Effective Date: August 20, 2026
This Privacy Policy describes how Sonamont ("we," "us," or "our") handles personal data when you visit this website.
1. Data Controller
The party responsible for the processing of your personal data is:
Sonamont
Belgium
Email: 
2. Hosting and Server Logs
When you visit this website, our hosting provider automatically processes technical access data — such as your IP address, date and time of the request, the requested URL, the referring page and your browser type — in server log files. This processing is necessary to deliver the website, to ensure its stability and security, and to detect abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating a secure website). Log files are retained only for as long as the hosting provider requires for these purposes and are then deleted or anonymised.
3. Reach Measurement (Self-Hosted, Cookieless)
We count page views with a self-hosted first-party system. Per calendar day it stores only aggregate totals: the number of page views, the requested paths, the referring host (the domain only, never the full referrer URL), any campaign parameters (utm_*), plus counters for clicked links and for reaching 50% / 90% scroll depth. It sets no cookies, creates no user or device identifier, does not use local storage or any other storage on your device, does not store IP addresses, and does not share any data with third parties. The browser "Do Not Track" setting is respected and suppresses the measurement entirely.
Because this measurement neither stores information on your device nor reads information already stored there, it does not trigger the consent requirement of Art. 10/2 of the Belgian Act of 30 July 2018 (the provision that implements Art. 5(3) of the ePrivacy Directive and that replaced Art. 129 of the Electronic Communications Act). We therefore do not ask for consent for it. The remaining server-side processing is based on Art. 6(1)(f) GDPR — our legitimate interest in aggregate usage statistics — and creates no personal profile.
4. Contact Form and Email Contact
If you contact us through the contact form or by email, we process the information you provide (name, email address, your message) solely to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
To prevent abuse, the form uses a hidden decoy field, a minimum time before submission and a rate limit of one message per IP address per minute; for the rate limit a one-way hash of your IP address is stored on the server. The IP address from which the message was sent is included in the notification email we receive, so that we can respond to spam or misuse. We keep correspondence only as long as needed to handle your request and any statutory retention periods, and we do not use contact requests for unrelated marketing.
5. Newsletter (Double Opt-In)
If you subscribe to our newsletter, we process your email address to send you the newsletter. Subscription uses a double-opt-in procedure: your address is first stored as a pending entry together with a random confirmation token, your chosen language and the time of the request, and you receive an email with a confirmation link. Only after you follow that link is your address moved to the subscriber list, where we store it together with the token, the language and the time of confirmation as proof of your consent. Pending entries that are not confirmed are deleted after 48 hours, so an address that never confirms is never added.
To prevent abuse we limit signups to one attempt per IP address per minute (a one-way hash of the IP address is stored on the server), and the signup, confirmation and unsubscribe steps are written to a technical log on the server that contains the email address and, for the signup step, the IP address. This log serves only to diagnose delivery problems and abuse and is kept short-term in the temporary directory of the server. The legal basis for sending the newsletter is your consent, Art. 6(1)(a) GDPR; the abuse prevention and the technical log are based on Art. 6(1)(f) GDPR. You can unsubscribe at any time using the link in every newsletter or by contacting us; your address is then removed from the list.
6. External Links and Embedded Content
This website may contain links to external websites and, where indicated, embedded third-party content that only loads after you actively click it (two-click solution). Once you follow a link or activate embedded content, the third party processes personal data under its own privacy policy.
7. Legal Bases (Overview)
- Art. 6(1)(a) GDPR — consent, where we ask for it (newsletter)
- Art. 6(1)(b) GDPR — contract performance and pre-contractual steps
- Art. 6(1)(c) GDPR — legal obligations
- Art. 6(1)(f) GDPR — legitimate interests (secure operation of the website, aggregate reach measurement, answering enquiries)
8. Data Retention
We retain personal data only for as long as necessary for the relevant purpose and to comply with legal obligations, and delete it afterwards. In concrete terms: server log files for as long as our hosting provider needs them for secure operation; unconfirmed newsletter entries for 48 hours; confirmed newsletter addresses until you unsubscribe; contact correspondence for as long as handling your request and any statutory retention period require; the aggregate reach figures, which contain no personal data, for up to 400 days.
9. Your Rights as a Data Subject
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure ("right to be forgotten") (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
- Right to lodge a complaint with a supervisory authority — the competent authority for us is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium, contact@apd-gba.be, www.dataprotectionauthority.be. You may also complain to the supervisory authority of your habitual residence or place of work (Art. 77 GDPR).
To exercise your rights, please contact us at the email address provided above.
10. Data Deletion Requests
You can request the deletion of your personal data at any time. Please see the Data Deletion Request page listed with the legal documents on this site, or contact us directly at .
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The latest version is published on this page with the current effective date.