1. Controller

Royma Industrial CT – Europe, represented by BliXray Technologies GmbH
Hollerithallee 17, 30419 Hannover, Germany
E-mail: adrian_deriz@roymatek.eu · Phone: +49 511 57092696

2. Hosting and server logs

This website consists of static files delivered by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, through its worldwide network. When a page is requested, Cloudflare processes technical data: IP address, date and time, the page requested, browser type and operating system. This is needed to deliver the website and to protect it against attacks. Legal basis: Article 6 (1) (f) GDPR; our legitimate interest is a secure and fast website. Cloudflare acts as our processor. Where data is transferred to the USA, this takes place under the EU-US Data Privacy Framework and the EU standard contractual clauses.

3. Cookies, consent and fonts

Fonts and images are delivered from our own website. The public pages set no cookies of their own. Analytics cookies (section 4) are set only after you have agreed in the cookie banner. Your choice is stored in your browser (local storage, not a cookie) for twelve months and can be changed at any time via “Cookie settings” in the footer of every page. Legal basis for the storage of your choice: Article 6 (1) (c) and (f) GDPR.

Only if you sign in to the customer or staff area (section 7) do we set one strictly necessary session cookie (ry_customer or ry_staff). It contains your e-mail address, the area and an expiry date, signed so that it cannot be altered; it is valid for 30 days and is deleted when you sign out. It cannot be read by scripts, is sent only over encrypted connections and is not used for analytics. Because it is required to provide the service you asked for, no consent is needed (§ 25 (2) no. 2 TDDDG). Legal basis for the processing: Article 6 (1) (b) and (f) GDPR.

4. Analytics

Cloudflare Web Analytics. To see how many visitors read which pages and how fast the pages load, we use Cloudflare Web Analytics (Cloudflare, Inc., see section 2). It works without cookies and without storing personal identifiers; the page requested, the referring page, the browser type and the country are counted in aggregated form. Legal basis: Article 6 (1) (f) GDPR; our legitimate interest is measuring and improving our website.

Google Analytics 4. With your consent we use Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It sets cookies (in particular _ga, _ga_*, kept for up to two years) and records the pages you view, how you arrived, the type of device and browser and an approximate location; IP addresses are shortened before storage. We use the reports to understand which content is of interest. Google acts as our processor; where data is transferred to the USA, this takes place under the EU-US Data Privacy Framework and the EU standard contractual clauses. Legal basis: Article 6 (1) (a) GDPR (consent).

Apollo website visitors. With your consent we use the website-visitor tool of Apollo.io (ZenLeads Inc., 535 Mission St, San Francisco, CA 94105, USA). It sets a cookie and matches the network address of your visit against a company database in order to tell us which company a visit came from and which pages were viewed. It does not identify individual persons. We use this to prepare relevant follow-up with companies that show interest in industrial CT. Where data is transferred to the USA, this takes place under the EU standard contractual clauses. Legal basis: Article 6 (1) (a) GDPR (consent).

Identification of visiting companies from the network address. When a page is opened, our website records the page address together with the network from which the request came (the network operator named for the IP address by our hosting provider, and the organisation registered for the address range in the public internet registries such as RIPE NCC). We use this to see which companies and institutions take an interest in industrial CT and which pages they read. The IP address itself is not stored; no cookie and no visitor identifier is set, and individual persons are not identified. Where a network belongs to an internet provider or a mobile network, the visit is counted as anonymous. Legal basis: Article 6 (1) (f) GDPR; our legitimate interest is business development towards companies. You may object to this processing at any time (see section 11).

You can withdraw your consent at any time via "Cookie settings" in the footer; the tools are then no longer loaded. Withdrawal does not affect the lawfulness of processing before it.

5. Enquiry form

If you send the enquiry form, we process the details you enter: name, business e-mail address, company, telephone number if given, industry, the description of your inspection task and any files you attach (up to three drawings, photos or specifications), together with the address of the page from which the form was sent. We use them to answer your enquiry and to prepare a quotation or a test scan. Legal basis: Article 6 (1) (b) GDPR (steps prior to a contract) and Article 6 (1) (f) GDPR (answering business enquiries).

The form sends these details to a function on our own website, which passes them on to our contact list and sends an e-mail to our sales staff. The contact list and the e-mail are kept in Google Workspace services (Google Sheets and Gmail) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as our processor. Where data is transferred to the USA, this takes place under the EU-US Data Privacy Framework and the EU standard contractual clauses. Attached files are stored on our hosting platform (Cloudflare, see section 2) for twelve months and are reachable only through links contained in the internal e-mail and contact list; they are then deleted automatically.

6. Presentation requests

On several pages you can ask for a presentation (“Send me the presentation”). We process the e-mail address and company you enter, your consent, the presentation requested, the page from which you asked and the country derived from your network address. We use these details to send you the presentation and to follow up on your interest. Legal basis: Article 6 (1) (a) GDPR (your consent in the form) and, for the follow-up with companies, Article 6 (1) (f) GDPR.

The presentation is shared with your e-mail address only, read-only, from our Microsoft OneDrive: Microsoft either sends you an invitation directly, or we send you a personal link by e-mail from our Microsoft 365 mailbox; to open it, Microsoft asks you to sign in or to confirm your address with a one-time code. If Microsoft cannot share with your address, we instead e-mail you a personal download link from our own website; the file is then delivered from OneDrive through our hosting platform (Cloudflare, see section 2), and the link, which records your e-mail address, company and the presentation, is kept there until it expires. Shares and links expire after 90 days. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, acts as our processor; where data is transferred to the USA, this takes place under the EU-US Data Privacy Framework and the EU standard contractual clauses. Each request is also recorded in our contact list and notified to our sales staff by e-mail through Google Workspace (Google Ireland Limited, see section 5).

To prevent misuse, the number of requests per e-mail address (24 hours) and per network address (one hour) is counted on our hosting platform; these counters are deleted automatically after that time.

7. Sign-in to the customer and staff areas

Customers and staff with access sign in without a password, using a one-time code sent by e-mail. We process the e-mail address you enter, check it against our list of authorised users (kept in Google Sheets, see section 5) and, if it is on the list, send a six-digit code to that address through Google Workspace. The code is stored only in encrypted (hashed) form on our hosting platform and expires after ten minutes or after five wrong attempts; requests are limited to five per hour per address, and the counter is deleted after one hour. After a successful sign-in we set the session cookie described in section 3 and record the time of your last sign-in in the list of authorised users. Legal basis: Article 6 (1) (b) GDPR (providing the area you have access to) and Article 6 (1) (f) GDPR (protecting the areas against unauthorised access).

8. Contact by e-mail or telephone

If you contact us by e-mail or telephone, we process your details to handle the matter. Legal basis: Article 6 (1) (b) or (f) GDPR. Enquiries from business contacts are also recorded in our customer relationship management system (HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA; in the EU: HubSpot Ireland Ltd., Dublin), which acts as our processor.

9. Recipients

Your details are handled by the staff of Royma Europe and, where needed to answer a technical question or prepare a quotation, by Royma staff at the headquarters in Suzhou, China. Such transfers are limited to what the enquiry requires and are based on Article 49 (1) (b) GDPR or on standard contractual clauses. We do not sell data and do not pass it on for advertising.

10. Storage period

We delete enquiry and presentation-request data when it is no longer needed for the purpose, as a rule three years after the last contact, unless statutory retention periods under commercial or tax law require longer storage. Attachments to the enquiry form are deleted after twelve months, presentation links after 90 days; sign-in codes, request counters and session cookies are deleted automatically after the periods given in sections 3, 6 and 7. Entries in the list of authorised users are kept for as long as access is granted.

11. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on Article 6 (1) (f) GDPR (Article 21). Consent can be withdrawn at any time with effect for the future. An e-mail to adrian_deriz@roymatek.eu is sufficient.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

12. Changes

We update this policy when the website or the legal position changes. Version: October 2026.