1. Data Protection at a Glance

General Information

The following information provides a brief overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information about data protection is provided in the Privacy Policy below.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the section “Information about the Data Controller” in this Privacy Policy.

How do we collect your data?

Some data is collected when you provide it to us, for example by entering information in a contact form.

Other data is collected automatically, or after you have given your consent, by our IT systems when you visit the website. This is primarily technical data, such as your internet browser, operating system or the time you access a page. This data is collected automatically as soon as you access this website.

What do we use your data for?

Some data is collected to ensure that the website functions correctly. Other data may be used to analyse your usage behaviour. Where contracts can be concluded or initiated through the website, the data you provide is also processed for quotations, orders or other contractual enquiries.

What rights do you have regarding your data?

You have the right to receive information free of charge at any time about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you may withdraw that consent at any time with effect for the future. In certain circumstances, you also have the right to request restriction of the processing of your personal data. You also have the right to lodge a complaint with the competent supervisory authority.

You may contact us at any time about these rights or any other questions concerning data protection.

2. Hosting

We host the content of our website with the following provider:

IONOS

The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, referred to below as IONOS. When you visit our website, IONOS records various log files, including your IP addresses. Details are available in the IONOS Privacy Policy: https://www.ionos.de/terms-gtc/terms-privacy.

We use IONOS on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in providing our website as reliably as possible. Where corresponding consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), insofar as the consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data Processing Agreement

We have concluded a data processing agreement for the use of the service mentioned above. This agreement is required by data protection law and ensures that the provider processes the personal data of visitors to our website only in accordance with our instructions and in compliance with the GDPR.

3. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection requirements and this Privacy Policy.

Various personal data is collected when you use this website. Personal data is information that can be used to identify you personally. This Privacy Policy explains what data we collect, what we use it for, and how and for what purposes it is processed.

Please note that data transmitted over the internet, for example when communicating by email, may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information about the Data Controller

The data controller responsible for processing data on this website is:

Sonntag GmbH & Co. KG
Zur Christinenhütte 16
57368 Lennestadt
Germany

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

Telephone: +49 2721 7160
Email: info@sonntag-lennestadt.de

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data, such as names, email addresses and similar information.

Storage Period

Unless a more specific storage period is stated in this Privacy Policy, we retain your personal data until the purpose for processing it no longer applies. If you submit a valid request for erasure or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible grounds for retaining it, such as retention periods under tax or commercial law. In that case, the data will be deleted once those grounds no longer apply.

General Information about the Legal Bases for Data Processing on This Website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or, where special categories of data under Article 9(1) GDPR are processed, Article 9(2)(a) GDPR. If you expressly consent to the transfer of personal data to third countries, processing also takes place on the basis of Article 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device, for example through device fingerprinting, processing also takes place on the basis of Section 25(1) TDDDG. Consent may be withdrawn at any time. If your data is necessary for the performance of a contract or to take steps before entering into a contract, we process it on the basis of Article 6(1)(b) GDPR. Where processing is necessary to comply with a legal obligation, we process your data on the basis of Article 6(1)(c) GDPR. Processing may also take place on the basis of our legitimate interests under Article 6(1)(f) GDPR. The following sections explain the legal bases that apply in each case.

Data Protection Officer

We have appointed a data protection officer.

For the attention of the Data Protection Officer
Sonntag GmbH & Co. KG
Zur Christinenhütte 16
57368 Lennestadt

Telephone: +49 2762 6007432
Email: datenschutz@sonntag-lennestadt.de

Recipients of Personal Data

We work with various external organisations in the course of our business activities. In some cases, this requires personal data to be transferred to those organisations. We disclose personal data to external organisations only where this is necessary to perform a contract, where we are legally obliged to do so, for example when disclosing data to tax authorities, where we have a legitimate interest in disclosure under Article 6(1)(f) GDPR, or where another legal basis permits disclosure. When using data processors, we disclose our customers’ personal data only on the basis of a valid data processing agreement. Where processing is carried out jointly, a joint controllership agreement is concluded.

Withdrawing Your Consent to Data Processing

Many data processing activities are possible only with your express consent. You may withdraw consent you have already given at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to Object to Data Collection in Specific Cases and to Direct Marketing (Article 21 GDPR)

WHERE DATA IS PROCESSED ON THE BASIS OF ARTICLE 6(1)(e) OR (f) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE LEGAL BASIS FOR EACH PROCESSING ACTIVITY IS SET OUT IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING. THIS ALSO APPLIES TO PROFILING INSOFAR AS IT RELATES TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ARTICLE 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work or the place of the alleged infringement. This right is without prejudice to any other administrative or judicial remedy.

Right to Data Portability

You have the right to receive data that we process automatically on the basis of your consent or in performance of a contract, either yourself or through a third party, in a commonly used, machine-readable format. If you request direct transfer to another controller, we will do so only where technically feasible.

Access, Rectification and Erasure

Under applicable legal provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of processing. Where applicable, you also have the right to rectification or erasure. You may contact us at any time about these rights or any other questions concerning personal data.

Right to Restriction of Processing

You have the right to request restriction of the processing of your personal data. You may contact us at any time to exercise this right. The right to restriction applies in the following circumstances:

• If you contest the accuracy of your personal data held by us, we generally need time to verify it. You have the right to request restriction of processing for the duration of that verification.
• If the processing of your personal data was or is unlawful, you may request restriction of processing instead of erasure.
• If we no longer need your personal data but you require it to establish, exercise or defend legal claims, you have the right to request restriction of processing instead of erasure.
• If you have objected under Article 21(1) GDPR, your interests must be weighed against ours. Until it has been determined whose interests prevail, you have the right to request restriction of processing.

Where processing has been restricted, your personal data may, apart from storage, be processed only with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the website operator. You can recognise an encrypted connection when the browser address changes from “http://” to “https://” and a padlock symbol appears in your browser’s address bar.

When SSL/TLS encryption is enabled, data you transmit to us cannot be read by third parties.

4. Data Collection on This Website

Cookies

Our website uses cookies. Cookies are small data packages that do not harm your device. They are stored either temporarily for the duration of a session, known as session cookies, or permanently, known as persistent cookies. Session cookies are deleted automatically at the end of your visit. Persistent cookies remain on your device until you delete them yourself or your browser deletes them automatically.

Cookies may originate from us, known as first-party cookies, or from third-party companies, known as third-party cookies. Third-party cookies allow particular services provided by other companies to be integrated into websites, such as cookies used to process payment services.

Cookies perform different functions. Many are technically necessary because certain website functions would not work without them, such as shopping basket functions or displaying videos. Other cookies may be used to analyse user behaviour or for advertising.

Cookies required for electronic communications, to provide particular functions you have requested, such as shopping basket functions, or to optimise the website, such as cookies used to measure website audiences, are stored on the basis of Article 6(1)(f) GDPR unless another legal basis is stated. The website operator has a legitimate interest in storing necessary cookies to provide its services reliably and efficiently. Where consent to storing cookies and comparable recognition technologies has been requested, processing takes place exclusively on the basis of that consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

You can configure your browser to notify you when cookies are set and allow them only in individual cases, reject cookies in specific cases or generally, and enable automatic deletion when the browser is closed. Disabling cookies may restrict the functionality of this website.

Information about any additional cookies and services used on this website is provided in this Privacy Policy.

Contact Form

If you send us an enquiry through the contact form, we store the information you provide, including your contact details, to process your enquiry and address any follow-up questions. We do not disclose this data without your consent.

Processing takes place on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary to take steps before entering into a contract. In all other cases, processing is based on our legitimate interest in handling enquiries efficiently under Article 6(1)(f) GDPR, or on your consent under Article 6(1)(a) GDPR where this has been requested. Consent may be withdrawn at any time.

We retain the data you enter in the contact form until you request its deletion, withdraw your consent to storage, or the purpose for storing it no longer applies, for example after your enquiry has been dealt with. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Enquiries by Email, Telephone or Fax

If you contact us by email, telephone or fax, we store and process your enquiry, including any personal data it contains, such as your name and the details of your enquiry, to address your request. We do not disclose this data without your consent.

Processing takes place on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary to take steps before entering into a contract. In all other cases, processing is based on our legitimate interest in handling enquiries efficiently under Article 6(1)(f) GDPR, or on your consent under Article 6(1)(a) GDPR where this has been requested. Consent may be withdrawn at any time.

We retain data you send to us in contact enquiries until you request its deletion, withdraw your consent to storage, or the purpose for storing it no longer applies, for example after your request has been dealt with. Mandatory statutory provisions, particularly statutory retention periods, remain unaffected.

5. Plugins and Tools

Google Fonts (Local Hosting)

This website uses Google Fonts, provided by Google, to ensure consistent font presentation. Google Fonts are installed locally. No connection to Google servers is established for this purpose.

Further information about Google Fonts is available at https://developers.google.com/fonts/faq and in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en.

Google Maps

This website uses the Google Maps mapping service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, referred to below as Google. This service allows us to embed maps on our website.

Using Google Maps requires your IP address to be stored. This information is generally transferred to a Google server in the USA and stored there. The provider of this website has no influence over this transfer. When Google Maps is activated, Google may use Google Fonts to ensure consistent font presentation. When you access Google Maps, your browser loads the required web fonts into its cache to display text and fonts correctly.

We use Google Maps in the interest of presenting our online services attractively and making the locations specified on our website easy to find. This constitutes a legitimate interest under Article 6(1)(f) GDPR. Where corresponding consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.

Transfers of data to the USA are based on the European Commission’s Standard Contractual Clauses. Details are available at https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

Further information about the handling of user data is available in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en.

The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Each company certified under the DPF undertakes to comply with these standards. Further information is available from the provider at https://www.dataprivacyframework.gov/participant/5780.