Privacy Policy
Royal Exclusiv – www.royalexclusiv.net
Last updated: November 2026
1. Data Controller
The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Royal Exclusiv Aquarien-Anlagenbau
Christian Walter GmbH & Co. KG
Vorgebirgsstraße 28
D-50389 Wesseling
Germany
Phone: +49 (0) 2236 880550
Email: info@royal-exclusiv.de
Website: https://www.royalexclusiv.net
Hereinafter referred to as "Royal Exclusiv", "we" or "us".
A Data Protection Officer will be appointed separately only if legally required or if one has been voluntarily appointed.
2. General Information on Data Processing
Protecting your personal data is important to us.
We process personal data exclusively in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications-Digital Services Data Protection Act (TDDDG).
Personal data means any information relating to an identified or identifiable natural person.
We process personal data in particular for the following purposes:
Providing and maintaining the technical functionality of our website.
Processing orders and purchase contracts.
Managing customer accounts.
Handling enquiries.
Processing payments and deliveries.
Sending newsletters.
Ensuring IT security.
Improving our website and services, where a legal basis exists.
3. Legal Bases for Processing
The processing of personal data is based on the following legal provisions:
Art. 6(1)(a) GDPR – Consent.
Art. 6(1)(b) GDPR – Performance of a contract or pre-contractual measures.
Art. 6(1)(c) GDPR – Compliance with a legal obligation.
Art. 6(1)(f) GDPR – Legitimate interests.
Where we obtain your consent, you may withdraw it at any time with effect for the future.
4. Website Access and Server Log Files
When you visit our website, technical information is automatically collected by our web server.
This may include:
IP address of the requesting device.
Date and time of access.
Pages and files accessed.
Amount of data transferred.
Browser and operating system used.
Referrer URL.
Access status and technical error messages.
This processing is necessary to provide, maintain and secure our website.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the secure and reliable operation of our website.
Server log files are generally stored only for as long as necessary for these purposes. Longer storage may be necessary in the event of security-related incidents.
5. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Cookies are small text files stored on your device. They enable functions such as the technical operation of the shopping cart, saving preferences or recognising your device.
We distinguish between the following categories:
a) Strictly Necessary Cookies
These cookies are required for our website and online shop to function properly.
They may include:
Shopping cart and session functions.
Language preference settings.
Security functions.
Technical functions required for the ordering process.
The storage of or access to information on your device is based on Section 25(2) TDDDG, where the statutory requirements are met. The subsequent processing of personal data is based on Art. 6(1)(b) or Art. 6(1)(f) GDPR, depending on the specific purpose.
b) Analytics and Marketing Cookies
Where analytics or marketing technologies are used, they may help us analyse website usage or optimise marketing activities.
Such technologies will only be activated after you have provided your consent, where legally required.
The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
c) Managing Your Consent
You may withdraw your consent at any time with effect for the future or change your cookie preferences.
You can do so using the corresponding cookie settings function on our website.
Withdrawing consent must be as easy as giving it.
6. Contact by Email or Contact Form
If you contact us by email or through a contact form, we process the personal data you provide.
This may include:
Name.
Email address.
Telephone number.
Postal address.
Content of your message.
Any additional information voluntarily provided.
The data is processed to handle and respond to your enquiry.
The legal basis is:
Art. 6(1)(b) GDPR, where your enquiry relates to entering into or performing a contract.
Art. 6(1)(f) GDPR for other enquiries. Our legitimate interest is the proper handling of customer enquiries.
The data will be deleted once your enquiry has been fully processed, unless statutory retention obligations or other legitimate reasons require further storage.
7. Orders and Contract Processing in Our Online Shop
When you place an order through our online shop, we process the personal data necessary to fulfil the contract.
This includes, in particular:
First and last name.
Billing and delivery address.
Email address.
Telephone number, where provided or required.
Products and items ordered.
Payment information or payment status.
Shipping and delivery information.
Order details.
The processing is necessary to take pre-contractual measures and fulfil the purchase contract.
The legal basis is Art. 6(1)(b) GDPR.
Where we are legally required to retain certain data, further storage is based on Art. 6(1)(c) GDPR.
Data required for contract processing may be shared with the relevant service providers, particularly payment service providers and shipping companies.
8. Customer Accounts and Registration
You have the option of creating a personal customer account in our online shop.
During registration, we process in particular:
Name.
Address.
Email address.
Login credentials.
Order history.
Any additional information voluntarily provided.
The data is used to provide your customer account, manage your orders and improve our customer service.
The legal basis is Art. 6(1)(b) GDPR.
Your data is stored for as long as your customer account exists and the data is required to provide the account services.
After deletion of your customer account, the data will be deleted unless statutory retention obligations or other lawful grounds prevent deletion.
9. Payment Service Providers
External payment service providers may be used to process payments.
These include, in particular:
PayPal
Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
If you select PayPal as your payment method, the data required to process the payment will be transferred to PayPal.
The processing is necessary to complete the payment and fulfil the purchase contract.
Further information on PayPal's privacy practices can be found at:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full
UNZER
Provider: Unzer GmbH, Germany.
If you select a payment method offered through UNZER, the data required to process the payment will be transferred to UNZER.
Further information on data protection can be found at:
https://www.unzer.com/de/datenschutz/
Payment service providers may also process the transferred data under their own responsibility as independent data controllers.
Please refer to the respective privacy notices of these providers for further details.
10. Shipping and Delivery
To deliver ordered goods, we transfer the necessary personal data to the relevant shipping or transport company.
This may include:
Recipient's name.
Delivery address.
Telephone number or email address, where required for delivery notifications.
Shipment information.
The transfer takes place exclusively for the purpose of delivery and contract fulfilment.
The legal basis is Art. 6(1)(b) GDPR.
11. Newsletter
If you subscribe to our newsletter, we use your email address to send you regular information about our products, new developments, offers and promotions from Royal Exclusiv.
Subscription is based on your explicit consent pursuant to Art. 6(1)(a) GDPR.
To verify your subscription, we may use the so-called double opt-in procedure. After registering, you will receive a confirmation email asking you to confirm your subscription.
The following data may be processed:
Email address.
Date and time of registration.
Date and time of confirmation.
IP address and technical verification data.
You may withdraw your consent at any time with effect for the future. You can do so by using the unsubscribe link in each newsletter or by contacting us directly.
The lawfulness of processing carried out before withdrawal remains unaffected.
12. Google Analytics
If Google Analytics is used on our website, it may be used to analyse user behaviour and improve our online services.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
In connection with its use, the following information may be processed:
Pages visited.
Duration of visits.
User interactions.
Technical device information.
Approximate location information.
Online identifiers.
Google Analytics will only be activated after the required consent has been obtained.
The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
You may withdraw your consent at any time through the cookie settings.
Where personal data is transferred to Google entities outside the European Economic Area, such transfers will only take place in compliance with the requirements of Art. 44 et seq. GDPR.
Further information:
https://policies.google.com/privacy
13. YouTube Videos
Our website may contain embedded videos from the YouTube platform.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Where technically available, we use YouTube's enhanced privacy mode.
For embedded content requiring consent, a connection to YouTube will only be established after you have given your consent to the embedding or playback of the video.
In this process, your IP address, technical device information and information about the page visited may be transmitted to YouTube.
The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
Further information on Google's privacy practices:
https://policies.google.com/privacy
14. Social Media Presence
Royal Exclusiv maintains profiles on various social media platforms, in particular Instagram, Facebook, YouTube and LinkedIn.
When you visit our social media pages, personal data may be processed by the respective platform operators.
We have only limited influence over the data processing carried out by these platform operators.
Please refer to the respective privacy policies:
Instagram: https://privacycenter.instagram.com/
Facebook: https://www.facebook.com/privacy/policy/
YouTube: https://policies.google.com/privacy
15. Recipients of Personal Data
Personal data is only shared where legally permitted or necessary for the purposes described above.
Recipients may include, in particular:
Hosting and IT service providers.
Technical service providers operating our online shop.
Payment service providers.
Shipping and transport companies.
Newsletter service providers.
Analytics and platform providers.
Tax advisors and other legally authorised recipients.
Where required, we enter into data processing agreements with our processors in accordance with Art. 28 GDPR.
16. Transfers to Third Countries
Personal data may only be transferred to countries outside the European Union or the European Economic Area in compliance with applicable legal requirements.
Such transfers may take place where:
An adequacy decision has been issued by the European Commission.
Appropriate safeguards pursuant to Art. 46 GDPR are in place.
Another legally permitted exception applies.
Where data is transferred to appropriately certified US companies, the EU-US Data Privacy Framework may serve as a legal basis pursuant to Art. 45 GDPR.
17. Data Retention and Deletion
We store personal data only for as long as necessary for the respective processing purposes.
Once the relevant purpose no longer applies, the data will be deleted unless statutory retention obligations or other lawful reasons require further storage.
In particular, commercial and tax legislation may require certain data to be retained for longer periods.
After the relevant retention periods have expired, the data will be deleted unless another lawful basis for storage exists.
18. Your Rights as a Data Subject
Subject to the applicable legal requirements, you have the following rights:
Right of Access – Art. 15 GDPR
You may request information about whether and which personal data we process about you.
Right to Rectification – Art. 16 GDPR
You may request the correction of inaccurate personal data or the completion of incomplete data.
Right to Erasure – Art. 17 GDPR
You may request the deletion of your personal data under the conditions stipulated by law.
Right to Restriction of Processing – Art. 18 GDPR
You may request the restriction of processing under certain circumstances.
Right to Data Portability – Art. 20 GDPR
You may request that certain personal data be provided to you in a structured, commonly used and machine-readable format.
Right to Object – Art. 21 GDPR
You may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time.
Right to Withdraw Consent – Art. 7(3) GDPR
You may withdraw any consent you have given at any time with effect for the future.
Right to Lodge a Complaint – Art. 77 GDPR
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
To exercise your rights, you may contact us at any time using the contact details provided above.
19. Competent Data Protection Supervisory Authority
The competent data protection supervisory authority for our company is:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
(Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Phone: +49 (0) 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de
20. Data Security
We implement appropriate technical and organisational security measures to protect your personal data against loss, manipulation, unauthorised access and other unlawful processing.
Our security measures are regularly reviewed and updated in line with technological developments and legal requirements.
21. Updates to This Privacy Policy
We reserve the right to amend this Privacy Policy where necessary due to changes in legal requirements, technological developments or changes to our services.
The current version published on our website shall apply.
Last updated: November 2026
We offer various payment and shipping methods for fast processing. We are happy to determine the shipping costs incurred in advance.