Privacy policy

This is a translation. The German version is legally binding: Datenschutz.

We process personal data on this website only to the extent necessary for its operation, its security and the handling of your enquiries. Below we explain which data this is, what we use it for and what rights you have.

Controller

SONNWINN GmbH
Elbstraße 88/1
22880 Wedel, Germany
represented by the managing directors Marco Wilke and Robert Pfatischer

Phone +49 4103 121 4221
E-mail kontakt@sonnwinn.de

Hosting and server logs

The website is hosted on a server of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in a data centre in Germany. A data processing agreement under Art. 28 GDPR is in place with STRATO.

When a page is requested, the web server automatically stores: IP address, date and time, requested address, status code and amount of data transferred, the previously visited page (referrer) and browser and operating system. We need this data to deliver the website, find errors and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). The logs are deleted after 14 days; they are kept longer only if a security incident has to be investigated.

Statistics without cookies (Matomo)

To understand which pages are used, we use the open-source software Matomo. Matomo runs on our own server (statistik.sonnwinn.de); no data is passed on to third parties. Matomo does not set cookies and does not store anything on your device.

We record the pages visited, date and time, the referring page, browser, operating system, screen resolution, language, clicks on phone numbers and e-mail addresses and the sending of an enquiry. Your IP address is shortened by two bytes before it is stored (e.g. 192.168.xxx.xxx), so that it can no longer be attributed to you. The legal basis is our legitimate interest in evaluating and improving our website (Art. 6(1)(f) GDPR). Individual records are deleted after 180 days; after that only aggregated reports without personal reference remain.

Enquiry form

If you contact us via the enquiry form, we process the information you enter: the service requested, details of the project (type of plant, location, size, project status, message) and your contact details (name, company, e-mail address and, optionally, phone number). Mandatory fields are marked.

We use this information to handle your enquiry and answer follow-up questions. The legal basis is your consent (Art. 6(1)(a) GDPR) and, where your enquiry is aimed at a contract, Art. 6(1)(b) GDPR. You can withdraw your consent at any time by e-mail; processing carried out until then remains lawful.

The information is transmitted in encrypted form, sent to us by e-mail and stored in a protected area on our server, which only our management and authorised staff can access with two-factor authentication. It is deleted there automatically after 24 months, or earlier at your request. Statutory retention periods, for example if the enquiry leads to an order, remain unaffected. We send a short confirmation of receipt to your e-mail address; it does not contain your entries.

To protect against automated enquiries, the form contains a field that is invisible to visitors; we do not use third-party services (such as captchas). To limit misuse, we store your IP address in irreversibly encrypted form (hash) together with the time of the enquiry for no longer than one hour.

E-mail and Microsoft 365

For e-mail we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Enquiries sent via the form and e-mails to us are stored and processed there. A data processing agreement is in place with Microsoft. A transfer to the USA cannot be ruled out; Microsoft is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

No embedded third-party services

This website does not load content from external servers: fonts are hosted on our server, maps are our own graphics, and there are no videos, social media buttons or advertising. Links to other websites (e.g. authorities or data sources) are plain links; only when you follow them do the privacy policies of the respective providers apply.

Your rights

You have the right of access to the data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

For any of these requests, a message to kontakt@sonnwinn.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (Independent Centre for Privacy Protection Schleswig-Holstein), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de.

Encryption

The website is transmitted exclusively in encrypted form (TLS). You can recognise this by “https://” in your browser’s address bar.

As of October 2026