Privacy Policy

Controller

Data protection officer

SONKO Consulting GmbH is not required by law to appoint a data protection officer (Art. 37 GDPR in conjunction with § 38 BDSG), as we do not fall within any of the mandatory categories. All privacy-related requests are handled directly by the Managing Director. Please write to info@sonko-consulting.de for any concern.

Competent supervisory authority

Your rights

Under the GDPR you have the right to receive information about the personal data we process (Art. 15), to have inaccurate data corrected (Art. 16), to request the erasure (Art. 17) or restriction (Art. 18) of your data, to object to processing based on legitimate interests (Art. 21), to receive your data in a structured, common and machine-readable format (Art. 20) and to withdraw any consent you have given us with effect for the future (Art. 7 (3)).

You can exercise these rights informally by writing to info@sonko-consulting.de. If you believe we do not process your data lawfully, you have the right to lodge a complaint with the supervisory authority listed above.

How and why we process data

Outside of a signed advisory engagement with SONKO, we collect and process personal data only when you voluntarily provide it. We rely on the following legal bases:

1. Consent (Art. 6 (1) (a) GDPR)

• Getting in touch. When you send us your contact details to receive information or a proposal.
• Newsletter. Your email address (and optionally your name and title) are used to send you our LinkedIn newsletter The DACH Prestige Signal. You can unsubscribe at any time via the link in the newsletter or by writing to us.
• Free tools. When you use the Brand Fit Expansion check, the Leadership Mindset Audit or the Positioning Sanity-Check, you consent to us processing the inputs you provide in order to give you a result.

You can withdraw consent at any time with effect for the future by writing to us at the address above.

2. Performance of a (pre-)contract (Art. 6 (1) (b) GDPR)

• SONKO OS account. Creating and running your account and workspace, including email verification and password resets.
• Paid plans. Taking payment, granting access to the plan you bought, issuing invoices and handling refunds or cancellations.
• Contract execution. Client contact data, project data and correspondence processed to deliver our advisory services.
• Enquiries. Data you send us in the context of an enquiry, processed to send you a proposal or arrange a pre-contractual conversation.
• NDA workflow. When you request a mutual NDA through SONKO OS, we process the company details you provide (legal name, registered address, registration court, registration number, signatory) to prepare the NDA for signing.

3. Legal obligations (Art. 6 (1) (c) GDPR)

As a German limited-liability company we are subject to commercial-law and tax-law obligations, including reporting and record-keeping duties, for example the retention of invoice data under § 257 HGB and § 147 AO.

4. Legitimate interests (Art. 6 (1) (f) GDPR)

• Platform security. Logging access to SONKO OS, detecting misuse and protecting client data.
• Fraud prevention in payments. See the section on payments below.
• Campaign measurement. Understanding which campaign or channel a registration came from. See the section on campaign measurement below, including how to object.
• Direct communication. Using your email address to inform you about advisory services similar to those you have already engaged us for, as long as you have not objected.

Categories of data

• Customer and prospect data commonly used in business (name, business email, phone, company, role).
• Account data for SONKO OS (email address, password in hashed form, language preference, verification and password-reset tokens, login timestamps).
• Contract and mandate data (project brief, client materials shared under NDA, correspondence).
• NDA-preparation data (legal company name, registered address, registration court, registration number, signatory, and the signature image you draw when signing).
• Payment and invoicing data (billing address, tax IDs, invoice numbers, plan, amount, payment status and the payment references described under Payments).
• Usage data of SONKO OS (tool inputs such as Brand Fit Expansion answers and Leadership Mindset Audit responses, uploaded documents, AI chat messages).
• Campaign origin of a registration (see below).

Data collected when you visit our website

If you use our website for information only, your browser sends the following data to our server, which we process to display our pages and to keep them secure (Art. 6 (1) (f) GDPR):

• IP address
• Date, time and duration of the request
• Content of the request (page and click path)
• HTTP status code and transferred data volume
• Referring website
• Browser, operating system and version

Cookies

We do not show a cookie banner, because we do not need one. Our website and SONKO OS set no analytics cookies, no marketing cookies and no third-party cookies. The only two cookies we set are strictly necessary to provide the service you asked for, which means they are permitted without consent under § 25 (2) no. 2 TDDDG. The underlying processing is based on Art. 6 (1) (b) and (f) GDPR.

You can delete both cookies in your browser at any time. Deleting SONKOSID logs you out; deleting sonko_lang only resets the language choice.

Fonts and other external resources

Some of our pages load the typefaces Inter and Cormorant Garamond from Google Fonts, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When such a page loads, your browser contacts Google's font servers directly and your IP address becomes known to Google in the process. No cookie is set for this and we receive no data back. Legal basis is our legitimate interest in a consistent presentation of our pages (Art. 6 (1) (f) GDPR). Google's own policy is at policies.google.com/privacy.

Campaign measurement and the LinkedIn click identifier

We advertise on LinkedIn and elsewhere, and we want to know which campaign actually leads to a registration. We measure this ourselves, in our own database in Germany. We use no tracking pixel, no LinkedIn Insight Tag and no analytics service for it.

When you arrive at our registration page through a campaign link, that link carries parameters in the URL. If you then complete a registration, we store the following alongside your account:

• the campaign parameters from the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term);
• the LinkedIn click identifier (li_fat_id) if LinkedIn appended one to the link when you clicked the ad;
• the referring website, if your browser sent one.

If you arrive without such parameters, nothing is stored. If you do not register, nothing is stored. The record exists once per account and is never used to build a profile of your behaviour, to retarget you, or to decide anything about you.

The LinkedIn click identifier is currently stored only. We do not transmit it back to LinkedIn today. We keep it because LinkedIn's identifier expires 30 days after the click, so it cannot be recovered later; should we decide to report conversions to LinkedIn in the future, we will update this policy before doing so and describe the transfer here.

Legal basis is our legitimate interest in measuring the effectiveness of our own advertising (Art. 6 (1) (f) GDPR). Reading parameters that your browser transmits as part of the address does not store anything on, or read anything from, your device, so § 25 TDDDG does not apply. The record is stored for as long as your account exists and is deleted with it. You can object to this storage at any time under Art. 21 GDPR by writing to info@sonko-consulting.de; we will then delete the record for your account, which has no effect on your use of SONKO OS.

SONKO OS account and workspace

To create an account you give us an email address, a password and your company context. The password is never stored in readable form; we store only a cryptographic hash of it. We send a verification link to your email address to confirm that it is yours, and we send a one-time link if you ask to reset your password. Inside your workspace we process the material you put there: Fit-Check and audit answers, uploaded documents, notes, messages to Tity Sonko, and AI chat messages. Workspaces are logically separated so that one client cannot see another client's data.

Payments

Paid plans in SONKO OS are processed by Stripe. For users and businesses in the European Economic Area the contracting entity is Stripe Payments Europe, Limited, Dublin, Ireland. Stripe's US entity, Stripe, LLC, is a party to our agreement with Stripe specifically for the processing of personal data, so payment data reaches the United States.

No Stripe code runs on our pages. We embed no Stripe script and no payment form of our own. Nothing is transmitted to Stripe while you browse SONKO OS. Only when you deliberately start a purchase are you forwarded to a payment page hosted by Stripe, and only there do you enter your payment details. We never see or store your full card number; our database keeps the plan you bought, the amount, the status, the invoice number and Stripe's own references to the transaction and to you as a Stripe customer.

Stripe does not act merely on our instructions. For the payment itself Stripe is an independent controller, because it has its own obligations under money-laundering and financial-supervision law. Stripe's processing is described in its own privacy policy.

What happens on Stripe's payment page

• Payment methods. We have enabled cards, Apple Pay, Link and Klarna. Which of them Stripe offers you depends on your country, the amount and your device.
• Link. Link is Stripe's own wallet. If you use it, Stripe stores your email address and payment details so that you can pay with one click at other merchants who also use Stripe. That is a relationship between you and Stripe.
• Klarna. If you pay with Klarna, Klarna Bank AB (publ), Sweden, is an independent controller for that payment. For pay-later methods Klarna verifies identity and creditworthiness, which may include enquiries to credit agencies. Klarna informs you about this in its own privacy policy before you confirm.
• Fraud prevention. Stripe Radar checks every payment and every subscription renewal for fraud indicators, using technical data such as IP address and device characteristics. Legal basis is our legitimate interest in preventing payment fraud (Art. 6 (1) (f) GDPR).
• Tax. Stripe Tax determines the applicable VAT from the country and tax details you provide.
• Address entry. Stripe's payment page offers address auto-completion using Google Maps. If you type an address there, the fragments you type are sent to Google for that purpose. This happens on Stripe's page, not on ours.
• Emails from Stripe. Stripe sends you a payment confirmation and, where applicable, a refund notice to the email address used for the purchase. You also receive a separate confirmation from us.

Booking a call

We use Cal.com to let you book a conversation with Tity Sonko. The booking tool is not embedded in our pages; our pages only contain a link. Clicking it takes you to cal.com, where Cal.com, Inc. (United States) processes your name, email address, chosen time slot and any notes you add, under its own privacy policy. Some of our links pre-fill the booking form with the email address and name held in your SONKO OS account, so that you do not have to type them again; in that case these two fields are passed to cal.com as part of the link you follow.

AI-assisted analysis

SONKO OS uses large language models for document analysis, compliance checks, market intelligence and the AI assistant in your workspace: Anthropic PBC (Claude) and Google LLC (Gemini). Only the content needed for the specific request is transmitted. Neither provider uses your content to train its models.

Separately, SONKO uses OpenAI (ChatGPT) as a writing aid for our own publications, such as LinkedIn posts and outreach drafts. Client data and personal data from SONKO OS are not entered there.

Newsletter

Our newsletter The DACH Prestige Signal is published on LinkedIn and hosted by LinkedIn Ireland Unlimited Company. If you subscribe there, LinkedIn processes your data under its own policy. If you give us your address directly, we store it until you unsubscribe.

Mutual NDA

NDAs are prepared and signed inside SONKO OS. No external signature service is involved. We store the company details you enter, the finished document and the signature you draw, together with the time of signing. The record is kept for as long as the agreement can still have legal effect.

Recipients of data

We share personal data only where necessary for the purposes described above.

1. Public authorities (only where required by law)

Tax authorities, supervisory authorities and other public bodies where we are legally obliged to disclose data.

2. Service providers and other recipients

• Hosting and email: united-domains AG, Gautinger Straße 10, 82319 Starnberg, Germany. Web servers, database and mail infrastructure are located in Germany. Processor under Art. 28 GDPR.
• Payments: Stripe Payments Europe, Limited, Dublin, Ireland, and Stripe, LLC, United States; for individual payments also Klarna Bank AB (publ), Sweden. Independent controllers, see Payments above.
• AI analysis: Anthropic PBC and Google LLC, United States. Processors under Art. 28 GDPR.
• Scheduling: Cal.com, Inc., United States, when you follow a booking link.
• Fonts: Google Ireland Limited, Ireland, when a page loads our typefaces.
• Newsletter: LinkedIn Ireland Unlimited Company, Ireland.

3. Professional advisors

Tax advisors, auditors and lawyers acting for SONKO Consulting on the basis of professional confidentiality obligations.

4. Transfers outside the EU/EEA

Stripe, LLC, Anthropic, Google and Cal.com operate from the United States. These transfers are based on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) together with the supplementary measures required by Art. 44 ff. GDPR, and, where the recipient is certified under the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR). We do not transfer personal data to any other third country.

Data security

We apply technical and organisational measures proportionate to the sensitivity of client data:

Encryption

• In transit: all connections to www.sonko-consulting.com and SONKO OS use TLS.
• At rest: passwords are stored as hashes; session tokens and payment references are stored separately from the data they refer to.

Access controls

• Our hosting provider's data centres are secured with physical access controls and video surveillance.
• Access to client data inside SONKO OS is restricted to authorised users; administrative actions are logged with a timestamp and actor.
• Sessions are bound to the browser that created them and are ended on inactivity.

Minimisation and separation

• We process only the data we actually need (Art. 5 (1) (c) GDPR).
• Client workspaces are logically separated so that one client cannot see another client's data.

Backups and continuity

• Database and file storage are backed up regularly; backup media is encrypted.
• Restore procedures are tested.

Privacy by design and by default (Art. 25 GDPR)

• New features in SONKO OS are designed with the least amount of personal data required.
• Privacy-friendly defaults are pre-selected in every workspace; notes and activities are internal by default, not client-visible.

Retention

Client and contract data

• Contract and invoice data: for the duration of the mandate and 10 years afterwards, in line with § 257 HGB and § 147 AO.
• Enquiries without contract: deleted after 6 months if no engagement follows.

SONKO OS

Account data, tool inputs, uploaded documents and the campaign-origin record are stored for as long as your workspace exists. If you ask us to delete your account, we erase your personal data within 30 days, subject only to statutory retention duties for invoices and signed agreements.

Log data

Web-server access logs are kept for up to 6 months and are then deleted or anonymised.

Newsletter

Email addresses are stored until you unsubscribe.

Data held for legal purposes

Data related to actual or anticipated legal disputes may be stored until the matter is closed and applicable limitation periods have expired.

Social plug-ins and external links

We link to LinkedIn but embed no active LinkedIn plug-ins, no share buttons and no social widgets. A connection to LinkedIn is established only when you click a link. Our website also links to other third-party sites; we have no control over their content or privacy practices.

Security note

Confidential handling of client information is our operating philosophy; NDA-first is not marketing. Nevertheless the internet remains an open system. We recommend not sending highly sensitive documents by unencrypted email; the client folders inside SONKO OS or postal delivery are the safer channels.

Your rights in detail

1. Right of access (Art. 15 GDPR).
2. Right to rectification (Art. 16 GDPR).
3. Right to erasure (Art. 17 GDPR).
4. Right to restriction of processing (Art. 18 GDPR).
5. Right to data portability (Art. 20 GDPR).
6. Right to object (Art. 21 GDPR), in particular to the campaign measurement described above.
7. Right to withdraw consent (Art. 7 (3) GDPR).
8. Right to lodge a complaint (Art. 77 GDPR) with the supervisory authority listed above.

To exercise any of these rights, please write to info@sonko-consulting.de or to the postal address at the top of this page.

Changes to this policy

We adjust this Privacy Policy as our services, tooling or legal obligations evolve. The date at the top of the page indicates when the current version came into effect. Material changes are announced on our website and, where required, communicated to registered users of SONKO OS.