Ponora Cookie Policy

As of: 2 October 2026

1. Controller

The controller for the website and the storage technologies used on it is:

Ponora International GmbH
Willstätterstraße 6
40549 Düsseldorf
Germany
Email: support@ponora.ai
Website: https://ponora.ai

2. What are cookies and similar technologies?

Cookies are small text files that can be stored on your device. Comparable technologies include local storage, session storage and similar browser-side storage mechanisms. These technologies may be necessary to make a website technically available, store settings or—where used and legally permissible—enable analytics or marketing functions.

In this Policy, the term “cookies” is also used collectively in some places to refer to comparable storage and access technologies.

First-party cookies are set by the Ponora domain you visit, while third-party cookies are set by domains of other companies (e.g. doubleclick.net). In addition to cookies, tracking pixels or comparable scripts may be used; the same consent requirements apply to them as to non-essential cookies.

3. Legal bases

Section 25 TDDDG applies in particular to storing information on your terminal device or accessing information already stored there.

• Technically strictly necessary storage technologies may be used without consent where they are necessary to provide a digital service expressly requested by you.
• Non-essential storage or access technologies are used only with valid consent, where such consent is required by law.

Where personal data is processed in this context, the further processing is also governed by the General Data Protection Regulation (GDPR). Details can be found in our Privacy Policy.

4. Currently used storage technologies

4.1 Consent and preference storage

The Ponora website stores your selection in the consent banner in your browser's local storage (entry “ponora-cookie-consent-v3”). The categories “necessary”, “analytics” and “marketing”, together with a timestamp, are stored. This storage serves to recognise your selection in the same browser; under section 25(2) no. 2 TDDDG it does not require consent.

The preference remains in the browser's local storage until you change it, withdraw it via the “Cookie settings” link in the page footer, or delete the browser data. The storage period is limited to one year.

4.2 Technically necessary functions

Insofar as technically necessary cookies or comparable storage are required for registration, security, session management, shopping cart, language settings or other expressly requested functions, these may be used to the required extent. Such technologies are not used for advertising profile building.

Specifically used are: session tokens and renewal tokens as server-only cookies (not readable by scripts); a “locale” cookie for language selection with a term of one year, set for the Ponora domains (including subdomains); and the local-storage entry containing the consent selection mentioned above. A session storage entry (“ponora:google-ads:pending:<order-ID>”) is written only after you consent to “Marketing”, for conversion measurement. The key contains the order number; the entry is deleted after the conversion is sent or the session ends. Display names and email addresses are not stored in cookies readable by JavaScript. The account data required to display the logged-in user are retrieved after authentication via a protected interface.

The consent banner is displayed on the information and shop pages. The logged-in web application (app.ponora.ai) loads Apple and Google scripts for login; these are required for the login function expressly requested by you and therefore do not require consent under section 25(2) no. 2 TDDDG.

5. Analytics and Marketing Technologies

5.1 Google Ads (conversion tracking and remarketing)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: measuring whether a purchase in the Ponora shop originates from a Google ad, and showing interest-based ads.

Processed data: online identifiers (cookie IDs), IP address, browser and device information, pages viewed, ad click identifier; for a purchase additionally the order number, order value and currency. No name, email address, postal address or payment data is transmitted to Google.

Responsibility: Google processes the data as an independent controller under the Google Ads Controller-Controller Data Protection Terms (https://business.safety.google/adscontrollerterms/). Information about processing by Google: https://policies.google.com/privacy.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent, category 'Marketing').

Activation: the Google Ads destination is activated only after you select “Marketing”. The shared Google tag may already load for Google Analytics 4 when you consent to “Analytics”; Section 5.2 explains the restrictions on advertising purposes.

Storage technologies (selection; the authoritative list is https://business.safety.google/adscookies/):

– First-party (Ponora domains): “_gcl_au” (90 days), “_gcl_aw” (90 days), “_gcl_gs” (90 days), “_gcl_ag” (90 days), “_gcl_gb” (90 days)

– Third-party doubleclick.net: “IDE” (13 months (EEA/United Kingdom), otherwise 24 months), “RUL” (12 months), “ar_debug” (90 days), “test_cookie” (15 minutes)

– Third-party googleadservices.com / google.com: “AID” (13 months), “TAID” (14 days), “NID” (6 months)

5.2 Analytics

Google Analytics 4 (GA4) is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use GA4 to analyse website use, traffic sources and page performance. The GA4 destination is activated only with consent to “Analytics”. The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR.

The data processed include online identifiers and cookie IDs, IP address, browser and device information, pages viewed and source channels. According to Google, IP addresses from the EU, Switzerland and the United Kingdom are used solely to derive approximate location and are then discarded, not logged or stored. Outside those territories, IP addresses may also be used for basic functions such as spam detection; raw IP addresses are discarded afterwards. For properties linked to Google Ads, encrypted IP addresses may be used there for advertising services depending on the settings.

For analytics, Google generally acts as a processor under Article 28 GDPR and the Google Ads Data Processing Terms. Our GA4 property is linked to Google Ads, so collected data may also serve advertising purposes. Google may act as an independent controller for the relevant processing. Without “Marketing” consent, we technically restrict advertising purposes: allow_google_signals and allow_ad_personalization_signals are false, while ad_storage, ad_user_data and ad_personalization are denied. This does not guarantee complete separation of all processing within Google.

The account setting for sharing data with “Google products & services” has not yet been verified; no particular default is represented as a confirmed account setting. If this sharing is enabled, Google may process data shared under that setting for its own purposes as an independent controller.

GA4 uses the first-party cookies _ga to distinguish users and _ga_T8C20G0ZD3 to retain session state on Ponora domains. Each has a default lifetime of 2 years, which may renew on subsequent visits; browsers may shorten it. These analytics cookies are not technically necessary. Where advertising features are permitted, the advertising technologies described in Section 5.1 of the Cookie Policy may also apply.

Server-side retention of user and event data is separate: this notice provisionally assumes the GA4 default of 2 months; the actual property setting must be confirmed before publication. Deletion takes place in the monthly deletion cycle. Depending on the setting, new activity may reset retention for user identifiers; standard aggregated reports are not subject to this period.

Enhanced measurement is provisionally assumed to be enabled by default; the options actually enabled remain to be confirmed. After Analytics consent, it may automatically collect page views, scrolls and outbound link clicks in particular.

Further information: Google cookies https://support.google.com/analytics/answer/11397207 ; Privacy Policy https://policies.google.com/privacy ; processing terms https://business.safety.google/adsprocessorterms/.

5.3 Transfers to third countries

Google Ads and GA4 may involve transfers of personal data to Google LLC in the USA. Where a transfer is covered by the EU-US Data Privacy Framework and the US recipient’s certification, the corresponding adequacy decision applies; where required, the relevant standard contractual clauses (SCCs) and supplementary safeguards apply. The US certification concerns Google LLC, not Google Ireland Limited.

5.4 Meta Pixel (Facebook and Instagram)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

Purpose: measuring whether visits to and purchases on the Ponora website originate from ads on Facebook or Instagram, optimising ad delivery, and showing interest-based ads, including building audiences.

Processed data: online identifiers (cookie IDs), IP address, browser and device information, the URL viewed and referring page, time, page views (event “PageView”, including page changes within the website) and, where applicable, the Meta click identifier (fbclid). Meta’s automatic events may also capture button clicks and structured page data (e.g. product name and price). Ponora does not transmit names, email addresses, postal addresses or payment data to Meta; automatic advanced matching of form entries is not enabled for this pixel. If you are logged in to Facebook or Instagram, Meta may associate the data with your account.

Responsibility: Ponora and Meta are joint controllers under Art. 26 GDPR for collecting data with the Meta Pixel and transmitting it to Meta (agreement: https://www.facebook.com/legal/controller_addendum). Under that agreement, Meta is responsible for fulfilling data subject rights under Art. 15 to 20 GDPR regarding data stored by Meta after transmission; you may also exercise your rights against Ponora. Subsequent processing is carried out by Meta as an independent controller. Information about processing by Meta: https://www.facebook.com/privacy/policy/.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent, category “Marketing”).

Activation: the Meta Pixel is loaded only on ponora.ai and ponora.de and only after you select “Marketing”; without this consent, no connection to Meta is established.

Storage technologies (selection):

– First-party (Ponora domains): “_fbp” (90 days), “_fbc” (90 days, only when arriving via a Meta ad); local-storage entries “lastExternalReferrer” and “lastExternalReferrerTime” (until deleted in the browser)

– Third-party facebook.com: “fr” (90 days)

Transfers to third countries: data may be transferred to Meta Platforms, Inc. in the USA. Where a transfer is covered by the EU-US Data Privacy Framework and the certification of Meta Platforms, Inc., the corresponding adequacy decision applies; otherwise Meta bases transfers on standard contractual clauses (SCCs).

5.5 TikTok Pixel

Provider: TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, D02 HD23, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom (together “TikTok”).

Purpose: measuring whether visits to and purchases on the Ponora website originate from ads on TikTok, optimising ad delivery, and showing interest-based ads, including building audiences.

Processed data: online identifiers (cookie IDs), IP address, browser and device information, the URL viewed and referring page, time, page views (including page changes within the website), interactions such as clicks and time on page, structured page data and, where applicable, the TikTok click identifier (ttclid). Ponora does not transmit names, email addresses, postal addresses or payment data to TikTok. In the pixel’s current configuration, TikTok’s automatic advanced matching is enabled: TikTok may capture contact data such as an email address or phone number that you enter in form fields on the website, hash it in the browser and transmit it.

Responsibility: Ponora and TikTok are joint controllers under Art. 26 GDPR for collecting data and transmitting it to TikTok and for measurement and insight reports (agreement in the Jurisdiction Specific Terms: https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms). TikTok processes the data as an independent controller for building audiences, targeting and optimising ads, and for security purposes. Information about processing by TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent, category “Marketing”).

Activation: the TikTok Pixel is loaded only on ponora.ai and ponora.de and only after you select “Marketing”; without this consent, no connection to TikTok is established. Under its business terms, TikTok retains event data for no more than 18 months.

Storage technologies (selection):

– First-party (Ponora domains): “_ttp”, “_tt_enable_cookie”, “ttcsid” and “ttcsid_DAUI8T3C77UAAGDAMSO0” (13 months each); when arriving via a TikTok ad, additionally the click identifier “ttclid”

– Third-party tiktok.com: “_ttp” (13 months)

Transfers to third countries: according to TikTok, data is stored on servers in the USA, Malaysia and Singapore, and group companies in other countries are granted limited remote access, including in countries without an adequacy decision such as China. For those countries, TikTok bases the transfers on standard contractual clauses (SCCs). These countries do not offer a level of data protection equivalent to the EU; in particular, public authorities may access data without effective legal remedies being available to you.

6. Consent Management and Withdrawal

You may withdraw your consent at any time with effect for the future. Withdrawal must, in principle, be as easy as giving consent.

You can reopen, change or withdraw your cookie selection at any time via the “Cookie settings” link in the footer of every page. You can also delete locally stored preferences using your browser functions; the banner will then appear again.

Withdrawing “Marketing” consent sets ad_storage, ad_user_data and ad_personalization to denied and signals the withdrawal to the Meta Pixel and the TikTok Pixel; withdrawing “Analytics” consent sets analytics_storage to denied. The page reloads to unload previously loaded tags and pixels; only a destination still permitted is then activated, and the Meta Pixel and the TikTok Pixel are no longer loaded. You can delete existing cookies in your browser settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

7. Browser Settings

You can delete cookies and local storage data stored in your browser or restrict their storage. Please note that technically necessary storage may be required for individual functions. If you completely block such storage, certain website features may be restricted.

8. Third-Party Providers

Third-party scripts are already loaded for expressly requested functions: Stripe (payment processing, js.stripe.com), PayPal (shop payment processing, www.paypal.com), Apple (Sign in with Apple, appleid.cdn-apple.com) and Google (Sign in with Google, accounts.google.com). These scripts are loaded in the payment and login areas, not on ordinary information pages, and are required for the respective requested function; the providers may use their own storage technologies in this context. If further third-party providers requiring consent are used in the future, their name, purpose, legal basis, storage period and, where applicable, transfers to third countries will be described transparently before activation; they will not be activated before the required consent is granted.

Only with your respective consent: Google Ireland Limited for Google Ads (Section 5.1) and Google Analytics 4 (Section 5.2), through the shared Google tag (www.googletagmanager.com); Meta Platforms Ireland Limited for the Meta Pixel (Section 5.4; connect.facebook.net, www.facebook.com) and TikTok Technology Limited and TikTok Information Technologies UK Limited for the TikTok Pixel (Section 5.5; analytics.tiktok.com), both only with consent to “Marketing”.

9. Relationship to the privacy policy

This cookie policy explains the use of storage and access technologies on end devices. Further information on the processing of personal data, in particular on data categories, recipients, storage period, international data transfers and your rights as a data subject, can be found in the Ponora privacy policy.

10. Changes to this cookie policy

Ponora may adjust this cookie policy if the technologies used, the website functions or the legal requirements change. The current version will be published on the Ponora website.

As of: 2 October 2026