Collectibles Grading & Verification Lab
Privacy
Information about the processing of your personal data.
Data controller
Robbyn GerhardtCollectibles Grading & Verification Lab · Sole proprietorship
Kirchkette 12
59846 Sundern-Hövel
Germany
Contact
Email address: kontakt@cgvl.eu
Hosting and server logs
The hosting provider for this website is Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. Infomaniak operates its data centres in Switzerland and processes hosting data as a technical service provider.
When you access the website, data processed include your IP address, time, requested address, response status and, where applicable, browser information and referring page. This supports delivery, error analysis and security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Log data are needed only for as long as operational and security purposes or the investigation of specific incidents require.
The European Commission has adopted an adequacy decision for Switzerland. Transfers may rely on this under Article 45 GDPR.
Cookies and browser storage
This website uses no analytics or advertising trackers. Fonts and images are served from our own website. No external videos, maps or social media plugins are embedded.
Necessary storage supports the functions you request. Your language is stored only after you select it. The access key is stored only for your order. The basis for this storage is section 25(2), no. 2 of the German TDDDG. Depending on the function, subsequent processing serves pre-contractual steps or contract performance under Article 6(1)(b) GDPR, or security under Article 6(1)(f) GDPR.
No consent to analytics or advertising is requested for these functions. You can delete website data in your browser. Without session storage, sign-in, ordering or order access may be restricted. A separately saved private access link can restore access to your order.
| Storage | Purpose | Duration |
|---|---|---|
| rgc_session | Session cookie for secure form requests, sign-in and order access. | For the browser session; browsers may restore sessions. |
| rgc-language | Stores only the language you select in local browser storage. | Until you reset the language or delete website data in your browser. |
| rgc-order-… | Stores an order’s private access key in this tab’s session storage. | Until the tab session ends or session storage is cleared. |
Contact and enquiries
Our email mailbox and the destination mailbox of our email forwarding are operated by Infomaniak. Infomaniak processes the message and connection data required to receive, forward, store and send emails.
When you contact us, we process the contact details and messages you provide to handle your enquiry. Contract-related enquiries rely on Article 6(1)(b) GDPR; other enquiries rely on our legitimate interest in responding under Article 6(1)(f) GDPR. Your contact is the controller named above.
Submissions and order processing
Category, service and card count are sent to the server to calculate prices. While you fill in the form, contact and address details initially remain in the page’s working memory. They are transmitted only when you submit an enabled order.
For an order, we process first and last name, email address, shipping address, an optional phone number, selection, price, order number and payment and shipping status. This is necessary for pre-contractual steps and contract performance under Article 6(1)(b) GDPR. We cannot process an order without the required details. Statutory documentation and retention obligations rely on Article 6(1)(c) GDPR.
The private order page is protected by an access key. Anyone with the full private link can view the order details. Please do not share it with unauthorised people.
Payment through Stripe
Once paid ordering is enabled, payments are processed through Stripe. To prepare payment, we transmit email address, order reference, selected service, quantities and amounts. You enter payment details on the payment page provided by Stripe. This website does not store full credit card numbers.
Stripe processes payment and transaction data for payment handling, fraud prevention and its own legal obligations. Our transfer relies on Article 6(1)(b) GDPR. Stripe uses European entities in Ireland and international service providers. Transfers to third countries, particularly the USA, are possible; Stripe describes the adequacy decisions and standard contractual clauses it uses in its privacy information.
No Stripe script is loaded during a normal visit to this website. The connection to the payment page is established only when you open the payment process.
Shipping with DHL
Name, address and order reference are transmitted to DHL to create the inbound label and handle shipping. CGVL stores the shipping label and tracking number to process your order. The legal basis is Article 6(1)(b) GDPR. DHL also processes transport data under its own privacy information.
Contract documents and withdrawal
We retain the version of the contract documents applicable to your order, your declarations about starting work early and their timestamp as evidence and to process your order. You receive the documents with the contract confirmation; they are also available on your protected order page.
When you use the electronic withdrawal function, we process your name, email address, contract reference, the scope and time of your declaration. We acknowledge receipt and review the next steps. The legal bases are Article 6(1)(b) and (c) GDPR. To limit misuse, we also retain a daily changing hashed association of the IP address under Article 6(1)(f) GDPR. On subsequent use of the function, we remove associations older than 24 hours. Our legitimate interest is the secure operation of this function.
Public grading reports
Published reports are accessible using the CGVL ID or QR code without signing in. They contain card identity, photos, grades, findings, examination date and the names of the examiner and second reviewer. Contact, address and payment details from the submission order are not published as part of the public order record.
Providing the agreed card report serves contract performance under Article 6(1)(b) GDPR. Traceable assessment and approval also serve our legitimate interest and buyers’ and sellers’ interest in verifiable grading under Article 6(1)(f) GDPR. Individual assessment texts remain in their original language.
Retention and recipients
Personal data are accessible only to people and service providers who need them for operation, communication, order processing, payment or shipping. Data may also be disclosed to competent authorities where required by law.
Retention depends on the purpose: enquiries until fully resolved, order data during processing and necessary documentation periods, and report and image data for the agreed verifiability of the card. Records subject to legal retention remain stored for the applicable period. Data are then deleted or anonymised unless another lawful purpose, retention obligation or preservation of specific legal claims requires otherwise.
Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction of processing and data portability. You may withdraw any consent you have given at any time with future effect. Contact the controller named above.
Right to object: where we process data under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing at any time. We do not conduct direct marketing through tracking on this website.
You may complain to a data protection authority, particularly where you live, work or believe an infringement occurred. For this provider, the North Rhine-Westphalia data protection authority (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, is a competent contact point.
There is no advertising profiling or solely automated decision with legal or similarly significant effects. Card grading is reviewed by people.
Last updated: 17 September 2026