Privacy policy

1. Data protection at a glance

General information

The following instructions provide a simple overview of what happens to your personal data when you visit our website. Personal data is all data with which you can be personally identified.

This privacy statement also applies specifically to the use of the Metal price calculator and the Online sales on mkm-metals.de. It explains which data are processed in the context of the calculation and, if the sale is carried out, in the context of the processing.

Data collection on our website

The data processing on this website is carried out by the website operator:

MKM Metals e.K.
Holder: Mubarik Ahmad
Registry Court: Ludwigshafen District Court on the Rhine, HRA 61664
Industriestraße 4
67063 Ludwigshafen am Rhein
Telephone: +49 176 6577 0862
E-Mail: [email protected]

How do we collect your data?

Your data will be collected on the one hand by informing us about them – for example via a form or when you complete a sale. Other data is automatically collected by our IT systems when you visit the website. These are mainly technical data (e.g. B. Internet browser, operating system or time of page call). The collection of this data takes place automatically as soon as you enter our website.

What do we use your data for?

Part of the data is collected to ensure error-free provision of the website. We use the data from forms and sales to process your request or sale.

2. General information and mandatory information

Privacy

The protection of your personal data is very important to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations as well as this privacy policy.

Notice to the responsible body

The party responsible for processing data on this website is:

MKM Metals e.K.
Holder: Mubarik Ahmad
Registry Court: Ludwigshafen District Court on the Rhine, HRA 61664
Industriestraße 4
67063 Ludwigshafen am Rhein
Telephone: +49 176 6577 0862
E-Mail: [email protected]

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke your consent at any time. For this purpose, an informal message by e-mail is sufficient. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right of appeal to the competent supervisory authority

In the case of data protection violations, the data subject shall have a right to lodge a complaint with the competent supervisory authority. For us is responsible:

The State Commissioner for Data Protection and Freedom of Information
Rhineland-Palatinate
Rear bleach 34
55116 Mainz
Telephone: 06131 208-2449
E-Mail: [email protected]
<https://www.datenschutz.rlp.de>

You can also contact the supervisory authority of your habitual place of residence.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format.

3. Data collection on our website

Session cookie

This website uses a technically necessary session cookie. It keeps your shopping basket and your entries together while you are using the site, and becomes invalid when closing the browser or after short inactivity. It does not contain any evaluation of your behavior and does not come from any third party. The legal basis is Art. 6 para. 1 lit. f GDPR (technical operation of the page). We do not use advertising, statistics or tracking cookies.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of server request
• IP address

This data will not be merged with other data sources. The log files are usually deleted after 30 days at the latest at the hosting provider, unless security-relevant further storage is required. The legal basis is Art. 6 para. 1 lit. f GDPR (operational security, error analysis, misuse detection).

Range measurement (own, cookieless statistics)

To improve our offer, we include page views with our own server-side statistics – without cookies and without third-party providers. Only the page path called up, the date, the domain of origin (if transferred), the device class (mobile/desktop) and an anonymous, daily changing code are stored, which is calculated from technical data. The IP address itself will not be stored; it is not possible to draw conclusions on individual persons or to pursue them over several days. The legal basis is Art. 6 para. 1 lit. f GDPR (anonymous range measurement to improve the offer).

Contact and inquiry forms

If you send us inquiries via the form, your information from the form including the contact details provided by you will be stored for the purpose of processing the request and in case of follow-up questions. We will not share this data without your consent.

Optionally you can request your Photos of the material add (up to ten pictures). They are used solely for the evaluation of your material, are stored on our own server in a not publicly available directory and can only be viewed for registered employees. With the request they will be deleted. The legal basis is Art. 6 para. 1 lit. b GDPR (pre-contractual measure).

4. What data do metal price calculators and online sales process?

4.1 Computer inputs (calculation data)

The metal price calculator processes the data you enter for price/value calculation, e.g. B.:

• ==References== Variety
• Weight/volume
• selected transfer route (shipping, pick-up, self delivery)

These entries are not personal in themselves. A personal reference arises in particular when in the course of a sale additional personal data (e.g. B. Name, contact/address data).

4.2 Temporary storage in case of incomplete sale

If the sale is not carried out, the metal price calculator stores the entered data only temporarily in the session so that the process can be continued (e.g. For example, when re-navigating or re-calling within a short time).

• Purpose: Comfort function / continuation of the process
• Type of storage: Session memory on the server linked via the session cookie
• Deleted: automatically at the end of the meeting, no later than 24 hours

4.3 Storage in case of completed sale (delivery data)

When the sale is carried out, we store the data required for processing internally on our own webspace: name, if applicable. Company, address, e-mail address, if applicable Telephone number, materials and quantities sold, the chosen transfer route as well as – in case of payment by bank transfer – account holder and IBAN. This data will only be used

• used within the company; or
• This is the case in the case of a third party, insofar as this is necessary for the performance of the order. This is not the case in the United Kingdom, where sales are required (see 4.5).

4.4 No use of external course APIs with your data

For the price calculation itself, no data is transmitted to external providers; the calculation takes place completely on our server.

4.5 Transfer to DHL during parcel delivery

Select the transfer path Package delivery, we create DHL shipping labels for you. To do this, we will send your name and address to DHL Paket GmbH or DHL Packet GmbH. Deutsche Post AG. The transmission is necessary for the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR). DHL processes the data as an independent controller for transport; you can find information about this in the DHL Privacy Policy.

4.6 Purposes of processing

We process data in connection with computers and sales for the following purposes in particular:

1. Provision of the computer function and execution of calculation
2. Temporary cache for continuation of a process
3. The transaction of a closed sale (incl. Shipping labels, communication and payout)
4. Operational security, error analysis, misuse and attack detection

4.7 Legal basis (GDPR)

• Article 6(1)(b) GDPR (contract / pre-contractual measures): if the processing is necessary for the execution of the sale or the initiation of a contract – including the transfer to DHL for shipping labels.
• Art. 6 para. 1 lit. f GDPR (legal interest): for safe and stable operation (e.g. B. Log files, abuse prevention) and for temporary intermediate storage to continue a process.
• Art. 6 para. 1 lit. c GDPR (legal obligation): insofar as statutory retention obligations (e.g. This is the case in the United Kingdom, where sales have been completed.

4.8 Recipients / Transfer to third parties

A transfer to third parties takes place only if this is done for the fulfilment of the order or. Sales are necessary or there is a legal obligation. The beneficiaries are currently:

• DHL Paket GmbH / Deutsche Post AG for the creation of shipping labels during parcel shipment (see 4.5)
• Hosting Providers our website in the context of technical operation (order processing)

4.9 Storage duration and deletion

Discontinued operations: Inputs that are cached only for the continuation of an unfinished process will be automatically deleted at the end of the session, no later than 24 hours.

Sales completed: Data from completed sales will be stored for the period required for contract execution and then stored in accordance with the statutory retention periods (usually six or ten years according to commercial and tax law). After that, they are deleted or anonymized unless there are any other legitimate reasons for storage.

Server log files: See section 3.

5. Third party services used

Fonts

The font "Inter" used is delivered by our own server. A connection to Google Fonts or another third party provider does not take place; no data is transmitted to third parties.

Google reviews (Places API)

On our website, we show reviews that users have posted on Google about our company. The retrieval of these evaluations is done exclusively from our server; no data from our website visitors are transmitted to Google. Shown are the name of the author, the rating and the text published by Google.

Google Maps (Map to our location)

On the pages "Location Ludwigshafen" and "Contact" we include a map showing our recycling yard. It is provided by Google in a framework (storage.googleapis.com, behind it the Google Maps Platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

When these two sides are called up your IP address transmitted to Google; the card cannot be delivered without it. We do not pass on any further information about your person, and the card is not linked to any sales process or to any input from you. Google can set cookies and process the data under its own responsibility depending on your browser settings; for more information, see Google's privacy policy.

The legal basis for this is our legitimate interest in the fact that you can recognize the way to our farm before the journey, Art. 6 para. 1 lit. f GDPR.

You can bypass the map. The full address is directly below and in the imprint, and all other pages of our website do not include a map. If you want to avoid transmission, do not call these two pages and find the address in the imprint instead.

DHL (shipping labels)

See Section 4.5 – when sending parcels, we send the name and address to DHL for the creation of shipping labels.

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use this to evaluate how our pages are used to improve them.

Only after your consent. On the first visit we ask you with a hint at the bottom. As long as you haven't agreed, Google Analytics will not loaded: There is no connection to Google, no analysis cookie is set, and your IP address is not transmitted. Only with "accept all" the measurement begins.

You have three options: None (nothing will be saved, not even your decision – we ask again on the next visit), Essential only (no measurement; only your decision is stored) and Accept all. The session cookie for your sales basket and the protection of forms remains in all three cases – without it no sale would be possible.

You can change your consent at any time. In the footer of each page, the link "Cookie Settings" stands for this; a click on it opens the selection again, marked with the currently valid setting.

If you agree, the Google tag will be loaded. Cookies are set on your device and data is transmitted to Google.

In particular, we process: abbreviated IP address, pages accessed, time and duration of the visit, referring page, used browser and device type as well as a random identifier that is stored in cookies. This data can also be transferred to Google servers in the USA. For the USA, an adequacy decision is taken by the EU Commission (EU-US Data Privacy Framework); Google LLC is certified under this framework. With Google there is a contract for order processing.

Legal basis is your Consent pursuant to Art. 6 para. 1 lit. a DSGVO; for storing and reading information on your device at the same time § 25 para. 1 TTDSG. You can revoke your consent at any time with effect for the future – via the reference "cookie settings" in the footer. The legality of the processing carried out until then remains unaffected.

==References== October 2026 we based this processing on our legitimate interest. We've changed that and we've been getting our consent since 3. ==References====External links==

Advertising related functions are disabled: We do not transmit data for personalized advertising (Google Consent Mode with ad_storage, ad_user_data and ad_personalization ==References====External links==

To finish the measurement. The easiest way to use "cookie settings" in the foot area is to select "technically necessary" or "no cookies", and the measurement ends immediately. In addition:

• Browser add-on from Google: <https://tools.google.com/dlpage/gaoptout> – it prevents transmission permanently, on all websites.
• Delete and block cookies: In the settings of your browser, you can remove the cookies set and block future ones from google-analytics.com and googletagmanager.com.

You can also contact us at any time – the contact details are listed in Section 2.

What we bring back from Google Analytics. Since October 2026, we have been downloading the evaluation to our own administration so that we do not have to look it up at Google. Flowing none additional data from you to Google: All sums already made – number of users and meetings, pages accessed, channels of origin, types of devices and countries are retrieved. Individual visits or even persons are not included in it and cannot be made for us. The retrieval runs from our server via a technical account at Google; your browser is not involved.

Our own, cookieless range measurement (Section 3) runs independently. It can do without cookies and without third parties. The two series of figures inevitably differ: Google only counts visits where the transmission is technically effected, our measurement counts all calls.

Live Chat (Crisp)

At the bottom right of our pages there is a button "Chat". You can write us about them directly during our business hours, for example, to clear a grade before you sell.

The chat will not be loaded without your consent. The button is part of our own site; until you agree, there is no connection to Crisp, no cookie is set and no data goes there. Click on the button without agreeing to it, first the cookie selection opens. Only after "accept all" the chat is loaded and opened.

The provider is the Crisp in SAS, 2 Boulevard de Launay, 44100 Nantes, France (SIREN 833085806). According to the provider, the core systems are located in Amsterdam, Netherlands. With Crisp there is a contract for processing orders; in case of transmission to a third country Crisp is based on standard contractual clauses.

This is the case in the Content of your messages, your IP address, the page accessed, browser and device type as well as the information you voluntarily provide in the chat – such as name or email address, so that we can respond when you have left the page. According to the provider, the chat sets cookies with the names crisp-client-session-* and crisp-client-*. You assign your device to a conversation so that it is still there when you change pages and later visit, and run after 6 months ==References== They are not used to track your behavior on our website.

Legal basis is your Consent pursuant to Art. 6 para. 1 lit. a DSGVO; for storing and reading information on your device at the same time § 25 para. 1 TTDSG. You can revoke them at any time with effect for the future – via the reference "Cookie Settings" in the footer of each page.

If you send us a message, we will store it at Crisp as long as we need it for the processing of your request and for inquiries. If the interview results in a sale, the retention periods of Section 4 apply.

Next to the button appears a short hint "How can I help?". He's on our own side, not Crisp. Your browser remembers that you closed it for the duration of your visit (sessionStorage; when closing the browser window, this information is forfeited and it is not transmitted to us.

You can bypass the chat. We are also available on the phone number and e-mail address in Section 2 – without Crisp or cookie.

Google customer reviews

After you have registered a sale online, we will show you an invitation from Google on the confirmation page: You can voluntarily agree to be asked about your experience with us later by e-mail.

In order for this invitation to appear, Your e-mail address, your transaction number, your country and an expected closing date to Google. This transmission takes place as soon as the confirmation page is loaded – so before you decide on your participation. Do not participate, Google does not use the information for a survey according to its own statement.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to the USA is not excluded; Google relies on the EU-US Data Privacy Framework and standard contractual clauses.

In addition, on all sides we bind the Assessment marks by Google (merchantwidget.js from www.gstatic.com). Your IP address will be transmitted to Google; an e-mail address or other information about your person will not be used for this.

The legal basis is our legitimate interest in meaningful customer reviews according to Art. 6 para. 1 lit. f GDPR. You can use this processing after Art. 21 GDPR object – an informal message to [email protected] is sufficient; we will then take your process from the transmission. If you take part in the survey, Google will process your answer under its own responsibility; for more information, see Google's privacy policy.

We do not use any other analysis, advertising or social media services.

On two pages we include a map of Google; your IP address goes to Google. Which pages are these and how you avoid them, is at the top of "Google Maps".

6. User account and profile

An account is voluntary. You can sell scrap metal as a guest without registering – you will receive the same confirmation and credit via e-mail. Those who create an account see their sales collected in it.

6.1 What data the account processes

When you're working on it: E-mail address and a password chosen by you. We save the password not in plain languageBut only as a hash value – we can't read it and we can't tell you either.

In the profile, mandatory: Name, telephone number, street, postcode and place. We need this information for processing your sales – payout, shipping label, credit.

In profile, voluntary: Company, VAT number, country.

Automatic: Date of registration, date of confirmation, date of last registration.

6.2 Confirmation of your e-mail address

After creating a message, we will send you a link. Only with the click the account is activated. This is not a formality: Your account contains your sales with amounts and credits, including those you previously made as a guest. Without this step, someone could type in a foreign address and see what they are doing.

The email address connects your account to your sales and can therefore not be changed in the profile. If she's changed, write to us.

6.3 Identity document – voluntary and particularly protected

You can deposit an ID. This is voluntary and not a requirement for sale. From €1,000 payment, the Money Laundering Act (§§10 ff. GwG) proof of identity; those who deposit it in advance do not have to re-submit it on each payment. Otherwise, the template will suffice at the handover.

An identification card contains name, date of birth, address, photograph and identification number. We treat him differently than any other data:

• Encrypted stored. The file is not in the original on our server, but encrypted with AES-256-GCM. The key is separate from it and not in the program code.
• Unreachable via the network. The storage location is locked for browsers; the file bears a random name without reference to your person.
• Can only be seen with explicit authority. Insight into ID cards is a separate right in our rights management and not part of the general processing. Employees who process operations do not have it automatically.
• Every access is logged – with time and person, even if you look at your document yourself.
• You can remove it at any time. The file will then be deleted. An already performed test report remains as proof – we must be able to prove the fact of the test, the picture does not.

6.4 Legal basis

Account and profile: Article 6(1)(b) GDPR – Initiation of contracts and performance of contracts. We need the information in the profile to be able to handle a sale.

ID document: your Consent pursuant to Art. 6 para. 1 lit. a GDPR – You upload it voluntarily and can remove it at any time. If it is used for identification under the Money Laundering Act, it shall: Art. 6 para. 1 lit. c GDPR (legal obligation).

Minutes of the visits: Art. 6 para. 1 lit. f GDPR – our legitimate interest in understanding who has viewed an ID document. This interest is also yours.

6.5 Storage duration

The account as long as you use it. Write to us if you want it deleted; we will delete it if no statutory retention period is precluded. Data from completed sales are subject to the deadlines set in Section 4.9 – so they will continue to exist even after the account has been deleted, but without access to it.

An unconfirmed accountthat nobody unlocks, we delete after 30 days.

The identity document We will delete it as soon as you remove it, and in any case no later than when it is no longer needed for identification. If it has been used for identification under the Money Laundering Act, the retention period of five years will apply there (§ 8 para. 4 GwG).

The Access Log Let's keep it for 12 months.

6.6 Registration via Google

Instead of using e-mail and password, you can also use Google Sign up. This is voluntary; the usual way with e-mail address and password remains beside it, and for sale you still do not need an account.

What's happening. If you click on "Continue with Google", we will forward you to Google. You can register there – We never see your password. Google learns that you would like to register with MKM Metals and then transmits to us:

• one Identification codewhich you clearly identify with Google,
• Your Email address and whether Google has confirmed it,
• Your Google stored Names.

That's all we ask. We use only the permissions openid, email and profile. We have no access to and cannot request your emails, calendars, contacts or files.

What we store. The Google ID, the email address and the time of the last login – in a separate table, separated from your account. Connected is via the identifier and not via the e-mail address: So the connection remains when you change your address at Google.

When we connect to an existing account. Only if Google expressly confirms to us that the e-mail address is proven there. Without this confirmation, we neither create an account nor connect one – otherwise someone with a foreign address could gain access to a foreign sales history.

Legal basis: Art. 6 para. 1 lit. b GDPR – Contract initiation and contract performance. The decision to use this route is made.

Data transmission to the USA. The controller is Google Ireland Limited; data can be transmitted to Google LLC in the USA. Google is following the EU-US Data Privacy Framework certified, for which the EU Commission has identified an appropriate level of protection. However, a residual risk of US authorities accessing data cannot be ruled out. If you want to avoid this, use the login with e-mail and password.

Unlock the connection. In your profile you can disconnect the connection at any time. If it is your only access, first assign a password there – otherwise you won't be able to enter your account. Regardless of this, you can also revoke access in your Google account under "Third-party apps with account access".

We do not offer registration via Facebook.

7. Changes to this Privacy Policy

We reserve the right to adjust this privacy policy occasionally, so that it always complies with current legal requirements or in order to implement changes to our services in the privacy policy.

8. Your rights

You have the following rights under the GDPR in particular:

• Information (Article 15 GDPR)
• Correction (Art. 16 GDPR)
• Deletion (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Revocation of consent (Art. 7 para. 3 GDPR), if processing is based on consent

To exercise your rights, please send a message to: [email protected]. There is also a right of appeal to a data protection supervisory authority.

9. Data security

We take technical and organizational measures to protect data against loss, manipulation and unauthorized access. Specifically:

• Encrypted transmission the whole website (TLS/HTTPS).
• Passwords as hash value onlyNever in plain language. We can't read your password.
• Rights management with individual forgiving rights. Employees see only what their role explicitly permits; insight into ID documents is a separate right and not part of the general processing.
• ID documents encrypted on the data carrier (AES-256-GCM), with separate key, random file name and a storage location that is not accessible over the network.
• Logging of each access on identification documents.
• Protection against page embedding and foreign scripts via a content security policy.

No procedure is completely safe. If you have the impression that something is wrong with your data, write to us – we'll follow up on it.

10. State of play and changes

This Privacy Policy has the status: 03.10.2026. We update it when features of the website or legal requirements change.