Privacy Policy

Thank you for your interest in our company. Protecting your personal data is very important to us. Below, we provide you with an overview of how we process your personal data and outline your rights under German data protection law. Which data is processed in detail depends largely on your specific usage behavior on our website and other circumstances specific to your individual case. Therefore, not all parts of this information may apply to you.

1. Responsible party and contact details of the data protection officer

The responsible party responsible for data processing through this website is

SOMI Academy GmbH
Holzhofstr. 7
55116 Mainz

You can contact our data protection officer at

SOMI Software GmbH
Kennedyallee 93
60596 Frankfurt a. M.

as well as by email at datenschutz@somi.de and by telephone at +49 69 / 47 89 18 90-0.

2. Processing of data in connection with the use of our website

2.1. Data categories, purpose of processing and legal basis

When you use our websites, applications, or online tools (hereinafter collectively referred to as "online offering"), we process the following personal data:

  • Personal data that you voluntarily provide in connection with an online offering (e.g., when registering or making contact requests), such as your first and last name, email address, telephone number, and
  • Information that is automatically sent to us by your web browser or end device, such as your IP address, device type, browser type, previously visited websites, subpages visited, or the date and time of the respective visitor request.
  • Technical administration of the website (prevention and detection of fraudulent or similar actions, including attacks on our IT infrastructure, enabling user authentication) The legal basis for the processing of personal data for these purposes is Art. 6 para. 1 lit. f DS-GVO (GDPR Art. 6 (1) (f)), regardless of whether a contractual relationship exists with you.
  • Online and other services (enabling the use of the services and functions of our online offerings, processing of inquiries, sending marketing information upon request)

The legal basis for the processing of personal data for the above-mentioned purpose is Art. 6 (1) lit. b and lit. f GDPR. Visiting our online offering establishes a contractual relationship within the meaning of Art. 6 (1) lit. b GDPR. Without the processing of personal data, we cannot offer our online offering as intended. In particular, the transmission of personal data such as the IP address is necessary for establishing a connection.

In some cases, we expressly ask for your consent to the processing of your personal data. In this case, the legal basis for the processing is the consent you have given in accordance with Art. 6 para. 1 lit. a GDPR in conjunction with Art. 7 GDPR.

2.2 Cloudflare Turnstile

Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, is an automated detection service that helps us verify whether a request was sent by a human or a bot. This detection is necessary to prevent spam messages.

We use Turnstile to ensure the secure use of the contact form. The legal basis for this type of data processing is our legitimate interest in the secure operation of the contact form, Art. 6 para. 1 lit. f) GDPR.

Cloudflare processes your IP address to the Cloudflare servers for verification purposes. Cloudflare processes the data on our behalf on the basis of a data processing agreement between us and Cloudflare. This ensures that the data processing on our behalf is carried out in accordance with the General Data Protection Regulation, guaranteeing the protection of the rights of the data subjects. The IP address may be transferred to Cloudflare's US servers. In this case, the standard contractual clauses agreed between us and Cloudflare to protect your rights also apply.

You have the right to object to this data processing at any time, in which case you may no longer be able to use the website.

Further information on data protection from the third-party provider can be found on Cloudflare's privacy policy

2.3 Matomo

We use Matomo for web analytics. All data is pseudonymized, and no cookies are used for tracking. The Matomo server is located in Frankfurt am Main and is operated by our service provider, SOMI Services GmbH, Holzhofstraße 7, 55116 Mainz, Germany. Since all data is pseudonymized before storage and processing, it is not possible to link it to specific website visitors. The legal basis for this processing is our legitimate interest in the statistical analysis and optimization of our website in accordance with Article 6(1)(f) of the GDPR.

2.4 Cookiebot (Consent Management)

We use the consent management tool Cookiebot, provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, to obtain, manage, and document your consent to data processing and the use of technologies requiring consent (such as Google services). This processing is carried out to fulfill our legal obligations (duty of proof and documentation). The legal basis for this is Article 6(1)(c) of the GDPR. Further information on data protection at Cookiebot can be found in the Cookiebot Privacy Policy.

2.5 Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself does not create independent user profiles or set cookies; rather, it serves solely to centrally manage analytics and marketing tags.

We have configured Tag Manager in conjunction with Cookiebot so that tags requiring consent (such as Google Analytics or Google Ads) are loaded only after you have given us your explicit consent. Your IP address is processed briefly for the technically necessary connection to the Google server. The legal basis for the use of the Tag Manager is our legitimate interest in the secure and efficient management of our website services (Art. 6(1)(f) GDPR). Further information on data processing by Google can be found in the Google Privacy Policy.

2.6 Google Analytics 4

Provided you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited. This service collects information about your use of our website (e.g., pages visited, time spent on the site, interactions, device information). By default, users’ IP addresses are anonymized or truncated by Google before being stored.

Processing is based exclusively on your prior consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You may revoke this consent at any time via our privacy settings with future effect. Data transfers to the U.S. are safeguarded by the EU Commission’s Adequacy Decision (Data Privacy Framework). Further information on data processing by Google can be found in the Google Privacy Policy.

2.7 Google Ads Conversion Tracking and Remarketing

If you have given your consent, we use Google Ads from Google Ireland Limited to measure the success of our advertising campaigns (conversion tracking) and to display targeted ads to visitors on other websites (remarketing). In doing so, information about your interactions with our website is transmitted to Google and may be linked to your Google account.

The use of these services, as well as the storage or retrieval of information on your device, is based exclusively on your consent, which you may revoke at any time (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Further information on data processing by Google can be found in the Google Privacy Policy.

2.8 Payment Service Providers and Payment Processing

For the secure and efficient processing of payments for purchases made through our online shop, we use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, The Netherlands.

a) Processing via Mollie B.V.

If you select an offered payment method during the ordering process, the data required for processing the payment (such as name, address, bank or credit card details, invoice amount, currency, IP address, and transaction data) will be transmitted automatically to Mollie.

Purpose of processing: Processing of payments, fraud prevention, and payment verification.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract or implementation of pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in secure, reliable, and cost-effective payment processing).

Further details regarding privacy at Mollie can be found here.

b) Integrated Payment Providers

Depending on the selected payment method, Mollie forwards the transaction data to the respective payment providers:

  • PayPal: If payment via PayPal is selected, your payment data will be forwarded to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. For certain payment methods, PayPal reserves the right to carry out a credit assessment. For further information, please refer to PayPal's privacy policy here.

  • Klarna: If payment via Klarna is selected, your data will be transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. In order to offer you Klarna's payment options, we will transfer personal data (contact details and order details) to Klarna so that Klarna can assess whether you qualify for their payment options and tailor those payment options. Processing takes place in accordance with Klarna's privacy policy here.

  • Credit Card Payment: When paying by credit card, your data will be transmitted in encrypted form to the participating credit card institutions and acquirers to process the transaction and fulfill security standards (e.g., 3D-Secure / Strong Customer Authentication).

3. Newsletter

We use the service provider Brevo to send newsletters and transactional emails. Depending on the contractual arrangement, the provider is either Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, or an affiliated company of the Brevo Group. In connection with the sending of these communications, the following data may be processed in particular: email address, name, company, communication content, technical delivery information, as well as sending, delivery, and opening dates, to the extent necessary for sending, verification, security, error analysis, and optimization of delivery.

The data collected during the newsletter registration process—in particular the email address, first name, last name, company name, and information regarding registration and confirmation via the double opt-in process, are transmitted to Brevo and processed there on our behalf. Processing is carried out exclusively for the purpose of managing and sending our newsletter, documenting your consent, and—where applicable—statistical analysis of our newsletter communications.

The newsletter contains information about offers, services, events, and news from the SOMI Group. You may revoke your consent at any time with future effect, e.g., via the unsubscribe link in each newsletter. Further information can be found in the Privacy Policy.

The legal basis for sending the newsletter and processing the data required for this purpose is your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, for example by clicking the “Unsubscribe” link in each newsletter or by sending us a message. The lawfulness of the processing carried out prior to withdrawal remains unaffected.

We have entered into a data processing agreement with Brevo in accordance with Article 28 of the GDPR. Brevo processes personal data in accordance with our instructions. Brevo may engage subprocessors to provide its services. This may also involve transfers to countries outside the European Economic Area. In such cases, Brevo states that it ensures an adequate level of data protection, in particular through appropriate safeguards in accordance with Chapter V of the GDPR.

Further information on data processing by Brevo can be found in Brevo's Privacy Policy.

4. Contact

We include links on our website to several social media platforms to draw attention to our services and products and to connect with you as a visitor and user of these online offerings.

These are standard hyperlinks, not so-called social plug-ins. This means no direct connection is established to the servers of the respective networks and no data is transmitted simply by visiting our website. You can identify the specific links by the logo of the respective social network. Clicking on the logo will redirect you to the service provider’s website. Please note that when you access these external platforms, the terms of service and data processing policies of their respective operators apply.

The legal basis for linking to and maintaining our social media profiles is our legitimate interest in active corporate communication in accordance with Article 6(1)(f) of the GDPR.

5. Social media

We include links on our website to several social media platforms to draw attention to our services and products and to connect with you as a visitor and user of these online offerings.

These are standard hyperlinks, not so-called social plug-ins. This means no direct connection is established to the servers of the respective networks and no data is transmitted simply by visiting our website. You can identify the specific links by the logo of the respective social network. Clicking on the logo will redirect you to the service provider’s website. Please note that when you access these external platforms, the terms of service and data processing policies of their respective operators apply.

The legal basis for linking to and maintaining our social media profiles is our legitimate interest in active corporate communication in accordance with Article 6(1)(f) of the GDPR.

5.1. LinkedIn

Our website includes a link to our company profile on LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. For more information on data processing by LinkedIn, please see LinkedIn’s privacy policy here.

5.2. XING

We include a link to our company profile on the XING platform, operated by New Work SE, Baumwall 7, 20459 Hamburg, Germany. For more information on data processing by XING, please see XING’s privacy policy here.

5.3. YouTube

Our website includes a link to our channel on the YouTube video platform, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information on data processing by Google can be found in the Google Privacy Policy.

6. Recipients and categories of recipients

Within our company, those departments that need your data to fulfill their contractual and legal obligations will have access to it. Service providers and vicarious agents employed by us may also receive data for these purposes, provided that they maintain confidentiality and integrity. These are companies in the categories of IT services, telecommunications, and sales and marketing.

With regard to the transfer of data to recipients outside our company, it should first be noted that we only transfer necessary personal data in compliance with the applicable data protection regulations. We may only disclose information about you if this is required by law, if you have given your consent, or if we are authorized to provide such information. Under these conditions, recipients of personal data may include:

  • Public authorities and institutions (such as law enforcement authorities) if there is a legal or official obligation to do so,
  • Other companies affiliated with our group, and
  • Service providers that we use within the scope of order processing relationships.

7. Transfer to third countries

As part of the data processing activities described in this Privacy Policy (for example, through the use of Google services or certain payment functions), personal data may be transferred to recipients outside the European Union (EU) or the European Economic Area (EEA). Such transfers are made exclusively in compliance with the strict legal requirements of Articles 44 et seq. of the GDPR.

Adequacy Decision: For certain countries (e.g., for certified companies in the U.S. under the EU-U.S. Data Privacy Framework), the European Commission has officially determined that an adequate level of data protection exists. We can legally rely on this decision to support data transfers.

Standard Contractual Clauses & Safeguards: Where no adequacy decision applies, we ensure that the service providers we use employ appropriate safeguards (such as the Standard Contractual Clauses approved by the European Commission or Binding Corporate Rules in accordance with Article 47 of the GDPR) to protect your data. Further information on the specific safeguards can be found in the respective sections for each service provider listed in this Privacy Policy.

8. Storage period

We process and store your personal data for as long as it is necessary to fulfill our contractual obligations and exercise our rights.

The revocation of previously given consent will be retained for three years due to our accountability obligation. The administrative cookie is deleted 6 months after your last visit. Server log data is anonymized before storage. Data relating to newsletters and invitations is deleted immediately after unsubscribing.

In individual cases, longer storage of data may be justified for reasons of evidence in justified individual cases. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being 3 years.

9. Data security

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, SSL or TLS encryption is implemented on our website. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.

Our employees and the service providers we commission are also obliged to maintain confidentiality and comply with the provisions of the applicable data protection laws. The company takes appropriate technical and organizational security measures to protect your personal data from loss, alteration, destruction, and access by unauthorized persons or unauthorized disclosure. Our security measures are continuously improved in line with technological developments.

10. Data Subject Rights

As a data subject, you have the right to access your data (Article 15 GDPR), to rectify inaccuracies (Article 16 GDPR), to request erasure (Article 17 GDPR), the right to restriction of processing under Art. 18 GDPR, and the right to data portability under Art. 20 GDPR.

The restrictions under Sections 34 and 35 of the German Federal Data Protection Act (BDSG) apply to the right to information and the right to erasure. In addition, there is a right to lodge a complaint with a competent data protection supervisory authority (Article 77 of the GDPR in conjunction with Section 19 of the BDSG).

You may withdraw your consent to the processing of your personal data at any time with future effect. This also applies to the revocation of declarations of consent that were given to us before the GDPR came into force, i.e. before May 25, 2018. Please note that the revocation only takes effect for the future.

You also have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, in particular on the basis of Art. 6 (1) lit. f GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms. This includes, in particular, processing necessary for the assertion, exercise, or defense of legal claims.

You also have the right not to be subject to decisions based solely on automated processing as set out in Article 22 GDPR. We do not use fully automated decision-making for the establishment, execution, and termination of the business relationship. Should we use these procedures in individual cases (e.g., to improve our products and services), we will inform you separately about this and your rights in this regard, provided that this is required by law.

11. Obligation to provide data

Within the scope of our online offering, we rely on the processing of usage data that is necessary for the performance and termination of the service and for the fulfillment of the associated obligations. Without the collection of usage data, we and our service providers are unable to provide you with our online offering.

12. Profiling

We do not process your personal data in an automated manner in such a way that it has legal effects on you or significantly affects you in a similar manner.

13. Validity and changes to this privacy policy

This privacy policy is currently valid and was last updated in August 2026.