Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

The company data protection officer of Royal Legacy Motor Atelier is:

For questions about data protection, the exercise of your rights or to submit complaints, please contact the address given above directly.

We process personal data exclusively in accordance with the provisions of the GDPR and the BDSG. Personal data is only collected, processed and used insofar as this is necessary for the provision of our transport services, for the fulfilment of legal obligations or on the basis of your express consent.

Processing is carried out on the basis of the following legal grounds pursuant to Art. 6 GDPR:

• Art. 6(1)(a) GDPR — consent of the data subject
• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR — compliance with a legal obligation
• Art. 6(1)(f) GDPR — legitimate interests of the controller

Depending on the type of interaction with Royal Legacy Motor Atelier, we process the following categories of personal data:

If you contact us via the contact form on our website, by email or by telephone, we process the data you provide (name, email address, telephone number, vehicle type, pick-up and destination location, other information) exclusively to process your enquiry and to prepare for the conclusion of a contract.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to customer enquiries).

Retention period: Enquiry data is deleted after final processing if no contractual relationship arises. Upon conclusion of a contract, the retention periods set out in Section 13 of this policy apply.

The data submitted via the contact form is forwarded by email to the controller. The data is not stored on the web server.

To fulfil transport orders, we process all data necessary for carrying out the tour. This includes in particular your contact data, complete vehicle data (incl. chassis number, licence plate, dimensions, current value), handover and destination address as well as special transport requirements.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

As part of order processing, data may be passed on to the following categories of recipients (cf. Section 12):

• Customs authorities and customs service providers for cross-border transport
• Insurance companies for damage settlement
• Subcontractors (qualified drivers, partner freight forwarders) insofar as necessary for service provision
• Tax advisors and accountants to fulfil statutory bookkeeping obligations

In accordance with our General Terms and Conditions (§ 10 of the Terms), all-round shots of the vehicle are taken before and after each transport order (at least 15–25 images: exterior shots, interior, any pre-existing damage, loading and unloading process). This documentation serves to preserve evidence in the event of damage.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in preserving evidence).

Retention period: The photo documentation is archived in a GDPR-compliant manner for at least 5 years. Upon request, you are entitled to a copy of the recordings concerning you.

Marketing use: The Contractor reserves the right to use anonymised photo or video material (without personal reference, without visible licence plates) for marketing purposes on the website, Instagram or LinkedIn. Personal data (licence plates, identifiable persons) is rendered unrecognisable before publication.

If you wish to exclude the publication of any recordings, please inform us in writing before the start of the tour. Your objection is recorded permanently and taken into account for all future orders.

Legal basis for marketing use: Art. 6(1)(f) GDPR (legitimate interest in corporate communication and portfolio presentation) with consistent anonymisation of all personal characteristics.

During transport, the location of the transport vehicle is recorded in real time using GPS technology. This location data is made available to you as the client as part of the GPS real-time tracking so that you can follow the progress of the transport at any time.

Data processed: Geographic location data of the transport vehicle (not of the client), timestamps, route history.

Legal basis: Art. 6(1)(b) GDPR (contractually agreed service) and Art. 6(1)(f) GDPR (legitimate interest in the security of the transported goods).

Retention period: GPS history data is deleted no later than 12 months after completion of the tour and confirmation of damage-free handover, provided there is no complaint. In the case of ongoing complaint procedures, until their conclusion.

General information about the website: Our website uses no tracking tools, no analytics software (such as Google Analytics) and no advertising cookies. No usage profiles are created.

Google Fonts: Our website uses Google Fonts (fonts from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The fonts are loaded from Google servers when the page is accessed. In the process, your IP address is transmitted to Google. We have no influence on this data transmission.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a uniform and professional presentation of the website).

Information on data protection at Google can be found at: https://policies.google.com/privacy

Server log files: When our website is accessed, the hosting provider automatically stores information in server log files (IP address, browser type, operating system, date/time of access, pages accessed). This data cannot be attributed to a specific person and is deleted after no more than 7 days.

We offer the option of contacting us via WhatsApp (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). If you contact us via WhatsApp, the messages exchanged and your telephone number are processed by WhatsApp.

Note: WhatsApp transmits metadata (including telephone numbers, timestamps) to Meta servers, even when messages are end-to-end encrypted. For confidential information, we recommend communication by email.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contractual communication) and Art. 6(1)(f) GDPR (legitimate interest in fast, modern communication).

Information on data processing by WhatsApp: https://www.whatsapp.com/legal/privacy-policy

Royal Legacy Motor Atelier maintains a company profile on the following social networks:

• Instagram (Meta Platforms Ireland Limited) — presentation of vehicles and transport projects
• LinkedIn (LinkedIn Ireland Unlimited Company) — corporate presentation and B2B communication

If you visit our profiles on these platforms or interact with our content, data is processed by the respective platform operators. We have no influence on this data processing. Please refer to the privacy policies of the respective platforms.

On our social media presences, we publish exclusively anonymised vehicle material (no licence plates, no identifiable persons), unless express consent has been given.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in corporate marketing).

Your personal data is generally not passed on to third parties, except in the cases listed below:

Your data is only transferred to third countries outside the EU/EEA if this is necessary for carrying out a cross-border transport and appropriate safeguards pursuant to Art. 46 GDPR (e.g. standard contractual clauses) are in place.

We store personal data only for as long as is necessary for the respective processing purposes or as long as statutory retention obligations exist:

After expiry of the respective retention period, your data is routinely deleted, provided there are no other retention obligations or legitimate interests.

As a data subject, you have the following rights under the GDPR. You can exercise these at any time informally vis-à-vis the data protection officer (Section 2):

Zur Ausübung Ihrer Rechte wenden Sie sich bitte schriftlich oder per E-Mail an den Datenschutzbeauftragten (Abschnitt 2). Wir bearbeiten Ihr Anliegen innerhalb von 30 Tagen nach Eingang.

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR (Art. 77 GDPR).

The competent supervisory authority for Royal Legacy Motor Atelier, based in Lower Saxony, is:

We reserve the right to amend this privacy policy in the event of changes to the legal situation, our services or data processing practices. The current version is available on our website. In the event of significant changes, we will inform you separately.

Version of this privacy policy: May 2026