Privacy Policy

Effective Date: September 1, 2025

Last Updated: January 5, 2026

1. Introduction

Sonoma Communications, LLC ("Sonoma," "we," "us," or "our") operates the website sonomacommunications.com (the "Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard information about visitors to the Site.

Sonoma Communications, LLC is a wholly owned subsidiary of The Ington Group. Information collected through this Site is shared within the Ington Group corporate family as described in Section 5.

By using the Site, you acknowledge that you have read and understood this Policy.

2. Information We Collect

2.1 Information You Provide Directly

When you submit our lead collection form, we collect:

• Full name
• Company or organization name
• Email address
• Phone number
• Any additional information you choose to include in free-text fields

2.2 Information Collected Automatically

When you visit the Site, we and our service providers automatically collect:

• IP address (anonymized for analytics purposes) and approximate geographic location
• Browser type, version, and language
• Device type and operating system
• Pages viewed, time spent, referring URL, and click activity
• Cross-device and demographic signals via Google Signals (where you have enabled ad personalization in your Google account)
• Cookie and similar identifiers
• For reCAPTCHA: mouse movement, keystroke cadence, browser plugin data, and other signals used by Google to distinguish humans from bots

2.3 Information We Do Not Knowingly Collect

We do not knowingly collect Social Security numbers, financial account information, precise geolocation, biometric data, health information, or any other category of sensitive personal information through this Site.

3. How We Use Your Information

We use the information we collect to:

• Respond to inquiries submitted through the lead form
• Contact you about our services and the services of The Ington Group by email, phone, or text message
• Verify identity in the course of business communications
• Send marketing communications where you have consented or where permitted by law
• Operate, maintain, and improve the Site
• Measure Site performance and user engagement
• Detect and prevent fraud, abuse, and automated traffic
• Comply with legal obligations and enforce our terms

4. Legal Bases for Processing (EU/UK Visitors)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent — for analytics cookies, Google Signals, marketing communications, and processing of lead form data
• Legitimate interests — for site security, fraud prevention via reCAPTCHA, and responding to inquiries you initiate
• Legal obligation — where we are required to retain or disclose information by law

You may withdraw consent at any time by contacting us using the details in Section 14, or by adjusting your cookie preferences through our cookie banner.

5. How We Share Your Information

5.1 Within the Ington Group

Information submitted through the lead form is shared with The Ington Group and its wholly owned subsidiaries. Subsidiaries receive lead data solely for the purpose of responding to your inquiry and coordinating service delivery. The Ington Group, as parent company, may also use lead data to market its own and its subsidiaries' products and services to you directly. You may opt out of marketing communications at any time as described in Section 9.

5.2 Service Providers

We share information with the following third-party service providers who process data on our behalf:

Provider	Purpose	Data Involved
Google reCAPTCHA	Bot detection and fraud prevention	Device and behavioral signals, IP address
Google Analytics (with Google Signals)	Site usage measurement, cross-device and demographic insights	Cookies, anonymized IP, page activity, ad personalization signals
Google Cloud	Hosting and infrastructure	All Site data in transit and at rest
Mailgun	Transactional and marketing email delivery	Name, email address, message content, delivery metadata
Mailchimp	Marketing email campaigns and list management	Name, email address, engagement metrics
Salesforce	Customer relationship management and lead tracking	All lead form data and communication history

Each of these providers operates under its own privacy terms. Google's practices are described at policies.google.com/privacy. Mailgun's practices are described at mailgun.com/privacy-policy. Mailchimp's practices are described at intuit.com/privacy. Salesforce's practices are described at salesforce.com/company/privacy.

5.3 Legal and Protective Disclosures

We may disclose information when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

If Sonoma Communications, LLC or The Ington Group is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction.

5.5 Sale and Sharing of Personal Information

We do not sell personal information for monetary consideration. However, our use of Google Analytics with Google Signals and similar advertising-related analytics may constitute "sharing" for cross-context behavioral advertising or "sale" under the California Consumer Privacy Act, as amended by the CPRA. California residents may opt out using the "Do Not Sell or Share My Personal Information" link in our Site footer or by contacting us as described in Section 14.

6. Cookies and Tracking Technologies

The Site uses cookies and similar technologies for essential functionality, analytics, and security. Categories include:

• Strictly necessary cookies — required for the Site to function
• Analytics cookies — set by Google Analytics to measure usage, including Google Signals for demographic and cross-device data
• Security cookies — set by Google reCAPTCHA

A cookie consent banner is presented on your first visit and allows you to accept, reject, or selectively enable non-essential cookies. EU/UK visitors must affirmatively opt in to non-essential cookies before they are set. You can change your preferences at any time through the cookie settings link in our Site footer.

7. International Data Transfers

Our service providers, including Google, Mailgun, Mailchimp, and Salesforce, process data in the United States and other countries. Where information is transferred from the European Economic Area, United Kingdom, or Switzerland to a country not deemed to provide adequate data protection, we rely on Standard Contractual Clauses, the EU-US Data Privacy Framework where applicable, or other lawful transfer mechanisms.

8. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your information
• Receive a portable copy of your information
• Opt out of the "sale" or "sharing" of your information (California)
• Opt out of targeted advertising and profiling (Colorado, Virginia, Connecticut, Texas, and other states)
• Object to or restrict certain processing (EU/UK)
• Lodge a complaint with a supervisory authority (EU/UK)

To exercise any of these rights, contact us using the details in Section 14. We will respond within the timeframe required by applicable law, typically 45 days under US state laws and one month under the GDPR.

California "Shine the Light"

California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes once per calendar year.

9. Communications, Phone, and Text Messaging

By submitting the lead form, you consent to receive communications from Sonoma Communications, LLC and The Ington Group regarding your inquiry, by email, phone, or text message. We may also use your phone number to verify your identity in the course of business communications.

Marketing calls and text messages are sent in compliance with the Telephone Consumer Protection Act (TCPA) and applicable state law. Message and data rates may apply. Message frequency varies.

You may opt out of marketing communications at any time:

• Email: click the unsubscribe link in any marketing email
• Text: reply STOP to any text message
• Phone: request to be added to our internal do-not-call list
• All channels: contact us at privacy@ington.group

Opting out of marketing does not affect transactional or service-related communications related to an active inquiry.

10. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

• Non-customer lead form submissions: 14 months from the date of last contact
• Customer records (Salesforce): for the duration of the customer relationship and as required by applicable law
• Email delivery logs (Mailgun): 30 days
• Marketing list data (Mailchimp): until you unsubscribe or your record is otherwise removed
• Analytics data (Google Analytics): 14 months
• System backups: 6 years

We may retain information longer where required by law, to resolve disputes, or to enforce our agreements.

11. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. No method of transmission over the internet is fully secure, and we cannot guarantee absolute security.

12. Children

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, please contact us so we can delete it.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be indicated by an updated "Effective Date" at the top of this Policy and, where appropriate, by additional notice on the Site.

14. Contact Us

For questions, complaints, or to exercise your privacy rights:

Sonoma Communications, LLC

Attn: Privacy

306 Tesconi Circle

Santa Rosa, CA 95401

privacy@ington.group

EU/UK Data Protection Officer

The Ington Group has appointed The DPO Centre as its Data Protection Officer. EU and UK residents may contact the DPO directly:

The DPO Centre