Privacy policy

1. Controller

SON Besitz GmbH & Co. KG
Am Wasserfall 6
57368 Lennestadt
Germany
Phone: +49 2721 949905-9
Email: info@son-group.com

Represented by its general partner SON Verwaltungs GmbH, which in turn is represented by its managing director Patrick Sonntag. A data protection officer does not have to be appointed under Art. 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG).

2. Principles of this website

This website is deliberately kept simple. It does not set cookies, does not use tracking or marketing tools, does not embed third-party content (no externally loaded fonts, maps, videos or social networks) and does not contain a contact form. Personal data is only processed to the extent described below.

3. Hosting and server log files

The website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When the website is accessed, the hosting provider's server records the following information for technical reasons:

• the page or file accessed and the previously visited page (referrer),
• browser type and version, operating system and device type,
• date and time of access,
• IP address, which according to the hosting provider is anonymised at the time of collection.

The processing serves the secure and stable provision of the website. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the functionality and security of the website. According to the hosting provider, log data is stored for eight weeks and then deleted. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS SE.

From the log data, the hosting provider compiles aggregated access statistics (IONOS WebAnalytics), for example on page views, referring pages, browsers and operating systems. For this purpose, the IP address is processed in anonymised form only and is used solely to determine the approximate region of access. No cookies or other recognition techniques are used; the data cannot be attributed to individual persons and is not passed on to third parties. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in monitoring the availability and use of the website. You may object to this processing pursuant to Art. 21 GDPR (see section 6).

4. Contact by email or phone

If you contact us by email or phone, we process the information you provide (in particular your name, contact details and the content of your enquiry) in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract or to steps prior to entering into a contract, and otherwise Art. 6(1)(f) GDPR; the legitimate interest lies in responding to enquiries.

The data is deleted once the enquiry has been dealt with in full, unless statutory retention obligations apply. Under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), business correspondence including emails is retained for up to six years and accounting records for up to ten years.

For email we use Microsoft 365 provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor pursuant to Art. 28 GDPR. Processing by Microsoft Corporation in the USA cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission of 10 July 2023 exists (Art. 45 GDPR); in addition, the standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR).

For telephony we use the cloud telephone system of sipgate GmbH, Gladbacher Straße 74, 40219 Düsseldorf, Germany, as a processor pursuant to Art. 28 GDPR. This involves processing in particular your telephone number, the time and duration of the call and, where applicable, a message left on our voicemail. Processing takes place on servers within the European Union.

5. Encryption

The website is delivered exclusively via an encrypted connection (TLS). You can recognise this by the address beginning with https:// and the padlock symbol in your browser.

6. Your rights

With regard to the personal data concerning you, you have the following rights against us:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

Right to object pursuant to Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

An informal message to the contact details above is sufficient to exercise your rights.

7. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2-4
40213 Düsseldorf
Germany

8. Other information

There is no automated decision-making, including profiling, pursuant to Art. 22 GDPR. You are under no statutory or contractual obligation to provide us with personal data; without such information, however, we are unable to respond to enquiries.

This English version is provided for convenience. In case of doubt, the German version shall prevail.

Last updated: November 2026