Privacy Policy

I. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

SUNNYSUE GmbH represented by its Managing Director Susan Sonnenschein Rutenweg 2 39291 Möckern Germany

Phone: +49 (0) 39221-657670 Email: info@sunnysue.de

II. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functional website and our content and services, or where you have given your consent.

Depending on the processing operation, the legal bases for processing are:

• Art. 6(1)(a) GDPR, where you have consented to the processing;
• Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or for pre-contractual measures;
• Art. 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation to which we are subject;
• Art. 6(1)(f) GDPR, where processing is necessary for the purposes of a legitimate interest pursued by us or by a third party, provided that your interests, fundamental rights and freedoms do not override that interest.

The applicable legal basis is stated in the respective sections below.

Personal data will be erased as soon as the purpose of storage ceases to apply, unless statutory retention obligations (e.g. under commercial or tax law) require further storage.

III. Hosting and Server Log Files

Our website is hosted by an external service provider:

ALL-INKL.COM – Neue Medien Münnich Hauptstraße 68 02742 Friedersdorf Germany

A data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting provider.

Each time our website is accessed, the hosting provider's system automatically collects data and information from the computer system of the accessing device. The following data is collected:

• Browser type and version used
• The user's operating system
• The user's IP address
• Date and time of access
• Website from which the access originates (referrer URL)
• Pages and files accessed

This data is stored in the log files of our system. It is not combined with other personal data of the user.

The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR. Our legitimate interest lies in enabling the delivery of the website, ensuring its functionality and security, and being able to trace misuse. The data is not analysed for marketing purposes.

Log files are deleted or anonymised after no more than 7 days.

The collection of this data and its storage in log files are strictly necessary for the operation of the website. You may object to this processing pursuant to Art. 21(1) GDPR on grounds relating to your particular situation; as a rule, however, we will be unable to discontinue it, as the secure delivery of the website is not technically possible without it and this therefore constitutes a compelling legitimate ground.

IV. Cookies and Web Analytics

Our website uses technically necessary cookies and – only where you have given your consent – cookies and similar technologies for web analytics. Cookies are text files that are stored in the internet browser or by the internet browser on the user's device.

We use technically necessary cookies in order to:

• store language settings,
• maintain the login status in the B2B customer area during a session (session cookie),
• store the choice you have made in our consent banner.

The storage of information on your device and the access to it are based on Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as these cookies are strictly necessary to provide the service expressly requested by you (use of the website and of the login area). The associated processing of personal data is based on Art. 6(1)(f) GDPR; our legitimate interest lies in the functional provision of our website.

The user data collected by technically necessary cookies is not used to create user profiles.

You can delete cookies or restrict their storage at any time in your browser settings. If cookies are deactivated, it may not be possible to use all functions of the website – in particular the login area – to their full extent.

Web Analytics with Google Analytics 4

If you have given your consent via our consent banner, we use the web analytics service Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

We use Google Analytics 4 to measure the reach of our website, to understand how it is used and to improve our content and our offering on that basis.

Google Analytics 4 uses cookies and similar technologies that enable an analysis of your use of the website. The data processed in this context includes in particular:

• pages and files accessed, and the duration of use
• the website from which the access originates (referrer URL)
• approximate location at city level, derived from the IP address
• browser type and version, operating system, device type and screen resolution
• interaction events (e.g. clicks, scrolling, downloads)
• a pseudonymous identifier assigned to your browser or device

In Google Analytics 4, IP addresses are neither logged nor permanently stored. For traffic originating in the EU, IP data is used solely to derive coarse location information and is deleted immediately afterwards; the corresponding lookups take place on EU-based servers before the traffic is forwarded for processing. The other information generated is transmitted to a Google server; this may also involve a transfer to the USA.

We have set the retention period for user- and event-level data in Google Analytics to 14 months. After this period, the data is automatically deleted. Aggregated reports are not affected by this deletion.

The advertising features of Google Analytics – in particular the "Google Signals" function – are not activated. We therefore do not receive any information about the age, gender or interests of our visitors, and the data collected is neither linked to your Google account nor combined across the different devices you use.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings on our website. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

Google LLC is certified under the EU-US Data Privacy Framework; any transfers to the USA are therefore covered by an adequacy decision of the European Commission pursuant to Art. 45 GDPR. In addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR have been concluded with Google.

Further information can be found in Google's privacy policy: https://policies.google.com/privacy

V. Contact

You can contact us by email (info@sunnysue.de) or by telephone. In this case, we process the personal data you provide (e.g. name, email address, content of your enquiry) exclusively for the purpose of handling your enquiry.

A contact form is also available on our website. The data entered in the input mask (mandatory fields: name, email address, message) is transmitted to us and stored. At the time of submission, the date and time of transmission are also stored.

The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest lies in responding to your enquiry. If the contact is aimed at the conclusion or performance of a contract, the additional legal basis is Art. 6(1)(b) GDPR.

Apart from our hosting provider named in Section III, the data is not passed on to third parties in this context.

The data will be erased as soon as the respective conversation has ended and the matter concerned has been conclusively resolved, unless statutory retention obligations (in particular for business correspondence) require further storage.

VI. B2B Customer Area (Login)

On our website, we provide an access-restricted area for business customers (B2B area). Access is granted via personal login credentials and is intended exclusively for entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB).

In the context of setting up and using the B2B access, we process the following data:

• Company name and address
• Name of the contact person
• Business email address
• Telephone number (optional)
• Login credentials (username; password stored in hashed form only)
• IP address as well as date and time of registration and of logins

The processing serves the provision of the B2B area, the verification of the entrepreneur status, the initiation and maintenance of the business relationship, and the security of the login area (traceability of access, prevention of misuse).

The legal basis is Art. 6(1)(b) GDPR (implementation of pre-contractual measures and of the business relationship); insofar as data of contact persons of legal entities is processed, the legal basis is additionally Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with our business customers and in the secure operation of the customer area.

The data will be erased as soon as the user account is closed, unless statutory retention obligations require further storage. Deletion of the access can be requested at any time by informal email to info@sunnysue.de.

VII. Recipients of the Data

Within our company, only those departments that require your data to fulfil the purposes stated above have access to it. External service providers (in particular the hosting provider, the web analytics provider and, where applicable, IT service providers) act only within the framework of data processing agreements pursuant to Art. 28 GDPR. No data is transferred to third countries outside the EU or the EEA, with the exception of the transfer to Google described in Section IV.

VIII. Your Rights as a Data Subject

If your personal data is processed, you have the following rights vis-à-vis the controller:

• Right of access (Art. 15 GDPR): You may request information as to whether and which personal data we process about you, for what purposes, to which recipients it is disclosed and for how long it is stored.
• Right to rectification (Art. 16 GDPR): You have the right to request the immediate rectification of inaccurate data or the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You may request the immediate erasure of your personal data, provided that the statutory requirements are met and no exception (e.g. statutory retention obligations) applies.
• Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your data under the statutory conditions.
• Right to data portability (Art. 20 GDPR): You have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
• Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent given at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Without prejudice to any other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority responsible for us is:

Landesbeauftragter für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection of Saxony-Anhalt) Leiterstraße 9 39104 Magdeburg Germany https://datenschutz.sachsen-anhalt.de

To exercise your rights, an informal message to the contact details stated in Section I is sufficient.

IX. No Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

X. Validity and Amendment of this Privacy Policy

Last updated: July 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version is available on our website at any time.

This privacy policy is a translation. In the event of any discrepancy between the language versions, the German version shall prevail.