Globale sonnen Privacy Policy for Customers and Business Partners

1. What does this Privacy Policy cover?

This Privacy Policy informs you about the processing of your personal data by companies belonging to the sonnen Group (hereinafter “sonnen,” “we,” or “us”).

This Privacy Policy is intended for our customers, suppliers, business partners, and/or investors, as well as visitors to our website and customer portal. If you visit any of the websites we operate, our provisions regarding data protection and the use of cookies also apply.

In addition, local privacy policies and regulations may apply in the countries where we operate, reflecting local practices and applicable legal requirements. This Privacy Policy is therefore always subject to the applicable legal provisions and may be amended accordingly.

This Privacy Policy explains what personal data is processed, for what purposes, how long we retain the personal data, how you can access and update your personal data, where you can obtain further information, and where you can file a complaint.

2. Special note if you are under 16 years of age: Processing of children’s personal data

If you are under 16 years of age (or older, if required by law), please do not send us any personal data (such as your name, address, and email address). If you would still like to ask us a question that requires you to provide your personal data (e.g., in connection with an educational program or an event we offer), please contact your parents or legal guardians and ask them to contact us on your behalf.

3. What personal data do we process?

We process the following personal data from and in connection with individuals who are customers, suppliers, business partners, and/or investors:

Personal contact information (such as name, mailing address, email address, and phone number) to the extent necessary for the intended purposes;

Business contacts and other information (such as job title, department, company name, and the reason for collaborating with sonnen).

4. Who is responsible for the personal data collected?

The data controller as defined by law is sonnen Holding GmbH, Am Riedbach 1, 87499 Wildpoldsried, Germany, and/or the company within the sonnen Group with which you have a contractual relationship.

5. For what purpose do we process your personal data?

We process the personal data we receive from you in the following cases based on these provisions:

5.1 In the course of our business activities and to fulfill concluded contracts

Conducting our business operations, including for the purposes of research, development, and improvement of the products and services we offer; to enter into and fulfill contracts with customers, suppliers, and business partners; to record and bill for services, products, and materials provided by and to sonnen; to manage and promote a business relationship, e.g., to maintain and foster contacts with existing and potential future customers; for our accounting, customer service, and the development, implementation, and analysis of market surveys and marketing strategies.

5.2 Organization of our business processes

The organization and management of our business, including financial and asset management, the implementation of control mechanisms, and for reporting, evaluations, audits, and internal investigations.

5.3 Health and safety

To protect the health and safety of our employees, including the protection of a person’s life or health, we verify a person’s identity and their access permissions to our companies’ facilities and properties.

5.4 Compliance with legal requirements; enforcement of rights

Compliance with legal and regulatory requirements, including for the purpose of conducting legal proceedings or defending against claims.

5.5 Cross-referencing with publicly available sanctions lists

To comply with legal obligations, protect assets, our employees, and contractors, and, in particular, to ensure that sonnen can comply with all trade control laws, anti-money laundering and/or anti-bribery and corruption laws, and other legal requirements, we conduct regular checks (at least quarterly) on our existing and potential future customers and business partners.

This screening is based on publicly available or government-issued sanctions lists. It is conducted in Europe. To this end, we compare your first and last names with the data contained in the published sanctions lists. In the event of an initial match, we will use the data stored by sonnen (e.g., date of birth, nationality, address) to verify whether the match is indeed accurate. For this verification, sonnen may also use other public sources, such as information from credit reporting agencies. sonnen may also contact the individual directly for this purpose to obtain further information. If sonnen is unable to rule out the match, we reserve the right to engage the services of external consultants for further review and assessment.

If a match is confirmed, sonnen Holding GmbH, a company of the sonnen Group, or an affiliate of the sonnen Group may be required under applicable legal, regulatory, or capital markets laws to disclose or report the match to the relevant authorities or regulatory bodies. To the extent required by law, sonnen must file the appropriate reports with the relevant local or international supervisory authorities.

The legal basis for this data processing is Article 6(1)(c) and (f) of the General Data Protection Regulation (GDPR).

The review does not result in automated decisions regarding an existing customer or business partner or a prospective customer or business partner.

6. Legal basis for the processing of personal data

The personal data covered by this Privacy Policy is processed exclusively in accordance with the following provisions:

to contact a person upon request prior to entering into a contract;

to perform a contract that you have entered into with sonnen;

to the extent necessary to comply with the laws and legal regulations to which we are subject;

to the extent necessary to pursue sonnen’s legitimate business interests, provided that these are not overridden by the overriding interests, fundamental rights, or fundamental freedoms of the data subject; or

(only to the extent required by law) with a person’s explicit consent.

In cases where we process personal data with your consent, you have the right—unless otherwise provided by law—to withdraw your consent at any time. The withdrawal does not affect the lawfulness of the processing carried out up to the time of withdrawal.

7. To whom do we disclose personal data?

Your personal data is processed exclusively for the purposes described in this Privacy Policy. Access to personal data is granted solely in accordance with the principle of necessity (the “need-to-know principle”).

To the extent necessary for the purposes specified in Section 5, your personal data may be disclosed to other companies within the sonnen Group as well as to companies affiliated with the sonnen Group.

Provided that you have given your consent or there is a corresponding legal basis, we may also share your personal data within the sonnen Group to inform you about products, services, events, or other offers that may be of interest to you. Such communications are always conducted in compliance with applicable data protection regulations.

To provide our products and services and to fulfill existing contractual relationships, your personal data may also be shared with companies within the sonnen Group that perform certain internal support, administrative, IT, sales, service, or other business functions.

In addition, personal data may be transferred to carefully selected and contractually bound service providers, commercial agents, distribution partners, consultants, subcontractors, or other business partners to the extent necessary to fulfill the aforementioned purposes.

Furthermore, we may disclose personal data to competent courts, authorities, supervisory agencies, government agencies, or other public institutions to the extent necessary to comply with legal obligations, to protect legitimate interests, or to assert, exercise, or defend legal claims.

8. Transfer of personal data

To the extent that personal data is transferred to companies within the sonnen Group, affiliated companies, or other recipients within or outside the country in which you reside—including countries outside the European Economic Area (EEA)—we ensure, through appropriate technical, organizational, contractual, and legal measures, that your personal data is protected in accordance with applicable data protection laws.

If personal data is transferred to countries outside the EEA, this will only take place to the extent that there is an appropriate legal basis for such a transfer under applicable data protection regulations. This may be the case, in particular, if the European Commission has issued an adequacy decision for the country in question or if appropriate safeguards within the meaning of Article 46 of the GDPR have been provided, in particular through the conclusion of the Standard Contractual Clauses approved by the European Commission. Where necessary, additional appropriate supplementary safeguards will be implemented to ensure an adequate level of protection for the personal data.

You can obtain further information regarding the safeguards used for international data transfers from us upon request.

9. How long will your personal data be retained?

We store personal data only for as long as is necessary to fulfill the purposes for which the data was collected, including the fulfillment of contractual obligations, the protection of legitimate interests, and compliance with statutory retention and record-keeping requirements.

Personal data processed in connection with a contractual relationship, the initiation of business dealings, or the conduct of business relationships is generally retained for the duration of the business relationship and, beyond that, for the period necessary to fulfill statutory retention obligations or to assert, exercise, or defend legal claims.

Personal data that we have collected without a business relationship or contractual relationship being established is deleted or anonymized as soon as the respective purpose of processing no longer applies, provided there are no statutory retention obligations or other legitimate reasons for further storage.

Personal data processed in connection with sanctions list checks is stored only for as long as necessary to conduct the respective check, fulfill legal obligations, or document compliance requirements.

Upon expiration of the applicable retention period, the personal data will be deleted, anonymized, or subject to restricted processing to the extent and for as long as further processing is no longer necessary.

10. How can I access my personal data?

Our goal is to keep the information we have stored about you accurate and up to date. You have the legal rights granted under the GDPR.

You may request access to your personal data, as well as request the correction of inaccurate personal data and the completion of incomplete personal data. In addition, you may request the erasure of your personal data, provided the legal requirements for doing so are met. Furthermore, you have the right to request the restriction of the processing of your personal data and the portability of your personal data in accordance with legal provisions.

To the extent that we process your personal data on the basis of Article 6(1)(f) of the GDPR, you also have the right to object to this processing at any time for reasons arising from your particular situation. In the event of an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing or the processing is necessary for the establishment, exercise, or defense of legal claims.

To exercise your rights, please contact the data controller listed below.

11. Who can I contact for further information?

If you have any questions about this Privacy Policy, the processing of your personal data, or the exercise of your data protection rights, you may contact sonnen Holding GmbH or the respective company within the sonnen Group with which you have a business relationship:

sonnen Holding GmbH, Am Riedbach 1, 87499 Wildpoldsried, Germany, Email: privacy-notice@sonnen.de

Regardless of this, you have the right to file a complaint with a data protection supervisory authority. In particular, you may contact the supervisory authority responsible for your place of residence, your workplace, or the location of the alleged data protection violation.

The competent supervisory authority for sonnen Holding GmbH is currently:

Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, Phone: +49 981 180093-0, Email: poststelle@lda.bayern.de, Website: www.lda.bayern.de

12. Contacting us via email or via the contact form

If you contact us via email, we will process the personal data you provide to handle your inquiry and for further communication with you.

This processing is carried out to implement pre-contractual measures or to fulfill a contract, to the extent that your inquiry relates to such matters, and otherwise based on our legitimate interest in processing inquiries pursuant to Article 6(1)(f) of the GDPR.

Your data will be stored only for as long as necessary to process your inquiry or as required by statutory retention or documentation obligations. Afterward, the data will be deleted or anonymized. The basis for the current policy is the Global Privacy Policy for Customers and Business Partners.

13. Collection of personal data when visiting our website

When you use our website for informational purposes only, we collect the personal data that your browser automatically transmits to our servers. This includes, in particular, the IP address, the date and time of access, the page accessed, the access status, the amount of data transferred, the previously visited website (referrer URL), information about the browser and operating system used, and the language setting.

This personal data is processed to ensure the technical operation of the website, to guarantee system security, and to improve the stability of our website. The legal basis for this is Article 6(1)(f) of the GDPR.

The log data is stored only as long as necessary for the purposes stated and is subsequently deleted, provided that no statutory retention obligations prevent this. The basis for the previous website clause is the existing privacy policy.

14. Additional features and services on our website

To the extent that you use the services offered by sonnen, we process the personal data required for this purpose in accordance with the relevant data protection legal bases.

To provide our services, we may engage carefully selected service providers and business partners who process personal data exclusively on our behalf or for the respective contractual purposes.

If personal data is transferred to recipients outside the European Economic Area (EEA), this is done exclusively in compliance with applicable data protection requirements and appropriate safeguards.

15. Security through technical and organizational measures

In accordance with applicable legal provisions, we implement appropriate technical and organizational measures to protect your personal data from loss, misuse, unauthorized access, unauthorized disclosure, alteration, destruction, and accidental or intentional manipulation. This includes, in particular, the encrypted transmission of personal data between your device and our systems using SSL or TLS encryption. Our security measures are continuously reviewed and improved in line with technological developments.

16. Use of cookies

For more information on the use of cookies on our website, please visit https://www.sonnen.nl/cookie-beleid.

17. Email security

As soon as you initiate electronic contact with sonnen, you consent to electronic communication. Please be aware that emails may be read or altered without authorization and without your knowledge while in transit. This website uses encryption technology only in certain areas. sonnen uses software to filter out unwanted emails (spam filter). The spam filter may block emails if they are incorrectly identified as spam based on certain characteristics.

18. Publication of job postings / online job applications

We collect and process your application data electronically for the purpose of handling the application process. The legal basis for data processing is Article 6(1)(a) of the GDPR. If your application results in the conclusion of an employment contract, the data you have provided may be stored by us in your personnel file for the purposes of standard organizational and administrative processes, in compliance with the relevant legal provisions. The legal basis for data processing is Article 6(1)(f) of the GDPR. If your application is rejected, the data you submitted will be automatically deleted two months after notification of the rejection. This does not apply if longer storage is necessary due to legal requirements (such as the burden of proof under the General Equal Treatment Act) or if you have expressly consented to longer storage in our database of prospective candidates.

19. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time. The most current version is always in effect and is subject to the applicable legal provisions. This Privacy Policy was last updated on August 24, 2026.