details marked as required in the forms. Without them we cannot conclude or perform the contract. All other details are voluntary. We do not make decisions that are based solely on automated processing and that legally affect you.

19. Changes to this policy

We update this policy when our services or the law change. The version published here applies.