Privacy Policy

Last updated: October 16, 2026

This policy explains which personal data we process on mineralica.com, why we do so, on what legal basis, and which rights you have.

1. Controller

Mineralica
Owner: Maximilian Schiller
Klosterholz 5
94491 Hengersberg
Germany

Postal address: Mineralica, PO Box 86 06 47, 81633 Munich, Germany
Phone: +49 89 2153 7111
Email: info@mineralica.com

2. Visiting the website

When you open our pages, our server processes the data your browser sends: IP address, date and time, the address requested, the page you came from, and your browser's identifier. We need this data to deliver the page, to find faults, and to fend off attacks. We delete these logs after 30 days at the latest.

The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

Our servers and our database are located in Frankfurt am Main, Germany, with Amazon Web Services and MongoDB. Both companies process the data on our behalf (section 16).

3. Cookies

We use our own cookies and, in addition, the cookies of Google Analytics (section 4).

Cookie	Purpose	Lifetime
`jwt_access_token`	keeps you signed in	30 minutes, renewed while you use the site
`csrf_token`	protects forms against misuse	until you close your browser
`print_cart`	your cart in the print shop	30 days
`print_checkout_ids`	lets you reopen your order as a guest	1 day
`cart`	your cart on Mineralica Auctions	30 days
`checkout_ids`	lets you open an order on Mineralica Auctions again	1 day
`country`	your country, so that we show prices in the right currency and the shipping costs	1 year
`vid`	random identifier for our own visitor statistics (section 4)	1 year
`_ga`, `_ga_…`	random identifier for Google Analytics (section 4)	2 years

We need the cookies for sign-in, form protection, cart, and order for the functions you use (Section 25 (2) no. 2 of the German TDDDG). On the payment pages, our payment provider Stripe sets its own cookies to secure payments and detect fraud (section 9). On pages with a map, Google Maps may set its own cookies (section 10).

In the Mineralica Auctions catalog, your browser keeps copies of the catalog pages you visited last in its local storage, so that the back button works without reloading. These data do not leave your browser. They disappear when you delete the site data.

4. Visitor statistics

We would like to know how many people read our pages, which countries they come from, and which articles are read. For this we keep our own statistics on our own servers and also use Google Analytics.

Our own statistics

We do not pass the data of our own statistics on. How it works:

On your first visit, your browser receives a random identifier (cookie vid, valid for one year). The identifier itself contains no information about you.
Under this identifier we store the time of your first visit, the first page you opened, the page you came from, your browser language, and your approximate location: country, region, city, and coordinates rounded to about seven miles. We derive the location from your IP address using a database stored on our own server. Your IP address is not sent to anyone in the process.
We store which pages were last opened under this identifier (50 at most) and count page views per page and day.
We keep the link between IP address and location for 30 days. We delete the data stored under the identifier from the running system 90 days after your last visit. In our statistics, the first visit and the daily counts are kept permanently so that we can compare developments over several years.
We do not count automated access, for example by search engines.

When you create an account, we copy the details of your first visit to your account: time, referring page, first page, country, region, city, and browser language. This shows us how new readers find us.

Google Analytics

Google Analytics is an analytics service provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It loads when you open our pages. We do not ask for your consent for this.

Google Analytics sets cookies with a random identifier in your browser (_ga and _ga_…, valid for two years). The service uses them to tell whether a visit is new and which page views belong together.
With every page view, Google receives the address and title of the page, the page you came from, date and time, details of your browser, device, screen, and language, and your IP address, plus individual actions on the page: clicks on links to other websites, downloaded files, and how far you scroll. According to Google, the IP address is not stored and is only used to determine your approximate location.
We see aggregated reports, such as visitor numbers, countries of origin, the most-read pages, and the ways visitors find us. We cannot identify individuals in them. We do not use the advertising features of Google Analytics.
Google Analytics deletes data linked to individual identifiers after 14 months.
Google processes the data on our behalf, including on servers in the United States (section 16).

Google's privacy policy: https://policies.google.com/privacy

Legal basis and objection

The legal basis for both kinds of statistics is our legitimate interest in measuring the use of our site and in shaping it accordingly (Art. 6 (1) (f) GDPR). You may object to this processing at any time (section 18).

To do so, delete the vid, _ga, and _ga_… cookies in your browser and block them for mineralica.com, or write to us.

You can also turn off Google Analytics with a browser add-on from Google: https://tools.google.com/dlpage/gaoptout

5. Account

To create an account we need your email address and a password. We do not store the password in plain text, only as a hash. We send you a link to confirm your address. In your account you can add your form of address, name, and language as well as shipping and billing addresses with a phone number, and as a business your VAT identification number. We also store when you registered and when you last signed in.

The same account works for everything on mineralica.com. We have carried over accounts from our previous website.

The legal basis is the contract on the use of the account (Art. 6 (1) (b) GDPR). We store the data until you ask us to delete your account. A message to us is enough. Data we must keep for contracts and invoices remains stored until the statutory periods end (section 17).

6. Subscription

When you subscribe, we process your name, email address, shipping and billing addresses, your phone number if you provide one, the edition and language you chose, the term, the status of payments, and the issues we have sent you. We record when you agreed to which terms, and we keep the emails we send you about your subscription, such as the contract confirmation and the confirmation of a cancellation. This allows us to document the contract.

If you subscribe with an order form or at a show, we create an account for you.

For shipping, we pass your name and address on to the carrier that delivers your issues: Asendia, Deutsche Post, DHL, or Hermes. For deliveries to countries outside the European Union, the postal and customs authorities of the destination country also receive these details.

The legal basis is the subscription contract (Art. 6 (1) (b) GDPR) and, for keeping invoices and records, a legal obligation (Art. 6 (1) (c) GDPR).

Cancellation and withdrawal: If you use the pages "Cancel contracts here" or "Withdraw from contract here," the details you enter reach us by email, and you receive a confirmation at the address you provided.

7. Print shop

You can order issues as a guest or with your account. We process your name, email address, shipping and billing addresses, the issues ordered, and the status of payment and shipping. As a guest you receive a link by email that lets you reopen your order. We issue an invoice for every order and keep it.

For shipping, we pass your name and address on to the carrier that delivers your order: Deutsche Post, DHL, Hermes, or Asendia. For deliveries to countries outside the European Union, the postal and customs authorities of the destination country also receive these details.

The legal basis is the purchase contract (Art. 6 (1) (b) GDPR) and, for keeping the invoice, a legal obligation (Art. 6 (1) (c) GDPR).

8. Mineralica Auctions

On Mineralica Auctions, mineral specimens are sold at auction. Each lot names its seller.

Bids: When you bid, we store with your account the lot, the amount, the time, and your maximum bid if you enter one. With a maximum bid, our system keeps bidding on your behalf automatically, up to that amount. We do not show your maximum bid to anyone. With your first bid on a lot we also record which version of the auction rules and of the seller's terms applied, which shipping country you bid for, and which shipping costs we showed you for it. This lets us prove the contract.

Bid history: The bid history on every lot is public. For every bid it shows the amount, the time, and a neutral label such as "Bidder 1," but no name and no details from your account. It remains visible for as long as the lot is on the platform.

Purchase: If you win a lot, the purchase contract is concluded with the seller named on the lot. For your order we store the lots, the hammer price, the shipping costs, your shipping address, and the status of payment and shipping. Once you have paid, the seller receives your name and your shipping address, with your phone number if you provide one, so that the lot can be shipped. If the seller is a dealer other than Mineralica, that dealer is responsible for its own use of these data. For shipping, the carrier receives your name and address; for deliveries to countries outside the European Union, so do the postal and customs authorities of the destination country.

Payment: Payments are handled by Stripe (section 9). Stripe forwards the amount to the seller's Stripe account. We do not store your card for later payments.

Emails: For your bids and purchases we send you the emails that are part of the auction and the contract, including the confirmation of every bid, the notice when you have been outbid, the contract confirmation after the auction ends, payment reminders, and the messages about payment and shipping.

Favorites: With your account you can save lots, minerals, countries, and localities as favorites. We store them until you remove them or have your account deleted.

Order of lots: Sorting by popularity is based on how often a lot was viewed in the last 30 days. For this we use the count of views per page and day described in section 4.

Suspension: If we suspend an account because its holder has breached the auction rules, we store the email address, the time, and the notice shown at sign-in.

The legal basis is the contract on taking part in the auction and the purchase contract (Art. 6 (1) (b) GDPR), a legal obligation for keeping records (Art. 6 (1) (c) GDPR), and, for the public bid history and for protecting auctions against misuse, our legitimate interest in transparent and fair auctions (Art. 6 (1) (f) GDPR).

Storage period: We store bids permanently together with the lot, so that the result of an auction remains traceable. The public bid history contains no names. Section 17 applies to orders.

9. Payment

Payments are handled for us by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You enter your payment details, such as your card number or bank account, directly with Stripe. We neither see nor store them. We send Stripe your name, email address, postal address, language, and the amount, and Stripe tells us whether the payment succeeded and with which payment method.

For purchases on Mineralica Auctions, Stripe forwards the amount to the seller's Stripe account.

If you pay with PayPal, Apple Pay, Google Pay, by direct debit, or by bank transfer, the respective provider and the banks involved also receive the data needed for the payment.

Stripe also processes data as a controller in its own right to prevent fraud and to meet its own legal obligations, and may transfer data to the United States for this purpose. See Stripe's privacy policy for details: https://stripe.com/privacy

The legal basis is our contract with you (Art. 6 (1) (b) GDPR) and our legitimate interest in secure payment processing (Art. 6 (1) (f) GDPR).

10. Google Maps

On the pages of our show directory we show a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you open such a page, your browser loads the map directly from Google. We do not ask for your consent for this. Google receives your IP address and information about your browser and may set its own cookies. Google processes this data as a controller in its own right, including in the United States.

The legal basis is our legitimate interest in showing you the location of a show on a map (Art. 6 (1) (f) GDPR). You may object to this (section 18). If you do not want a connection to Google, you can block content from Google in your browser. The pages of the directory then remain usable without the map.

Google's privacy policy: https://policies.google.com/privacy

11. Protecting our forms

We protect our public forms against automated submissions with a method that runs on our own server: when you submit a form, your browser solves a small computational puzzle in the background. We set no cookie for this and pass no data on.

The legal basis is our legitimate interest in preventing misuse (Art. 6 (1) (f) GDPR).

12. Contact

When you write to us or call us, we process your details to handle your request. Depending on the request, the legal basis is our contract with you or our legitimate interest in answering inquiries (Art. 6 (1) (b) or (f) GDPR).

We only send you emails about your account, your orders, and your subscription. There is currently no newsletter.

13. Show directory

We publish dates of mineral shows with organizer, venue, and website. The information comes from publicly accessible sources, such as organizers' websites, registers, and the press, and from the organizers themselves. If the organizer is a private individual, we process their name and the contact details they have published themselves. For our work on the directory we also store organizers' contact persons with contact details and notes on our correspondence. We do not publish this information.

The legal basis is our legitimate interest, and that of collectors, in a reliable directory (Art. 6 (1) (f) GDPR). Organizers may have their entry corrected or deleted at any time and may object to its publication. A message to info@mineralica.com is enough.

14. Editorial content

In articles, captions, and on contributor pages we name people such as authors, photographers, collectors, and interviewees. Where we process data for journalistic purposes, only some provisions of the GDPR apply (Art. 85 GDPR, Section 23 of the German Interstate Media Treaty, Art. 38 of the Bavarian Data Protection Act, Art. 11 of the Bavarian Press Act). The rights of access, erasure, and objection apply there only to a limited extent.

If you believe that an article portrays you incorrectly or infringes your rights, please write to us. We review every report.

We run profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and a page of links on Linktree (Linktree Pty Ltd, 1-9 Sackville Street, Collingwood VIC 3066, Australia). When you visit them, the operator processes your data as a controller in its own right: Meta also for advertising and also in the United States, Linktree also in Australia and the United States. We receive aggregated statistics about visitors to our profiles from the operators, from which we cannot identify individuals. For these statistics on Facebook ("Page Insights"), Meta and we are joint controllers. Meta has undertaken to inform you about this and to fulfill your rights: https://www.facebook.com/legal/terms/page_controller_addendum

The legal basis is our legitimate interest in reporting on our work and staying in conversation with readers (Art. 6 (1) (f) GDPR). You can assert your rights against the operator and against us.

Privacy notices of the operators: https://privacycenter.instagram.com/policy · https://www.facebook.com/privacy/policy · https://linktr.ee/s/privacy

We do not embed social media content on mineralica.com itself. There are only links.

16. Recipients and transfers to other countries

Your data is only received by parties we need for the purposes described:

Amazon Web Services EMEA SARL, Luxembourg: servers, storage, and email delivery, located in Frankfurt am Main; our email mailbox, located in Ireland
MongoDB Limited, Ireland: database, located in Frankfurt am Main
Stripe Payments Europe, Limited, Ireland, and, depending on the payment method, other payment providers and banks
Sellers on Mineralica Auctions from whom you have bought a lot: your name and your shipping address
Deutsche Post, DHL, Hermes, and Asendia: shipping
Google Ireland Limited: visitor statistics (Google Analytics) and maps (Google Maps)
our tax advisor and lexoffice, our accounting software
service providers who support us in operating and developing our software
public authorities where we are legally obliged

Some of these companies belong to groups based in the United States or process data there. Such transfers are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's standard contractual clauses.

17. Storage periods

Server logs: 30 days
Visitor statistics: as described in section 4
Bids on Mineralica Auctions: as described in section 8
Account: until you ask us to delete it
Records of orders and subscriptions, including the related emails: three years after the end of the contract, counted from the end of the year
Invoices and accounting records: eight years; business letters and emails: six years (Section 147 of the German Fiscal Code, Section 14b of the German VAT Act)
Entries in the show directory: as long as the show or the organizer is relevant to the directory

18. Your rights

You may ask us for access to your data (Art. 15 GDPR), have incorrect data corrected (Art. 16), have data erased (Art. 17), have processing restricted (Art. 18), and receive the data you gave us in a commonly used format (Art. 20). You may withdraw consent at any time with effect for the future (Art. 7 (3)).

For any of this, a message to info@mineralica.com or to our postal address is enough.

You may also lodge a complaint with a data protection supervisory authority, for example where you live. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

19. Required information and automated decisions

For an account, an order, a subscription, or a bid we need the details marked as required in the forms. Without them we cannot conclude or perform the contract. All other details are voluntary. Our system determines who wins an auction from the bids placed, under the auction rules; this is necessary for concluding the purchase contract (Art. 22 (2) (a) GDPR). We do not make any other decisions that are based solely on automated processing and that legally affect you.

20. Changes to this policy

We update this policy when our services or the law change. The version published here applies.