Legal

Privacy Policy

Pursuant to Art. 13, 14 GDPR · Last updated: October 2026

01

Controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Controller
Royal Legacy
Maximilian Christopher Garus
Address
Roggenkamp 1D
49849 Wilsum
Germany
Phone
+49 170 1488791
Email
contact@royal-legacy.com
02

Principles of Processing

We process personal data solely on one of the following legal bases and only insofar as this is necessary for the respective purpose:

  • Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG — your consent, for example for Google Ads (section 08).
  • Art. 6 (1) (b) GDPR — for pre-contractual measures, for example when you contact us about a transport, a loan or an event.
  • Art. 6 (1) (c) GDPR — to fulfil legal obligations, in particular commercial and tax retention requirements.
  • Art. 6 (1) (f) GDPR — to safeguard legitimate interests, such as the secure operation of the website and the prevention of abuse.
03

Categories of Data Processed

Depending on the nature of the contact, we process the following categories of personal data:

  • Master data — first and last name, company where applicable.
  • Contact data — email address, telephone number, postal address.
  • Enquiry data — the content of your message and the details you provide about your request.
  • Usage data — the technically necessary server log data of the hosting provider.
  • Advertising data — only with your consent: information on ad clicks, page views and device collected by Google Ads (section 08).
04

Contacting Us

If you contact us by email, telephone or WhatsApp, we process the data you provide in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR for general enquiries.

This website itself contains no contact form. If your enquiry concerns one of our three houses, we handle it within the relevant business unit. As all three brands are run by the same owner, this does not involve any transfer to third parties.

Details that go beyond what is necessary for processing are voluntary. We ask you not to include special categories of personal data within the meaning of Art. 9 GDPR in your message.

05

Website Hosting & Server Logs

When you access this website, the hosting provider automatically collects information transmitted by your browser: IP address, date and time of access, page accessed, volume of data transferred, referrer URL as well as browser and operating system details. This data is technically necessary to deliver the site and to ensure its stability and security.

The legal basis is Art. 6 (1) (f) GDPR. Log data is regularly deleted after no more than 30 days, unless it is required to investigate a specific case of abuse.

06

Google Fonts

This website embeds fonts from Google Fonts. When the page is accessed, your browser establishes a connection to Google servers, transmitting your IP address. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in a consistent and fast presentation. If you wish to avoid this, you can prevent the execution of web fonts in your browser.

07

Links to Our Houses

This website links to the websites of Royal Legacy Motor Atelier, Royal Legacy Motorsport Heritage and Royal Legacy Marine Transport. As long as you merely see the links, no connection to these websites is established; all images and logos on this page are hosted on our own server.

Only when you follow a link does your browser call up the target page, transmitting the usual connection data — such as your IP address — to its hosting provider. From that point on, the privacy policy of the respective website applies.

08

Cookies, Google Ads & Consent

This website uses Google Ads provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — but only if you consent via the cookie banner. Without your consent the Google tag is not loaded and no data is transmitted to Google. We do not use analytics services such as Google Analytics.

Once you consent, your browser loads the Google tag (gtag.js). It sets cookies (such as _gcl_au) and transmits information to Google — in particular your IP address, browser and device details, the page visited, the time and, if you reach us via an ad, its click identifier. This allows us to measure which ads lead to visits (conversion tracking), and Google may show you our ads again later (remarketing).

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time with effect for the future — via “Cookie settings” in the footer of every page; any Google cookies set will be deleted. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). Further information: Google’s privacy policy.

Independently of this, we store only two technically necessary items locally in your browser: your choice of language under the key rl_lang and your cookie decision under rl_consent. Neither leaves your device or is transmitted to us. The legal basis is § 25 (2) no. 2 TDDDG, as the storage is strictly necessary for the service you requested.

You can remove this storage at any time by deleting the data saved for this website in your browser; the cookie banner will then appear again on your next visit.

09

WhatsApp Communication

If you contact us via WhatsApp, your messages and your telephone number are processed via the servers of WhatsApp Ireland Limited. We have no influence over this processing; WhatsApp’s own privacy terms apply in addition. We process the content in order to answer your enquiry. The legal basis is Art. 6 (1) (b) or (f) GDPR. If you wish to avoid this processing, please use email or telephone.

10

Recipients & Disclosure

Your data is disclosed only where necessary. Recipients may be:

  • IT service providers for hosting and email — on the basis of data processing agreements pursuant to Art. 28 GDPR where applicable.
  • Tax advisors, legal advisors and authorities — insofar as required by law or necessary to pursue legal claims.
  • Google Ireland Limited (Google Ads) — only if you have given your consent (section 08).
11

Transfers to Third Countries

Individual services used — specifically the typefaces from Google Fonts and, after your consent, Google Ads — may involve processing outside the European Union. Where an adequacy decision of the European Commission exists, the transfer takes place on that basis; otherwise we rely on standard contractual clauses pursuant to Art. 46 (2) (c) GDPR. We point out that a level of data protection comparable to that of the EU is not guaranteed in every third country.

12

Retention Periods

We store personal data only for as long as is necessary for the respective purpose:

  • Enquiries not followed by a contract: up to 12 months after the last contact.
  • Contract and billing records: 6 or 10 years in line with commercial and tax retention periods (§ 257 HGB, § 147 AO).
  • Server log data: generally 30 days.
  • Google Ads cookies: generally no more than 90 days — or until you withdraw your consent or delete the cookies.
13

Your Rights

As a data subject you have the following rights. An informal message to the address given under point 01 is sufficient to exercise them:

  • Access (Art. 15 GDPR) — which data we process about you.
  • Rectification (Art. 16 GDPR) — correction of inaccurate or incomplete data.
  • Erasure (Art. 17 GDPR) — unless a statutory retention obligation applies.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) — release in a structured, commonly used format.
  • Objection (Art. 21 GDPR) — against processing based on legitimate interests.
  • Withdrawal of consent (Art. 7 (3) GDPR) — at any time with effect for the future.
14

Right to Lodge a Complaint

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR.

The authority responsible for us is the data protection supervisory authority of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hanover, Germany. You may also contact the supervisory authority of your habitual residence.

15

Changes to This Privacy Policy

We amend this privacy policy whenever the legal situation, our services or the services used change. The version published on this page applies in each case. In the event of material changes requiring renewed consent, we will obtain it separately.

← Back to the homepage
Contact +49 170 1488791