Privacy policy

This is a translation; the German version is legally binding.

1. Controller

Peter Boehlke, sonora, Carl-von-Linde-Straße 32, 85716 Unterschleißheim, Germany
Phone: +49 89 800 44 608, email: info@sonora.de

Data protection officer: Wolfgang Evers, DSZ GmbH, Brandlweg 5, 83543 Rott am Inn, Germany, phone: +49 152 2951 7648, email: wolfgang.evers@dsz365.de

2. At a glance

This website sets no cookies and embeds no third-party services that receive data when you simply visit. Fonts, images and scripts are served from our own server. We only process personal data when you write to us, use the quick check, subscribe to the newsletter or talk to us, and in the form of technically necessary server log files and privacy-friendly analytics without cookies.

3. Hosting and server log files

This website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany. Hetzner only processes data as far as necessary to operate the servers and following our instructions. We have a data processing agreement with Hetzner (Art. 28 GDPR).

When you open a page, server log files are processed automatically: IP address, date and time, requested page, browser and operating system (user agent) and the previously visited page (referrer). This serves smooth operation and the defence against attacks (Art. 6 (1) (f) GDPR). Log files are deleted after 30 days at the latest unless a security incident requires longer retention. They are not combined with other data sources.

The connection to this website is encrypted with TLS (shown by “https://” in the address bar), so third parties cannot read your input, for example in the contact form.

4. Contact form, quick check and email

When you use the contact form, we process your name, email address, message and, if provided, company, phone number and topic. In the quick check it is your name, email address, your answers to the six questions and, if provided, company, website and whether you would like us to get back to you. We use this information solely to handle your enquiry and reply to you (Art. 6 (1) (b) GDPR, for general enquiries Art. 6 (1) (f) GDPR).

The information is sent to us by email and is not stored in a database of this website. Our mailbox is operated as part of Microsoft 365 by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, which processes the data on our behalf (Art. 28 GDPR). The email remains in our mailbox until the enquiry is closed and no statutory retention obligations prevent deletion.

To protect against automated requests, we store an irreversible hash of your IP address together with the time when you submit a form. It is deleted after 24 hours at the latest (Art. 6 (1) (f) GDPR).

If you email or call us directly, we process your information in the same way, only to handle your request and on the same legal bases. We do not pass it on without your consent.

Website check

In the quick check you can have a website address checked automatically. Our server then opens the homepage once in an automated browser, like a new visitor and without accepting the cookie banner, and evaluates which services and cookies load. For this we only process the address you enter; we do not ask for any personal details. The checked website sees our server, not you.

The result is shown to you and cached for 10 minutes in the memory of the check service so the same page is not checked repeatedly in a row. We receive the checked address and a summary of the result by email, without your IP address or any other personal details. To prevent abuse, we store the hash of your IP address described above; it is deleted after 24 hours at the latest. The legal basis is our legitimate interest in offering this tool and protecting it from abuse (Art. 6 (1) (f) GDPR).

When you subscribe to our newsletter, we process your email address, your IP address, the website you subscribed on and the times of subscription and confirmation. The legal basis is your consent (Art. 6 (1) (a) GDPR). The newsletter appears about once a month with practical tips on Matomo, tracking, privacy settings and performance.

We use double opt-in: after subscribing you receive an email with a confirmation link, and only once you click it are you subscribed. We store the IP address and times as proof of your consent.

We send the newsletter with rapidmail, a service of Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany. rapidmail processes the data on our behalf (data processing agreement under Art. 28 GDPR).

You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every newsletter or by email to info@sonora.de. You will then no longer receive the newsletter, and your address is removed from the list.

6. Storage in your browser

This website sets no cookies. The following features store values in your browser that are not transmitted to us:

Colour scheme (“sonora-theme”, local storage): remembers whether you chose the light or dark design until you change it or clear the storage.
Transparency display (“sonora-live”, session storage): counts page views, clicks and time on site of your current visit so the “Transparency” page can show them to you. It is deleted as soon as you close the tab.
Objection to analytics (“sonora-matomo-optout”, local storage): only if you object below.
Website check (“sonora-check-url”, session storage): if you enter an address for the website check on the homepage, it is passed to the quick check page and deleted there immediately.

This storage is strictly necessary for the features you use (§ 25 (2) no. 2 TDDDG).

7. Analytics with Matomo

To evaluate the use of this website statistically and improve it, we use the open source software Matomo. Matomo runs on a server operated by us in Germany, and the data is not passed on to third parties. On this website Matomo sets no cookies, does not read device properties such as screen resolution or browser plugins (browser feature detection is switched off) and does not recognise you across several days.

Matomo records the pages viewed, date and time, time on site, the previously visited page (referrer), clicks on links and buttons, form submissions (without their content), use of the website check (without the checked address), browser, operating system and device type (from the identifier your browser sends with every request anyway), language and the approximate origin (country). Your IP address is shortened before it is stored, so it cannot be linked to you. The legal basis is our legitimate interest in analysing and improving this website (Art. 6 (1) (f) GDPR). The “Transparency” page shows you what Matomo is recording during your visit.

You can object to this at any time (Art. 21 GDPR), with the switch at the bottom of this page or informally by email. The switch stores your objection in your browser’s local storage; if you clear it, the objection is cleared as well.

8. Video calls

For intro calls and meetings we use Microsoft Teams, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We process the data you provide or transmit when taking part, such as name, email address, video and audio. The legal basis is Art. 6 (1) (b) GDPR where the call serves to prepare or perform a contract, otherwise Art. 6 (1) (f) GDPR. We have a data processing agreement with Microsoft. A transfer to the USA cannot be ruled out; it is based on the EU-US Data Privacy Framework, under which Microsoft is certified, and on the European Commission’s standard contractual clauses.

9. Booking with Calendly

For intro calls we link to our booking page on Calendly, a service of Calendly LLC based in Atlanta, Georgia, USA. Calendly is not embedded in this website: data is only transferred when you follow the “Book an intro call” link. On the Calendly page you enter your name, email address, the desired time and any further details. Calendly processes this data on our behalf so we can plan, hold and follow up on the meeting (data processing agreement under Art. 28 GDPR). The legal basis is Art. 6 (1) (b) GDPR, as the booking serves to prepare a contract. The transfer to the USA is based on the European Commission’s standard contractual clauses. On the booking page, Calendly’s privacy policy also applies, including for cookies set there. Booking data is kept until the purpose no longer applies or you request deletion, unless statutory retention obligations apply.

10. Links to other websites

This website links to other services, such as our sister brand feinwerk.io, LinkedIn, GitHub and Calendly. Data is only transferred when you follow a link; the privacy policy of the respective provider then applies.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR); the lawfulness of processing before the withdrawal remains unaffected. Simply contact the email address above or our data protection officer.

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing at any time without giving reasons.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

13. Storage period

Unless a more specific period is stated in this privacy policy, we only store your data until the purpose of processing no longer applies. If you make a justified request for erasure or withdraw consent, we delete your data unless statutory reasons such as tax or commercial retention periods prevent this; in that case we delete it as soon as those reasons no longer apply.

Last updated: 19 October 2026