Template – review before publication (Vorlage – vor Veröffentlichung prüfen). These texts are a draft and not legal advice.
Translation for convenience; the German version is legally binding. Deutsche Fassung
Privacy policy
1. Controller
Maicol Angioni
ROYA D'OR (sole proprietorship)
Oppenheimer Straße 18
60594 Frankfurt am Main
Germany
E-mail: info@royador.com · Phone: +49 163 1787405
No data protection officer has been appointed (not required by law).
2. Principles
This website uses no tracking cookies, no analytics tools and no advertising pixels. We do not set any cookies ourselves. We only process personal data to the extent necessary to run the website and to process your order.
3. Hosting and server logs (Cloudflare)
The website runs as a Cloudflare Worker at Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (processor, Art. 28 GDPR). When you visit, Cloudflare processes technically necessary data (including IP address, time, requested URL, user agent) to deliver the page and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.
Our own application does not store IP addresses. For abuse protection (limiting requests to the order interface) the IP address is held briefly in memory only (a few minutes at most) and is not logged. Our application's technical logs contain no personal data (only the event, PayPal order number and error codes).
4. Order and payment
a) PayPal
Payments are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal processes your payment data as an independent controller. From PayPal we receive the order number, payment status, amount and currency, and the e-mail address of the payer's PayPal account. PayPal's privacy statement: paypal.com/uk/legalhub/privacy-full.
PayPal's scripts are only loaded once you tick both boxes in the checkout area. From that point PayPal receives technical data from your browser (including IP address and device information) and may set its own cookies required for payment and fraud prevention. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps and performance of the contract) and § 25(2) no. 2 TDDDG.
b) Google Pay
If you use Google Pay, the payment is processed via PayPal; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes the payment details stored in your Google account as an independent controller. The Google Pay script (pay.google.com) is likewise only loaded after you tick both boxes. Privacy notice: Google Payments privacy notice.
c) What we store and for how long
- Order record (PayPal order number, capture ID, date, amount, currency, product, page language and chosen e-book language, payer e-mail address, time of your declarations on the Terms and early performance): legal basis Art. 6(1)(b) and (c) GDPR. Retained to meet commercial and tax obligations (§ 147 AO, § 257 HGB) for up to 10 years, then deleted.
- Download link (random token, counter): deleted automatically after 7 days.
- Stored in Cloudflare Workers KV (processing on our behalf by Cloudflare, see section 3).
- Order confirmation by e-mail: after payment we send an order confirmation with the download link to the e-mail address of your PayPal account (required under § 312f BGB). Sent via Resend, Inc., San Francisco, USA (processor, Art. 28 GDPR; sent from servers in the EU, Ireland region; standard contractual clauses in addition). Legal basis: Art. 6(1)(b) and (c) GDPR. A copy goes to our own mailbox for accounting purposes.
5. Contact by e-mail
If you write to us, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed and no retention obligations apply.
6. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Just write to info@royador.com.
You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, or the authority in your own country.
7. No automated decision-making
We do not carry out automated decision-making, including profiling (Art. 22 GDPR).
Last updated: October 2026