Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:

TrustMedia LLC
530-B Harkle Road Ste 100
Santa Fe, NM 87505
USA

Contact from Germany:
Phone: +49 30 890 929 36
Fax: +49 30 890 929 41
Email for enquiries about trading-spotter.com: imprint@trading-spotter.com

Data protection requests can be sent to the same address. The controller can also be reached at trading-spotter.com.

2. Hosting and server log files

2.1 Hosting

trading-spotter.com is operated on the infrastructure of ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf. The hosting provider processes all data technically generated when the website is accessed exclusively on behalf of and in accordance with the instructions of the controller; the processing is carried out as processing by a processor within the meaning of Art. 28 GDPR. The legal basis for using a hosting provider is Art. 6(1)(f) GDPR; the legitimate interest lies in providing the service in a technically secure and reliable manner.

2.2 Server log files

Each time the website is accessed, the web server automatically collects data transmitted by the browser and stores them in log files. The following are collected:

• the page and file accessed and the amount of data transferred
• date and time of access
• the HTTP status code
• the browser type and browser version
• the operating system used
• the referrer URL (the previously visited page)
• the IP address of the accessing device

These data are not combined with other data sources. The processing serves the secure and stable operation of the website, the defence against attacks and error analysis. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the security and functionality of the service.

The log files are stored for as long as is necessary for the operation and security of the website and are then deleted.

The website's search function processes the search term entered exclusively on its own server in order to display results. The search term is stored in the server log files as part of the address accessed.

3. Cookies and consent management

3.1 Technically necessary cookies

The website sets the following cookies, which are necessary for its operation and do not require consent:

• Cookies with the prefix “cmplz_”: they store which cookie categories a user has accepted or rejected. Storage period: 365 days.
• Cookie “pll_language”: it stores the selected language version so that the appropriate language is displayed on the next visit. Storage period: one year.

The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR. The legitimate interest lies in displaying the website in the selected language and in respecting consent decisions that have been made.

3.2 Consent management (cookie banner)

A cookie banner appears on the first visit. It is generated by the WordPress plugin “Complianz”, which runs on the website's own server; no data are transferred to the plugin's manufacturer in the process. Analytics and marketing technologies are loaded only once the “Marketing” category has been confirmed. Consent can be changed or withdrawn at any time with effect for the future via the “Cookie settings” link in the footer of the website.

The decision is stored in the “cmplz_” cookies mentioned under 3.1. The legal basis for storing the decision is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(c) GDPR (obligation to demonstrate consent under Art. 7(1) GDPR).

4. Analytics and marketing services (only with consent)

The following services are loaded only if the “Marketing” category has been confirmed in the cookie banner. Without this consent, no connection to the providers named is established. In all cases, the legal basis is consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Consent can be withdrawn at any time via the cookie settings; the lawfulness of processing carried out before the withdrawal remains unaffected.

4.1 Google Tag Manager

After consent has been given, the website loads Google Tag Manager (container ID GTM-KBWD2D6D) from the server www.googletagmanager.com. Tag Manager is an administration tool that launches the services mentioned under 4.2 and 4.3. When it is loaded, the user's IP address is transmitted to Google.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy information: https://policies.google.com/privacy

4.2 Google Analytics 4

Via Tag Manager, Google Analytics 4 is launched with the measurement ID G-5MEZMTT6HG. Google Analytics records page views and the following interactions: clicks on phone and email links, reaching 75 per cent of the page length, scroll depth in steps of 25, 50, 75 and 90 per cent, clicks on labelled buttons, share actions, clicks on external links (including partner links) and the submission of the contact form and of the briefing sign-up. For form events, the language, the selected topic and the page path are transmitted, not the content entered.

Google Analytics sets cookies with the prefix “_ga” and processes the IP address in truncated form. From the data, Google creates pseudonymous usage profiles and statistics, which are made available to the controller for evaluating the use of the website. Google may also process these data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR).

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy information: https://policies.google.com/privacy. Option to object via the browser add-on: https://tools.google.com/dlpage/gaoptout

4.3 Microsoft Clarity

Via Tag Manager, Microsoft Clarity (project ID wrppaydj78) is loaded from the server www.clarity.ms. Clarity records how users interact with the website (mouse movements, clicks, scrolling, session recordings and heatmaps) and sets cookies for this purpose, including cookies named “_clck” and “_clsk”. The data are used to analyse and improve the website. Microsoft may also process the data in the USA; Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Privacy information: https://privacy.microsoft.com/de-de/privacystatement

5. Briefing by email (newsletter)

The website offers the option of subscribing to a market briefing by email. This requires entering an email address and confirming the consent field. On submission, the following are stored:

• the email address
• the language version in which the sign-up took place
• date and time of the sign-up
• the consent
• a cryptographically hashed form of the IP address (the IP address itself is not stored)

Sign-up takes place using the double opt-in procedure: after submission, a confirmation email is sent to the address provided; the briefing is sent only after the confirmation link has been clicked. Logging the sign-up serves to demonstrate consent and to prevent misuse.

The Brevo service is used for sending and for managing the recipient lists. The email address and the language assignment are transmitted to Brevo; Brevo processes the data on behalf of the controller as a processor pursuant to Art. 28 GDPR. The sender address of the briefing is briefing@trading-spotter.com.

Provider: Brevo (Sendinblue SAS), 7 rue de Madrid, 75008 Paris, France. Privacy information: https://www.brevo.com/de/legal/privacypolicy/

Brevo provides performance tracking for mailings, whereby tracking pixels embedded in the email can record whether and when a message was opened and which of the links it contains were accessed. Where this performance tracking is active for the briefing, it serves to evaluate and improve the mailings. The legal basis is consent pursuant to Art. 6(1)(a) GDPR. Anyone who wishes to exclude this performance tracking can disable the automatic loading of images in their email program or unsubscribe from the briefing.

The legal basis for receiving the briefing is consent pursuant to Art. 6(1)(a) GDPR. Consent can be withdrawn at any time, via the unsubscribe link in every briefing email or by sending a message to the contact address stated in section 1. After withdrawal, the email address is removed from the mailing list.

The sign-up data are stored on the website's server for as long as the briefing is received and, beyond that, as proof of the consent given. There is no automatic deletion after a fixed period; at the request of a data subject, the sign-up data will be deleted unless a statutory retention obligation prevents this.

6. Contact form

The contact form can be used to submit enquiries about content, partnerships and technical questions. Mandatory fields are name, email address, topic and message, as well as confirmation of the consent field. On submission, the following are stored:

• name and email address
• the selected topic and the message text
• the language version
• date and time of submission
• a cryptographically hashed form of the IP address

The enquiry is stored in the website's database and retrieved from there by the controller; it is not transmitted to third parties. The processing serves to answer the enquiry. The legal basis is consent pursuant to Art. 6(1)(a) GDPR; where the enquiry is aimed at a contract or a partnership, additionally Art. 6(1)(b) GDPR.

Enquiries are stored for as long as they are being dealt with. Technically, the system retains at most the last 300 enquiries; older entries are overwritten when new enquiries are received and are then no longer available. At the request of a data subject, an enquiry will be deleted unless a statutory retention obligation prevents this.

Alternatively, contact is possible by email to the address stated in the legal notice. Emails are stored for as long as the correspondence continues and statutory retention obligations require.

7. Calculators and tools in the browser

The calculators offered on the website (including the pip value calculator, the position size calculator and the risk/reward calculator), the trading journal and the watchlist run entirely in the user's browser. Entries are stored in the browser's local storage (localStorage) so that they are available again the next time the same page is accessed. These data do not leave the device and are not transmitted to the server or to third parties. They can be removed at any time by deleting the website data in the browser. The legal basis is Section 25(2) no. 2 TDDDG, as storage is necessary for the function requested by the user.

8. Market data

The price and market data displayed on the website are retrieved by the trading-spotter.com server from public data sources and delivered to the browser. The user's browser connects only to trading-spotter.com; no personal data of the user are transmitted to the data sources.

9. Partner links (affiliate links)

The website contains labelled links to brokers, platforms and products for which the controller may receive a commission when an account is opened or a product is used. When clicking on such a link, the user leaves trading-spotter.com; from that point on, the privacy policy of the respective provider applies. The click itself is recorded as an event in Google Analytics only if consent has been given in accordance with section 4.2. trading-spotter.com does not transmit any data to the partner; partners can recognise from the link address that the visit originated from trading-spotter.com.

10. What the website does not use

For clarification: trading-spotter.com does not embed fonts from third-party servers, videos, maps, social media plugins, advertising networks, payment services or captcha services. There is no comment function and no user registration. Should this change, this privacy policy will be updated.

11. Recipients and transfers to third countries

Recipients of personal data are the hosting provider (section 2), Brevo (section 5) and, only with consent, Google and Microsoft (section 4). Google and Microsoft may process data in the USA; both companies are certified under the EU-U.S. Data Privacy Framework, for which there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

The controller itself has its registered office in the United States. Insofar as it accesses the data stored in accordance with sections 5 and 6, a transfer to a third country takes place. This transfer is necessary in order to provide the service requested by the user: answering the contact enquiry and sending the briefing. For contact enquiries, the transfer is based on Art. 49(1)(b) GDPR; for the briefing, on explicit consent pursuant to Art. 49(1)(a) GDPR.

Data subjects are expressly informed that there is no general adequacy decision of the European Commission for the United States. The adequacy decision on the EU-U.S. Data Privacy Framework applies only to companies that have certified themselves under it. In the case of a transfer to a non-certified company in the United States, a level of data protection equivalent to European law cannot be guaranteed; in particular, public authorities may have access rights against which no legal protection comparable to that in the Union is available. Anyone who does not wish this transfer to take place can refrain from using the contact form and the briefing; the content and tools of the website can be used in full without these functions.

12. Data subject rights (your rights)

Data subjects have the following rights vis-à-vis the controller:

• access to the personal data processed (Art. 15 GDPR)
• rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
• erasure, unless a statutory retention obligation prevents this (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a commonly used, machine-readable format (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR, on grounds relating to the particular situation of the data subject (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

A message to the contact address stated in section 1 is sufficient to exercise these rights.

13. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). In particular, the supervisory authority competent for the data subject's place of residence is responsible; in addition, the complaint may be lodged with the supervisory authority of the place of work or of the place of the alleged infringement.

14. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on the website.

15. Obligation to provide data

The website can be used without providing personal data. For the briefing (section 5) and the contact form (section 6), the mandatory fields indicated in each case must be completed; without this information, the respective function cannot be used.

16. Changes to this privacy policy

This privacy policy will be updated as soon as the services used, the legal situation or the offering change. The version published on this page at any given time is authoritative.

Last updated: 8 September 2026