Privacy Policy

Last updated: 4 October 2026

1. Controller

The controller responsible for the processing of personal data on this website is:

Sonja-Maria Römpke
Artist name: Sonja Rom
Seehausstraße 31

71299 Wimsheim
Germany

Email: studio@sonjarom.art
Website: sonjarom.art

Personal data means any information relating to an identified or identifiable natural person.

2. Hosting and Website Platform

This website is created and hosted using services provided by:

Wix.com Ltd.
5 Yunitsman Street
Tel Aviv
Israel

When you visit this website, technical information may automatically be processed in order to provide, secure and operate the website. This may include, in particular:

• IP address

• date and time of access

• browser type and version

• operating system

• device information

• referring website

• pages and files accessed

• technical and security information

The processing of this data is necessary for the secure and reliable operation of the website.

The legal basis for the processing of personal data is Article 6(1)(f) GDPR. My legitimate interest is the secure, stable and functional provision of this website.

Wix.com Ltd. is based in Israel. The European Commission has recognised Israel as providing an adequate level of data protection.

Wix and its service providers may also process personal data in other countries. Where personal data is transferred to a country for which no adequacy decision exists, appropriate safeguards, such as the European Commission's Standard Contractual Clauses, may be used.

Further information regarding the processing of personal data by Wix is available in Wix's Privacy Policy.

3. Cookies and Similar Technologies

This website may use cookies and similar technologies.

Technically necessary cookies and technologies may be used where they are required to:

• display and operate the website

• ensure website security

• remember essential settings

• provide functions expressly requested by the visitor

Where the requirements of Section 25(2) TDDDG are met, these technologies may be used without consent.

Non-essential cookies or similar technologies, such as technologies used for analytics or marketing purposes, are only used where the required consent has been obtained.

Where consent is required, the legal basis for accessing or storing information on your device is Section 25(1) TDDDG. Any subsequent processing of personal data is based on Article 6(1)(a) GDPR.

You may withdraw or change your consent at any time using the cookie settings provided on this website. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. 

4. Contact

If you contact me by email or through the contact form provided on this website, I process the information you provide in order to respond to your enquiry.

Depending on the information you provide, this may include:

• your name

• your email address

• the content of your message

• information relating to an artwork or commission you are enquiring about

Where your enquiry relates to the possible purchase of an artwork, a commission or another contractual matter, the processing is based on Article 6(1)(b) GDPR.

For general enquiries, the processing is based on Article 6(1)(f) GDPR. My legitimate interest is to respond to messages addressed to me.

Your enquiry and the associated personal data will be deleted when they are no longer required for the purpose for which they were collected, unless statutory retention obligations apply or continued storage is necessary for the establishment, exercise or defence of legal claims.

5. Social Media Links

This website may contain links to my profiles on social media platforms, in particular Instagram.

If an ordinary link to a social media platform is displayed on this website, no direct connection to the social media provider is established merely by displaying the link.

When you click such a link, you leave this website and access the respective social media platform. The provider of that platform may then process personal data in accordance with its own privacy policy.

I have no control over the extent, purpose or duration of the processing carried out by the respective social media provider.

6. Recipients and Service Providers

Personal data may be disclosed to third parties only where this is necessary for the operation of the website, communication with you, compliance with legal obligations or the protection of legitimate interests.

Possible recipients may include:

• website and hosting providers

• email and communication service providers

• IT and security service providers

• professional advisers where legally necessary

• public authorities where disclosure is legally required

Where a service provider processes personal data on my behalf, the processing is carried out in accordance with the applicable requirements of data protection law.

7. International Data Transfers

Some service providers used in connection with this website may process personal data outside the European Union or European Economic Area.

Where the European Commission has issued an adequacy decision for the relevant country, transfers may take place on the basis of that decision.

Where no adequacy decision exists, personal data is transferred only where an appropriate legal safeguard is available, such as the European Commission's Standard Contractual Clauses, or where another legal basis for the transfer applies.

Depending on the country concerned, the level of data protection and access rights of public authorities may differ from those within the European Union.

Wix states that transfers to countries without an adequate level of protection are subject to appropriate safeguards, including Standard Contractual Clauses where applicable. wix.com

8. Storage Period

Personal data is stored only for as long as necessary for the purpose for which it was collected.

Personal data may be stored for a longer period where:

• statutory retention obligations apply

• the data is necessary in connection with a contractual relationship

• consent remains valid

• the data is required for the establishment, exercise or defence of legal claims

• another legal basis permits or requires continued storage

Once the relevant purpose and any applicable retention period have ended, the personal data will be deleted or anonymised.

9. Your Rights

Subject to the requirements of applicable data protection law, you have the right to:

• request access to your personal data

• request correction of inaccurate or incomplete personal data

• request deletion of your personal data

• request restriction of processing

• receive certain personal data in a portable format

• object to processing based on legitimate interests

• withdraw consent at any time with effect for the future

• lodge a complaint with a competent data protection supervisory authority

Where processing is based on Article 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact:

Email: studio@sonjarom.art

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

In particular, you may contact a supervisory authority in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement.

11. Security

Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

This website uses encrypted transmission through TLS/SSL technology where supported.

However, no transmission of information over the internet can be guaranteed to be completely secure.

12. Automated Decision-Making

I do not use personal data collected through this website for automated decision-making, including profiling, that produces legal effects or similarly significantly affects visitors.

13. Changes to This Privacy Policy

This Privacy Policy may be updated where the website, the services used on the website or applicable legal requirements change.

The current version is published on this website together with the date of the latest update.