Privacy Policy
Aurum Invest AB • Last updated: 2026-01-22
Your security is our top priority. In this privacy policy, we describe how MittGuld (Aurum Invest AB, reg. no. 559458-4723) processes your personal data to provide a secure, transparent, and smooth service for the sale of precious metals.
We process data when you use our website, order a Gold Envelope, identify yourself with BankID, or communicate with our customer service.
We only process the data required to conduct a secure transaction:
- Contact Information: Name, email, phone number, and address.
- Registry Data (SPAR): We fetch and verify your registered address via the Swedish State Person Address Register (SPAR). We do this for your security, to ensure that your Gold Envelope is sent to the correct person and that the transport insurance remains valid.
- Identification: Personal identity number via a secure connection to BankID.
- Transaction Data: Case number, valuation details (weight/purity), payout details (bank account/Swish), and history.
- Communication: Logs from customer service cases via email, SMS, or phone.
- Technical Data: IP address, device information, and cookies (if you consent).
We process your data based on the following grounds:
- Performance of Contract: To be able to send your envelope, value your items, and complete your payout.
- Legal Obligation: To comply with the Bookkeeping Act and regulations regarding trade in used goods (police control).
- Legitimate Interest: To prevent fraud and ensure a secure service.
- Consent: For statistics and marketing via cookies.
We never keep your data longer than necessary:
- Accounting Records: 7 years as required by law.
- Customer Service Cases: Normally 24 months after the case is closed.
- BankID Logs: 12 months for traceability and security.
- Image/Video Documentation: Upon receipt, we save documentation for 30–90 days to minimize the risk of errors.
We never sell your data. We only share information with trusted partners required for the service:
- PostNord: For secure transport of your items.
- Banks/Swish: For your payout.
- Authorities: Only in case of a statutory obligation (e.g., the Police or the Swedish Tax Agency).
- IT Partners: For secure operation and storage (e.g., Supabase and Google Cloud).
According to GDPR, you have the right to:
- Obtain an extract of the data we hold about you.
- Request correction of inaccurate data.
- Request erasure (with the exception of data we must keep by law, e.g., bookkeeping).
- Restrict processing or object to processing.
Contact us at [email protected] to exercise your rights.