Ponora Cookie Policy

As of: 18 September 2026

1. Controller

The controller for the website and the storage technologies used on it is:

Ponora International GmbH
Hammfelddamm 4 A
41460 Neuss
Germany
Email: support@ponora.ai
Website: https://ponora.ai

2. What are cookies and similar technologies?

Cookies are small text files that can be stored on your device. Comparable technologies include local storage, session storage and similar browser-side storage mechanisms. These technologies may be necessary to make a website technically available, store settings or—where used and legally permissible—enable analytics or marketing functions.

In this Policy, the term “cookies” is also used collectively in some places to refer to comparable storage and access technologies.

First-party cookies are set by the Ponora domain you visit, while third-party cookies are set by domains of other companies (e.g. doubleclick.net). In addition to cookies, tracking pixels or comparable scripts may be used; the same consent requirements apply to them as to non-essential cookies.

3. Legal bases

Section 25 TDDDG applies in particular to storing information on your terminal device or accessing information already stored there.

• Technically strictly necessary storage technologies may be used without consent where they are necessary to provide a digital service expressly requested by you.
• Non-essential storage or access technologies are used only with valid consent, where such consent is required by law.

Where personal data is processed in this context, the further processing is also governed by the General Data Protection Regulation (GDPR). Details can be found in our Privacy Policy.

4. Currently used storage technologies

4.1 Consent and preference storage

The Ponora website stores your selection in the consent banner in your browser's local storage (entry “ponora-cookie-consent-v2”). The categories “necessary”, “analytics” and “marketing”, together with a timestamp, are stored. This storage serves to recognise your selection in the same browser; under section 25(2) no. 2 TDDDG it does not require consent.

The preference remains in the browser's local storage until you change it, withdraw it via the “Cookie settings” link in the page footer, or delete the browser data. The storage period is limited to one year.

4.2 Technically necessary functions

Insofar as technically necessary cookies or comparable storage are required for registration, security, session management, shopping cart, language settings or other expressly requested functions, these may be used to the required extent. Such technologies are not used for advertising profile building.

Specifically used are: session tokens and renewal tokens as server-only cookies (not readable by scripts); a “locale” cookie for language selection with a term of one year, set for the Ponora domains (including subdomains); and the local-storage entry containing the consent selection mentioned above. A session storage entry (“ponora:google-ads:pending:<order-ID>”) is written only after you consent to “Marketing”, for conversion measurement. The key contains the order number; the entry is deleted after the conversion is sent or the session ends. Display names and email addresses are not stored in cookies readable by JavaScript. The account data required to display the logged-in user are retrieved after authentication via a protected interface.

The consent banner is displayed on the information and shop pages. The logged-in web application (app.ponora.ai) loads Apple and Google scripts for login; these are required for the login function expressly requested by you and therefore do not require consent under section 25(2) no. 2 TDDDG.

5. Analytics and Marketing Technologies

5.1 Google Ads (conversion tracking and remarketing)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: measuring whether a purchase in the Ponora shop originates from a Google ad, and showing interest-based ads.

Processed data: online identifiers (cookie IDs), IP address, browser and device information, pages viewed, ad click identifier; for a purchase additionally the order number, order value and currency. No name, email address, postal address or payment data is transmitted to Google.

Responsibility: Google processes the data as an independent controller under the Google Ads Controller-Controller Data Protection Terms (https://business.safety.google/adscontrollerterms/). Information about processing by Google: https://policies.google.com/privacy.

Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent, category 'Marketing').

Activation: the Google Ads destination is activated only after you select “Marketing”. The shared Google tag may already load for Google Analytics 4 when you consent to “Analytics”; Section 5.2 explains the restrictions on advertising purposes.

Storage technologies (selection; the authoritative list is https://business.safety.google/adscookies/):

– First-party (Ponora domains): “_gcl_au” (90 days), “_gcl_aw” (90 days), “_gcl_gs” (90 days), “_gcl_ag” (90 days), “_gcl_gb” (90 days)

– Third-party doubleclick.net: “IDE” (13 months (EEA/United Kingdom), otherwise 24 months), “RUL” (12 months), “ar_debug” (90 days), “test_cookie” (15 minutes)

– Third-party googleadservices.com / google.com: “AID” (13 months), “TAID” (14 days), “NID” (6 months)

5.2 Analytics

Google Analytics 4 (GA4) is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use GA4 to analyse website use, traffic sources and page performance. The GA4 destination is activated only with consent to “Analytics”. The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR.

The data processed include online identifiers and cookie IDs, IP address, browser and device information, pages viewed and source channels. According to Google, IP addresses from the EU, Switzerland and the United Kingdom are used solely to derive approximate location and are then discarded, not logged or stored. Outside those territories, IP addresses may also be used for basic functions such as spam detection; raw IP addresses are discarded afterwards. For properties linked to Google Ads, encrypted IP addresses may be used there for advertising services depending on the settings.

For analytics, Google generally acts as a processor under Article 28 GDPR and the Google Ads Data Processing Terms. Our GA4 property is linked to Google Ads, so collected data may also serve advertising purposes. Google may act as an independent controller for the relevant processing. Without “Marketing” consent, we technically restrict advertising purposes: allow_google_signals and allow_ad_personalization_signals are false, while ad_storage, ad_user_data and ad_personalization are denied. This does not guarantee complete separation of all processing within Google.

The account setting for sharing data with “Google products & services” has not yet been verified; no particular default is represented as a confirmed account setting. If this sharing is enabled, Google may process data shared under that setting for its own purposes as an independent controller.

GA4 uses the first-party cookies _ga to distinguish users and _ga_T8C20G0ZD3 to retain session state on Ponora domains. Each has a default lifetime of 2 years, which may renew on subsequent visits; browsers may shorten it. These analytics cookies are not technically necessary. Where advertising features are permitted, the advertising technologies described in Section 5.1 of the Cookie Policy may also apply.

Server-side retention of user and event data is separate: this notice provisionally assumes the GA4 default of 2 months; the actual property setting must be confirmed before publication. Deletion takes place in the monthly deletion cycle. Depending on the setting, new activity may reset retention for user identifiers; standard aggregated reports are not subject to this period.

Enhanced measurement is provisionally assumed to be enabled by default; the options actually enabled remain to be confirmed. After Analytics consent, it may automatically collect page views, scrolls and outbound link clicks in particular.

Further information: Google cookies https://support.google.com/analytics/answer/11397207 ; Privacy Policy https://policies.google.com/privacy ; processing terms https://business.safety.google/adsprocessorterms/.

5.3 Transfers to third countries

Google Ads and GA4 may involve transfers of personal data to Google LLC in the USA. Where a transfer is covered by the EU-US Data Privacy Framework and the US recipient’s certification, the corresponding adequacy decision applies; where required, the relevant standard contractual clauses (SCCs) and supplementary safeguards apply. The US certification concerns Google LLC, not Google Ireland Limited.

6. Consent Management and Withdrawal

You may withdraw your consent at any time with effect for the future. Withdrawal must, in principle, be as easy as giving consent.

You can reopen, change or withdraw your cookie selection at any time via the “Cookie settings” link in the footer of every page. You can also delete locally stored preferences using your browser functions; the banner will then appear again.

Withdrawing “Marketing” consent sets ad_storage, ad_user_data and ad_personalization to denied; withdrawing “Analytics” consent sets analytics_storage to denied. The page reloads to unload previously loaded tags; only a destination still permitted is then activated. You can delete existing cookies in your browser settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

7. Browser Settings

You can delete cookies and local storage data stored in your browser or restrict their storage. Please note that technically necessary storage may be required for individual functions. If you completely block such storage, certain website features may be restricted.

8. Third-Party Providers

Third-party scripts are already loaded for expressly requested functions: Stripe (payment processing, js.stripe.com), PayPal (shop payment processing, www.paypal.com), Apple (Sign in with Apple, appleid.cdn-apple.com) and Google (Sign in with Google, accounts.google.com). These scripts are loaded in the payment and login areas, not on ordinary information pages, and are required for the respective requested function; the providers may use their own storage technologies in this context. If further third-party providers requiring consent are used in the future, their name, purpose, legal basis, storage period and, where applicable, transfers to third countries will be described transparently before activation; they will not be activated before the required consent is granted.

Only with your respective consent: Google Ireland Limited for Google Ads (Section 5.1) and Google Analytics 4 (Section 5.2), through the shared Google tag (www.googletagmanager.com).

9. Relationship to the privacy policy

This cookie policy explains the use of storage and access technologies on end devices. Further information on the processing of personal data, in particular on data categories, recipients, storage period, international data transfers and your rights as a data subject, can be found in the Ponora privacy policy.

10. Changes to this cookie policy

Ponora may adjust this cookie policy if the technologies used, the website functions or the legal requirements change. The current version will be published on the Ponora website.

As of: 18 September 2026