Privacy Policy

Privacy policy

This page explains which data we process when you visit sonnenglas.net, order from us or write to us. We built the site to get by with little data: no Google Analytics, no Tag Manager, no advertising pixels, no tracking cookies. That is why there is no cookie banner.

At a glance

Questions about data protection: info@sonnenglas.net.

Who is responsible

Sonnenglas GmbH
Marschstraße 94, 25704 Meldorf, Germany
E-mail: info@sonnenglas.net · Phone: +49 4851 96390 63

Orders with a delivery address in the USA are concluded by our US company: SNGLS US LLC, 3833 Powerline Road, Suite 601-I, Fort Lauderdale, FL 33309, USA. For these orders SNGLS US LLC is the controller; Sonnenglas GmbH runs the website, order system and customer service on its behalf. You can reach both companies about data protection at info@sonnenglas.net.

We have not appointed a data protection officer; as a small company we are not required to (Section 38 BDSG).

Website and hosting: Cloudflare

The website and our own interface at sonnenglas.net/api run on Cloudflare (Cloudflare Pages and Workers). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

To deliver a page, Cloudflare processes technically necessary data: IP address, time, requested address, browser identifier and referrer. Cloudflare also uses it to fend off attacks and abuse. We only see aggregated numbers (for example page views per day and country), never individual visitors, and we do not use them for advertising.

Our interface also handles:

• Delivery country suggestion: from the country Cloudflare passes along, we suggest a delivery country in the cart and a country in the "Let me know" form. Nothing is stored, and we never redirect you automatically.
• Spam protection for forms, the logo preview and the interface for AI assistants: we count requests per IP address. The counter stays at Cloudflare for one hour and then expires. We do not use a CAPTCHA.
• Notices at the top of the page (for example about shipping times): only your region (de, at, ch, us, fr, en) is sent.

Legal basis: our legitimate interest in a secure, fast website (Art. 6(1)(f) GDPR). Cloudflare acts on our behalf (Art. 28 GDPR) and is certified under the EU-US Data Privacy Framework. Cloudflare privacy policy

What is stored on your device

We only store on your device what the shop needs to work — with one exception: the Google click ID when you arrive from a Google ad (see below). None of it builds a profile of you. The entries stay in your browser; they reach us only when you do something, such as checking the cart or ordering.

For every entry except sg-attr, Section 25(2) no. 2 TDDDG applies: it is strictly necessary for the shop you are using. For sg-attr we ask you first (Section 25(1) TDDDG). Further processing is based on Art. 6(1)(b) GDPR (contract and pre-contract steps) and Art. 6(1)(f) GDPR (legitimate interest in a working shop).

You can delete all entries in your browser at any time. Your cart will then be empty.

Orders and shipping

When you order, we need your name, delivery and billing address, e-mail address, the items you order and — if you give it — your phone number. Without these we cannot carry out the order. The data goes through our interface to xhosa, our own order system, where order, invoice and order confirmation are created. If you redeem an upgrade voucher, the serial number (or old order number) of your old SOMO goes along too; xhosa uses it to make sure each number works for one upgrade only and keeps it with the order. If you redeem a personal welcome voucher, the e-mail address you enter for it goes along with the voucher check already; xhosa uses it to make sure it is the address we sent the voucher to.

The carrier delivering your parcel (for example DHL or Swiss Post) receives your name and delivery address. We only pass on your e-mail address or phone number if the carrier needs it for delivery — for example for express and freight shipments or customs clearance. If you collect your order in Meldorf, none of this applies.

Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR). We keep invoices and accounting records as long as commercial and tax law require — in Germany up to ten years (Section 257 HGB, Section 147 AO; Art. 6(1)(c) GDPR).

Paying with Stripe

Payments are handled by Stripe. For orders outside the USA this is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Orders to the USA are charged by SNGLS US LLC through its own account with Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA.

You enter your payment details directly with Stripe; we never see them. We only learn whether the payment worked, the payment method and what we need for invoices and refunds. Stripe automatically checks every payment for fraud risk. If Stripe declines a payment, write to us — a person will look at the order.

We only load Stripe's payment script (Stripe.js) when you need it: at checkout and — once there is something in your cart — for the express buttons in the cart. Stripe then sets cookies and processes device and connection data to prevent fraud. If you pay with Apple Pay, Google Pay or Link, the privacy terms of Apple, Google or Stripe also apply.

Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure payments (Art. 6(1)(f) GDPR); for the cookies Section 25(2) no. 2 TDDDG. Stripe is responsible itself for parts of payment processing (such as fraud checks and legal duties). Stripe, Inc. is certified under the EU-US Data Privacy Framework. Stripe privacy policy

Measuring Google ads

We advertise on Google. Still, there is no Google script, pixel or cookie on our website. This is how we measure whether an ad led to a purchase:

1. When you click a Google ad, Google adds a click ID to the address (gclid, gbraid or wbraid).
2. We keep this click ID in session storage for your browser session (sg-attr) — no cookie; it is gone when you close the tab.
3. If you order in that session, the ID goes to xhosa with the order.
4. After the purchase, xhosa reports to Google Ads: click ID, order value, currency, time and our order number. We do not send your name, address or e-mail address.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google processes the report as a controller in its own right, also in the USA (Google is certified under the EU-US Data Privacy Framework).

Legal basis: our legitimate interest in measuring the success of our ads (Art. 6(1)(f) GDPR). You can object at any time: close the tab before ordering, or write to info@sonnenglas.net — then we report nothing to Google for your order.

Forms and customer service

Our forms (contact, warranty, withdrawal, become a reseller, jobs, corporate gifts, back-in-stock notice) send your details to our interface. It accepts only the fields of that form. So that no request gets lost, we keep a copy in a database at Cloudflare (without your IP address, with one exception below) and then pass the request on:

We handle e-mails to us and contact-form requests in Sirportly, a helpdesk software. The provider is based in the United Kingdom, which has an EU adequacy decision.

Legal basis: handling your request or preparing or performing a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR); for withdrawals also our legal obligation (Art. 6(1)(c) GDPR).

We delete the copy in the form database six months after passing it on. We keep withdrawal declarations as evidence until the end of the third year after receipt. We delete job applications six months after the process ends unless you agree to a longer period. The receipt for a withdrawal or warranty registration that you see after sending is available via its link for 90 days.

Against spam we use a hidden field, a timing check and the per-IP counter described above. For newsletter sign-ups, reseller applications, back-in-stock notices and call-back, offer and support requests from the concierge we also pass your IP address to Indaba, so that Indaba can limit sign-ups per connection. Until Indaba has accepted the request, it is kept with the copy in our database, for at most seven days. Legal basis: our legitimate interest in fending off abuse (Art. 6(1)(f) GDPR).

E-mails from us

Our systems send order confirmations, receipts and other e-mails through the delivery service Postmark (ActiveCampaign, LLC, USA). Postmark receives your e-mail address and the message content and acts on our behalf (Art. 28 GDPR).

Newsletter

For the newsletter we only need your e-mail address. It goes to Indaba, our own customer contact system. You first get an e-mail with a confirmation link; only after you click it do we send the newsletter (double opt-in). We store sign-up and confirmation with their time as evidence.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time — via the unsubscribe link in every issue or by e-mail to info@sonnenglas.net.

Back-in-stock notice

If a product is not available right now, you can sign up on its product page ("Let me know when it's available"). For this we process your e-mail address, the product's article number, the country you chose (or "Anywhere"), the region and language of the page and your IP address. The details go through our interface to Indaba, our own customer contact system. Indaba uses the IP address only to limit sign-ups per connection (see "Forms and customer service").

You first get an e-mail with a confirmation link; only after you click it is your entry on the list (double opt-in). As soon as the product is available, we write to you once. Every one of these e-mails has an unsubscribe link. This is not the newsletter — you sign up for that separately.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time — via the unsubscribe link or by e-mail to info@sonnenglas.net.

Logo preview for corporate gifts

On the corporate gifts page you can upload your logo and see how it looks on a jar. Before the first preview we ask for your e-mail address.

Logo, technique, scene and e-mail address go to SAM, our own image system. SAM sends the logo and a product photo to an AI image service that creates the preview, and has a second AI model check the result for misspellings in the logo. The requests run through OpenRouter, Inc. (USA); the images are created by models from OpenAI and Google. These services act on our behalf and may not use your images for their own purposes.

We delete logos and previews after 30 days. If you send the corporate gifts request, we attach your previews to your request in Indaba; they then stay as long as we work on the request.

Legal basis: pre-contractual steps (Art. 6(1)(b) GDPR). Please only upload logos you are allowed to use.

Sonnenglas concierge (chat)

On parts of our website we offer a chat assistant, the Sonnenglas concierge (the “Ask us” entry with the speech bubble at the top right of the navigation). It answers questions about our products, the shop and customer service (for example shipping, returns, warranty) from the content of this website and shows you suitable products. It only runs when you open it and type something.

For this we process your messages and the answers, the page you are on, the region and language of the page and a random session ID. These details go to our interface at Cloudflare and from there through our own AI access to the language model Claude by Anthropic. The requests run through OpenRouter, Inc. (USA); OpenRouter passes them on only to Anthropic, to no other provider. Our AI access stores neither your messages nor the answers. For each request it records only technical details without content: the name of our access, the model, the number of tokens, the cost, the time and a request ID. Our AI access does not delete these details; in our logging system they are kept for 360 days. We do not store the conversation on our servers: it stays in your browser until you close the tab.

Please do not type personal data into the chat. If the concierge needs your e-mail address, your name, your company, your phone number or a serial number — for example for a back-in-stock notice, a corporate gifts request or a call back or an offer from our team — it shows you a small form. These details are not sent to the AI service. They stay in your browser until you send the request with one click; then they reach us as with the respective form (see "Forms and customer service" and "Back-in-stock notice"). We record a call-back or offer request, with the summary you see before sending, in Indaba, our customer contact system; we only use a phone number if you give one. From the form the concierge only learns which fields you filled in; it sees the quantity and the country so it can help you further. Our interface only checks a serial number for its format. If you upload a logo in the chat, "Logo preview for corporate gifts" applies.

If it is about a problem with a product or an order, the concierge shows you a card with a prepared message to our support team. You check and edit it, enter your e-mail address and, if you like, your name, the order number or the serial number. Only when you click "Send to the team" do these details, the page you are using the chat on and your IP address (only to limit requests per connection) go through our interface to Indaba, our customer contact system. Indaba creates you as a contact there (or finds you by your e-mail address) and opens a support case; you get a reference (SG-…), and our team answers you by e-mail. This is no consent to marketing and no newsletter sign-up; the legal basis is handling your request (Art. 6(1)(b) GDPR, for an order) or our legitimate interest in answering customer requests (Art. 6(1)(f) GDPR). If the transfer does not work, we store none of it; the concierge then offers you a prepared e-mail to our support address, which you send yourself from your e-mail program. We handle it like any e-mail to us (see "Forms and customer service").

So that nobody overloads the service, we count requests and costs per session and per IP address. For this we store the IP address only as a checksum, for at most two days.

Legal basis: answering your request and pre-contractual steps (Art. 6(1)(b) GDPR).

Requests through AI assistants

If you use an AI assistant of your own (for example a chat service on your device), it can use our interface for assistants to search products, ask for prices and shipping costs and give you a link to the cart or the payment page. Only you can pay, on the payment page.

If an assistant sends us a corporate gifts request or a back-in-stock notice on your behalf, we receive the same details as through our forms (e-mail address, name, company, quantity, message; or e-mail address, product and country) and process them for the same purpose and on the same legal basis — see the sections above. The assistant must ask for your consent first; we refuse requests without it. Logo previews an assistant asks for are processed by our image system like uploads on our page (see "Logo preview for corporate gifts").

Carts an assistant creates with us are stored without personal data, for at most 24 hours. What your assistant itself does with your data is governed by its provider's privacy policy.

Images, fonts and YouTube

Product images come from our own image server sam.sonnenglas.net, our fonts from our own server. We do not embed Google Fonts or Adobe Fonts.

Some older journal posts contain YouTube videos. Opening such a post loads nothing from YouTube: you see a preview image from our server and a notice. Only when you click the video does your browser load it from YouTube (youtube-nocookie.com); without JavaScript the click opens the video on youtube.com. Google Ireland Limited then receives your IP address and browser details and may store data on your device, also in the USA. By clicking you consent to this (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); without a click nothing happens. Google privacy policy

What we do not use

No Google Analytics, no Google Tag Manager, no pixels from Google, Meta, TikTok or others, no advertising or tracking cookies, no social media plugins, no live chat from another provider (our own concierge is described in "Sonnenglas concierge"), no CAPTCHA. Links to our profiles on Instagram, LinkedIn, X and YouTube are plain links — you only reach the provider when you click them.

Who else receives data

Our own systems (xhosa, Indaba, SAM) run on servers of hosting providers in the EU that act on our behalf. Beyond that we only pass data to the parties named above, and to tax advisers and authorities where the law requires it — never to third parties for advertising, and we do not sell data.

Some providers are based in the USA or may process data there: Cloudflare, Stripe (for US orders and Link), Google, Postmark, and OpenRouter with the image models of OpenAI and Google and the language model Claude by Anthropic. We base these transfers on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).

How long we keep data

As long as we need it for the purpose — the specific periods are given in each section above. Then we delete it, unless the law requires longer retention (for example for invoices) or we need it to establish or defend legal claims.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)). Just write to info@sonnenglas.net — free of charge; we answer within one month.

Right to object (Art. 21 GDPR): where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to marketing e-mails at any time without giving reasons.

You can also complain to a data protection supervisory authority (Art. 77 GDPR). Ours is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

We make no automated decisions within the meaning of Art. 22 GDPR. Stripe's automatic fraud check can decline a payment; you can then ask for a person to review it.

For customers in the USA

We do not sell personal information and do not share it for cross-context behavioral advertising. "Do Not Track" signals from your browser change nothing, because we do not track you across websites anyway. You can request access, correction and deletion at info@sonnenglas.net.

Changes

If what the website does with data changes, we update this policy first. The version on this page applies.

Last updated: 25 October 2026