Legal

Privacy Policy

Pursuant to Art. 13, 14 GDPR · Last updated: September 2026

01

Controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Controller
Royal Legacy Motorsport Heritage
Maximilian Christopher Garus
Address
Roggenkamp 1D
49849 Wilsum
Germany
Phone
+49 170 1488791
Email
motorsport.heritage@royal-legacy.com
02

Principles of Processing

We process personal data solely on one of the following legal bases and only insofar as this is necessary for the respective purpose:

  • Art. 6 (1) (a) GDPR — your consent, for example for the publication of images in which individuals are identifiable.
  • Art. 6 (1) (b) GDPR — for pre-contractual measures and the performance of a contract, for example when handling a loan.
  • Art. 6 (1) (c) GDPR — to fulfil legal obligations, in particular commercial and tax retention requirements.
  • Art. 6 (1) (f) GDPR — to safeguard legitimate interests, such as the secure operation of the website and the prevention of abuse.
03

Categories of Data Processed

Depending on the nature of the contact, we process the following categories of personal data:

  • Master data — first and last name, company or institution, position.
  • Contact data — email address, telephone number, postal address.
  • Enquiry data — desired object, occasion, period, venue and further details from your message.
  • Contract data — loan agreements, terms, dates, condition reports and billing records.
  • Usage data — exclusively the technically necessary server log data of the hosting provider.
  • Image data — photographs and video recordings of objects, installations and events.
04

Contact & Enquiry Form

If you contact us via the enquiry form, by email, telephone or WhatsApp, we process the data you provide in order to answer your enquiry and, where applicable, prepare an offer. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR for general enquiries.

The enquiry form on this website is sent via the FormSubmit service (FormSubmit.co). Your form entries are transmitted to its servers and delivered to us by email. The provider is a company based outside the European Union; a transfer to a third country can therefore not be excluded (see section 12). If you wish to avoid this, please contact us directly by email or telephone.

Details that go beyond what is necessary for processing are voluntary. We ask you not to enter special categories of personal data within the meaning of Art. 9 GDPR in free-text fields.

05

Handling of Loans & Brokerage

If a loan or brokerage is concluded, we process the data required for its performance: contracting parties and contact persons, venue and period, transport and installation data, insurance details, condition reports and billing records. The legal basis is Art. 6 (1) (b) GDPR.

For the performance we pass on the necessary data to third parties involved — in particular the owner of the object, transport companies, insurers, installation service providers and, where relevant, the operators of the venue. In each case only the data the recipient needs for their contribution is transmitted.

06

Photo & Video Documentation

We document the condition of objects as well as delivery, installation and return photographically. These records serve as evidence of condition towards owners and insurers. The legal basis is Art. 6 (1) (b) and (f) GDPR.

Recordings in which persons are identifiable are published exclusively with their express consent pursuant to Art. 6 (1) (a) GDPR. Consent given may be withdrawn at any time with effect for the future.

07

Website Hosting & Server Logs

When you access this website, the hosting provider automatically collects information transmitted by your browser: IP address, date and time of access, page accessed, volume of data transferred, referrer URL as well as browser and operating system details. This data is technically necessary to deliver the site and to ensure its stability and security.

The legal basis is Art. 6 (1) (f) GDPR. Log data is regularly deleted after no more than 30 days, unless it is required to investigate a specific case of abuse.

08

Google Fonts

This website embeds fonts from Google Fonts. When the page is accessed, your browser establishes a connection to Google servers, transmitting your IP address. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in a consistent and fast presentation. If you wish to avoid this, you can prevent the execution of web fonts in your browser.

09

No Analytics or Tracking Services

This website uses no analytics, tracking or advertising services. Neither Google Analytics nor comparable tools are employed, no audience measurement takes place, and no profiles of your behaviour are created. For that reason there is no cookie banner on this website either — there is nothing for which we would need to obtain your consent.

The only thing stored is your choice of language, held locally in your browser's storage under the key rlh_lang. This information never leaves your device and is not transmitted to us. Its sole purpose is to show you the site in your chosen language on your next visit. The legal basis is § 25 (2) no. 2 TDDDG, as the storage is strictly necessary for the service you requested.

You can remove this storage at any time by deleting the data saved for this website in your browser. Should we introduce an analytics service in future, we will obtain your express consent beforehand and amend this policy accordingly.

10

WhatsApp Communication

If you contact us via WhatsApp, your messages and your telephone number are processed via the servers of WhatsApp Ireland Limited. We have no influence over this processing; WhatsApp’s own privacy terms apply in addition. We process the content in order to answer your enquiry. The legal basis is Art. 6 (1) (b) or (f) GDPR. If you wish to avoid this processing, please use email or telephone.

11

Recipients & Disclosure

Your data is disclosed only where necessary. Recipients may be:

  • Owners of the objects and their representatives — in the course of initiating and performing a loan.
  • Service providers for transport, insurance, installation and security — in each case limited to the data needed for their service.
  • IT service providers for hosting, email and form delivery — on the basis of data processing agreements pursuant to Art. 28 GDPR where applicable.
  • Tax advisors, legal advisors and authorities — insofar as required by law or necessary to pursue legal claims.
12

Transfers to Third Countries

Individual services used — specifically form delivery via FormSubmit and the typefaces from Google Fonts — may involve processing outside the European Union. Where an adequacy decision of the European Commission exists, the transfer takes place on that basis; otherwise we rely on standard contractual clauses pursuant to Art. 46 (2) (c) GDPR. We point out that a level of data protection comparable to that of the EU is not guaranteed in every third country.

13

Retention Periods

We store personal data only for as long as is necessary for the respective purpose:

  • Enquiries not followed by a contract: up to 12 months after the last contact.
  • Contract and billing records: 6 or 10 years in line with commercial and tax retention periods (§ 257 HGB, § 147 AO).
  • Server log data: generally 30 days.
14

Your Rights

As a data subject you have the following rights. An informal message to the address given under point 01 is sufficient to exercise them:

  • Access (Art. 15 GDPR) — which data we process about you.
  • Rectification (Art. 16 GDPR) — correction of inaccurate or incomplete data.
  • Erasure (Art. 17 GDPR) — unless a statutory retention obligation applies.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) — release in a structured, commonly used format.
  • Objection (Art. 21 GDPR) — against processing based on legitimate interests.
  • Withdrawal of consent (Art. 7 (3) GDPR) — at any time with effect for the future.
15

Right to Lodge a Complaint

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR.

The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hanover, Germany. You may also contact the supervisory authority of your habitual residence.

16

Changes to This Privacy Policy

We amend this privacy policy whenever the legal situation, our services or the services used change. The version published on this page applies in each case. In the event of material changes requiring renewed consent, we will obtain it separately.

← Back to the homepage
Make an Enquiry +49 170 1488791