Manufacturer-independent adviceDelivery to businesses only (B2B)
+49 2133 273 791info@sono-medical.comDE · EN · FR
Request a quote

Privacy policy

Privacy Policy

In this privacy policy we inform you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR), which personal data we process when you visit this website or contact us, for what purposes and on what legal basis we do so, and what rights you have. Our offer is directed exclusively at companies, traders, freelance professionals and public institutions.

1. Controller

The controller responsible for data processing on this website is:

SonoMedical GmbH
represented by its managing director Claudia Peters
Hindenburgstr. 56
41542 Dormagen
Germany
Phone: +49 2133 273 791
Email: info@sono-medical.com

You can contact us at any time using these details with any questions about data protection or to exercise your rights. We have not appointed a data protection officer, as the legal requirements for a mandatory appointment are not met in our case.

2. Overview

So that you can quickly see which data is involved:

  • Without your consent, we set only one technically necessary cookie for visitors, which stores your decision in the consent banner (section 8).
  • Google Analytics 4 (statistics) and Google Ads conversion tracking and remarketing (marketing) are only loaded if you have previously consented to the respective category in the consent banner (sections 9 and 10). You can withdraw your consent at any time via the "Cookie settings" link at the bottom of every page.
  • Apart from this, we do not embed content from third-party providers (no video platforms, no map services, no social media plugins). Fonts, images and videos are loaded from our own web server.
  • We do not offer a newsletter and do not conclude contracts via the website.
  • No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

3. Hosting and server log files

3.1 Hosting

This website and our email mailbox are operated by the following provider:

[HOSTER – name, address]
Server location: [country, e.g. Germany]

The hosting provider processes the data transmitted via the website and by email solely on our behalf and in accordance with our instructions. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. The legal basis for using an external hosting provider is our legitimate interest in the secure, reliable and cost-efficient operation of our website and our email communication (Art. 6(1)(f) GDPR).

3.2 Server log files

Each time a page is accessed, your browser technically has to transmit data to our web server. The hosting provider stores this data in so-called server log files. This usually includes:

  • the IP address of the requesting device,
  • date and time of access,
  • the address (URL) accessed and the amount of data transferred,
  • the HTTP status code (e.g. whether the request was successful),
  • the previously visited page (referrer), if transmitted by the browser,
  • browser type and version, and operating system.

This data is required to deliver the website, to ensure its stability and security, and to detect and fend off malfunctions or attacks. It is not combined with other data and is not used to analyse your usage behaviour. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the purposes mentioned. The log files are deleted or anonymised after [NUMBER] days [insert hosting provider's information], unless a specific security incident requires longer retention for investigation.

4. Contacting us via enquiry forms, email or phone

4.1 Enquiry forms

You can contact us via enquiry forms on our website (e.g. a general contact enquiry or an enquiry about a specific device). In doing so, we process the information you enter in the form:

  • salutation, optional title, first and last name,
  • company, practice or clinic,
  • email address and phone number,
  • specialty and field of application,
  • your message and, where applicable, the device enquired about and selected probes or software packages.

We need the information marked as mandatory in order to assign your enquiry to the right subject, prepare a suitable offer and reach you for any questions. Without this information we cannot process the enquiry via the form; however, you can always contact us informally by email or phone.

After submission, your enquiry is sent by email to our mailbox info@sono-medical.com and is additionally stored in our website's database so that we can process it completely and traceably.

4.2 Automatic acknowledgement of receipt

After submitting a form, you will usually receive an automatic acknowledgement of receipt at the email address provided. It contains your salutation (where applicable with your name), the subject or the device enquired about, any selected probes and our contact details. It does not contain the text of your message. The acknowledgement serves to inform you that your enquiry has been received.

4.3 Contact by email or phone

If you contact us by email or phone, we process the data you provide (e.g. name, company, contact details, content of the enquiry) solely in order to deal with your request.

4.4 Legal bases

If your enquiry is aimed at an offer or a contract or relates to an existing contract, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract). As we work exclusively with companies and institutions, we otherwise process the data of the contact persons acting on their behalf on the basis of our legitimate interest in handling enquiries effectively and in communicating with our business partners (Art. 6(1)(f) GDPR). This also applies to general enquiries and to the storage of enquiries in our database.

4.5 Storage period

  • Enquiries that do not result in a business relationship are deleted no later than six months after the communication has ended, unless you request deletion earlier.
  • If your enquiry leads to an offer or contract, we retain the correspondence to the extent and for as long as necessary for the business relationship or as required by statutory retention obligations under German commercial and tax law (in particular Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO); usually six to ten years depending on the document). The legal basis for this is Art. 6(1)(c) GDPR.
  • The copy of the enquiry in the website database is deleted once the enquiry has been finally processed, but no later than six months.

4.6 Recipients

Within our company, your enquiry is only seen by the persons responsible for handling it. Our hosting provider has technical access as a processor (see section 3). Data is only passed on to third parties where this is necessary to carry out an order (e.g. to transport companies for delivery) or where we are legally obliged to do so.

5. Protecting the forms against misuse (spam protection)

To protect our forms against automated spam submissions, we use only our own procedures running on our server and no external services:

  • a field that is invisible to humans and is only filled in by automated programs,
  • a check of the time between opening and submitting the form,
  • a limit on the number of enquiries per hour. For this purpose, a hash value (a checksum that cannot be reversed) is generated from your IP address and a secret key and stored for one hour. Your IP address itself is not stored in plain text.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in keeping the forms functional and protecting ourselves against mass automated submissions. The hash value is deleted automatically after one hour.

6. Fonts

The fonts used on this website are stored on our own server and loaded from there. No connection to third-party servers (e.g. Google Fonts) is established for this purpose, and no data is transmitted to third parties.

7. Search function

The website's search function runs entirely in your browser. Your search terms are not transmitted to us or to third parties and are not stored.

8. Consent banner and cookies

8.1 Consent banner

When you first visit our website, we show you a banner in which you can decide whether you consent to the categories "Statistics" (Google Analytics 4) and "Marketing" (Google Ads conversion tracking and remarketing). You can accept or reject both categories together or select them individually. The banner is our own development and is delivered from our server; no external consent management provider is used.

To store your decision and avoid showing the banner again on every page view, we set the cookie "sm_consent". It contains only your choice for each category and the time of your decision, but no information that directly identifies you. The cookie is deleted after 12 months; we will then ask you again. It is not transmitted to third parties.

Storing this cookie is strictly necessary in order to respect your decision and is therefore permitted without consent (Section 25(2) no. 2 TDDDG). The related data processing is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent) and on Art. 6(1)(f) GDPR; our legitimate interest lies in implementing your choice and being able to demonstrate it.

8.2 Changing and withdrawing your choice

Via the "Cookie settings" link at the bottom of every page, you can reopen the banner at any time and withdraw your consent in full or for individual categories with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. After a withdrawal, we no longer load the services concerned and, where technically possible, delete the cookies they set on our domain.

8.3 Cookies without consent

Without your consent, no cookie other than "sm_consent" is set, and we do not store any other information in your browser's local storage (e.g. localStorage). Only for persons who log in as editors in the administration area of the website does the content management system WordPress set technically necessary cookies for the login. This is permitted without consent under Section 25(2) no. 2 TDDDG; the related data processing is based on Art. 6(1)(f) GDPR.

8.4 Google Consent Mode

We use Google's "Consent Mode" with the default setting "denied". As long as you have not given your consent, no Google script is loaded and no connection to Google servers is established. Only after your consent is the Google script loaded, and it receives information via Consent Mode about the categories for which your consent has been given.

9. Web analytics with Google Analytics 4 (category "Statistics")

If you have consented to the "Statistics" category, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). With Google Analytics we evaluate how our website is used – for example, which pages are viewed, how visitors reach our site and whether enquiry forms are submitted – in order to improve our offer and the website.

Data processed: Google Analytics sets cookies (in particular "_ga" and "_ga_<measurement ID>", storage period up to 2 years) in order to recognise your browser on subsequent visits. In particular, a pseudonymous identifier, pages viewed and interactions (e.g. clicks, form submissions), date and time, referring page, approximate location (country, region, city), device type, operating system, browser and screen resolution are processed. This data is not combined with your name or the content of your enquiries.

IP address: Your IP address is transmitted to Google but, according to Google, for access from the EU it is used only to derive the approximate location and is then discarded immediately; it is not logged or stored in Google Analytics.

Storage period: We have set the retention period for event and user data in Google Analytics to 2 months. After that, this data is deleted automatically; aggregated statistical reports without personal reference may be retained longer. The "Google signals" feature is deactivated.

Data processing on our behalf and transfer to third countries: Google processes the data for Google Analytics as our processor; we have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. It cannot be ruled out that data is transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR); where necessary, Google additionally bases transfers on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis: The storage of and access to information on your device is based on your consent under Section 25(1) TDDDG; the further processing of the data is based on your consent under Art. 6(1)(a) GDPR. Consent is voluntary; without it, Google Analytics is not loaded. You can withdraw it at any time via "Cookie settings" at the bottom of every page (section 8.2).

Further information: Google privacy policy https://policies.google.com/privacy; information on how Google uses data https://policies.google.com/technologies/partner-sites.

10. Google Ads conversion tracking and remarketing (category "Marketing")

If you have consented to the "Marketing" category, we use the conversion tracking and remarketing functions of Google Ads, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. They are integrated via the Google script "gtag".

  • Conversion tracking: If you reach our website via one of our Google ads, we can see whether a certain action follows (e.g. submitting an enquiry form). This is how we measure the success of our ads. We only receive aggregated reports, no information that allows us to identify you.
  • Remarketing: Visitors to our website may be added to audience lists so that we can later show them ads for our products on other websites or in Google Search.

Data processed: For this purpose, Google sets cookies on our domain (e.g. "_gcl_au", storage period up to 90 days) and, where applicable, cookies on Google's own domains (e.g. google.com, doubleclick.net), and processes in particular online identifiers, your IP address, pages viewed, the time of the visit, information about your browser and device, and the click on an ad. The content of your enquiries is not transmitted to Google.

Responsibility and transfer to third countries: Google also processes this data for its own purposes (e.g. to serve and bill ads) under its own responsibility; Google's privacy provisions apply. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR).

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR (your consent). Consent is voluntary and independent of the "Statistics" category; without it, conversion tracking and remarketing are not loaded. You can withdraw it at any time via "Cookie settings" at the bottom of every page (section 8.2).

Storage period: The cookies on our domain are deleted no later than at the end of the duration stated above. How long Google stores the data is governed by Google's provisions; membership in remarketing lists ends after the duration set by us of 180 days.

Further information and settings: Google privacy policy https://policies.google.com/privacy; information on advertising at Google https://policies.google.com/technologies/ads; manage or deactivate personalised ads in "My Ad Center": https://myadcenter.google.com/.

11. Contact via WhatsApp

Our website contains a link that you can use to contact us via WhatsApp. This is a simple link; no WhatsApp plugin or script is embedded. As long as you do not click the link, no data is transmitted to WhatsApp.

Only when you click the link is a connection to WhatsApp's servers established. The provider of the service for users in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of the Meta group. WhatsApp receives at least your IP address and technical information about your browser or device; if you then use WhatsApp, WhatsApp processes the related data under its own terms and under its own responsibility. Data may also be transferred to the USA. According to its own information, WhatsApp LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision under Art. 45 GDPR.

Using WhatsApp is voluntary. If you write to us via WhatsApp, we process your message and your phone number to deal with your enquiry on the basis of Art. 6(1)(b) or (f) GDPR (see section 4). If you do not want WhatsApp to receive data about you, please use our form, email or phone instead. For more information, please see WhatsApp's privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea.

12. Links to other websites

Our website contains links to websites of other providers, such as device manufacturers. These open in a new browser window. Data (in particular your IP address) is only transmitted to the respective provider when you click such a link. The respective provider is responsible for data processing on those websites; please refer to their privacy information.

13. Data security

For security reasons, this website uses an encrypted connection (TLS, recognisable by "https://" and the padlock symbol in your browser's address bar). As a result, data you submit via our forms cannot easily be read by third parties. In addition, we take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Please note that unencrypted emails are not fully protected during transmission.

14. Your rights

Under the GDPR you have the following rights, provided the respective legal requirements are met:

  • right of access to the data stored about you (Art. 15 GDPR),
  • right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR),
  • right to erasure (Art. 17 GDPR),
  • right to restriction of processing (Art. 18 GDPR),
  • right to data portability (Art. 20 GDPR),
  • right to object (Art. 21 GDPR, see below),
  • right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR), e.g. via "Cookie settings" at the bottom of every page.

To exercise your rights, an informal message to the contact details given in section 1 is sufficient.

Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes data protection law (Art. 77 GDPR). You may in particular contact the supervisory authority of your place of residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Postal address: Postfach 20 04 44, 40102 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

15. Updates to this privacy policy

We will amend this privacy policy if the functions of our website or the legal requirements change. The version published on this page applies.

In case of any discrepancy, the German version of this privacy policy prevails.

Last updated: October 2026

WhatsApp