Privacy Policy

Privacy at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website.

Personal data means any information with which you can be personally identified.

Who is responsible?

Data processing on this website is carried out by the website operator. You can find contact details in the section “Information on the controller” below.

How do we collect your data?

Some data is collected because you provide it to us. Other data is collected automatically when you visit the website.

What rights do you have?

You have the right to receive information free of charge about your stored personal data, and to request correction or erasure where applicable.

Information on the controller

Weber Media Consulting GmbH

Herlingsburg 6-10
22529 Hamburg

Commercial Register: HRB 178651 · Court of Registry: Hamburg Local Court (Amtsgericht Hamburg)

VAT ID: DE358940227

Represented by: Lucas Weber

Phone: +49 (0) 40 843 096 52

Email: info@weber-media.com

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered via its global content delivery network. Whenever a page is requested, Vercel processes technically necessary data: IP address, date and time of the request, requested URL, referrer, amount of data transferred, and browser and operating system (user agent). This data is stored in server log files in order to deliver the website, keep it secure and analyse errors.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure, fast and stable provision of the website. We have concluded a data processing agreement with Vercel under Art. 28 GDPR. Transfers to the USA are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the standard contractual clauses included in the data processing agreement (Art. 46(2)(c) GDPR).

Provider's privacy notice: vercel.com/legal/privacy-policy

SSL/TLS encryption

For security reasons and to protect confidential content, such as enquiries sent via the contact form, this site uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

Fonts

The fonts used on this website (Urbanist, Montserrat) are hosted locally on our server. No connection to Google or any other font provider is made when you visit the site.

Contact form and email enquiries

If you contact us via the contact form or by email, we process the data you provide (e.g. name, email address, phone number, company, your selections in the form and your message) to handle your enquiry and any follow-up questions.

Form data is delivered to our mailbox via the Web3Forms service (web3forms.com), operated by Web3Creative, based in India. Web3Forms uses sub-processors in the EU and the USA, including hosting and email delivery providers as well as spam filters that receive your IP address and email address to detect spam. Web3Forms also stores incoming enquiries in its system; according to the provider, they are technically deleted after three years at the latest. We have a data processing agreement with Web3Forms under Art. 28 GDPR. Transfers to India and the USA are based on the EU standard contractual clauses agreed therein (Art. 46(2)(c) GDPR). If the Web3Forms route is unavailable, our server sends the enquiry using the email delivery service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), likewise under a data processing agreement. Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete the data once your enquiry has been fully dealt with, unless statutory retention obligations (e.g. under the German Commercial Code or Fiscal Code) apply.

Provider's privacy notice: web3forms.com/privacy

Appointment booking via Calendly

To book a strategy call, we use the Calendly service (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA). Calendly is only loaded once you click a booking button; the booking calendar then opens in a window on our site, and only from that point is data such as your IP address transferred to Calendly. If you have consented to statistics, we also record in Google Analytics that a booking was completed, without your details from the calendar. Calendly processes your details (e.g. name, email address, preferred time) on our behalf to schedule and hold the appointment.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). Transfers to the USA are based on the EU-US Data Privacy Framework (Art. 45 GDPR) and the standard contractual clauses (Art. 46(2)(c) GDPR).

Provider's privacy notice: calendly.com/privacy

Consent management (cookie banner)

On your first visit, a banner asks whether you allow statistics and marketing services. Your choice and its timestamp are stored in your browser's local storage (key “wm-cookie-consent”) so that we do not ask again on every visit. No data is transferred to us or to third parties in the process.

The legal basis for this storage is Section 25(2) no. 2 TDDDG (strictly necessary) in conjunction with Art. 6(1)(c) GDPR (proof of consent). You can change your choice at any time via the “Cookie settings” link in the footer of every page, or withdraw consent with effect for the future (Art. 7(3) GDPR).

Google Analytics 4 and Google Ads

Only if you agree to “Statistics” or “Marketing” in the banner do we load Google Analytics 4 and Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent, Google's script is not loaded and no data is sent to Google.

Google Analytics sets cookies (e.g. “_ga”, lifetime up to 2 years) and records information about your use of the website, such as pages viewed, time spent, clicks, device, browser and approximate location. Google Analytics 4 does not store your IP address. Google Ads measures whether a visit came from one of our ads and led to an enquiry and, with marketing consent, may add visitors to advertising audiences (remarketing). Event data in Google Analytics is deleted after 14 months at the latest.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition.

Provider's privacy notice: policies.google.com/privacy

Meta Pixel

Only if you agree to “Marketing” in the banner do we load the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It lets us measure whether visitors send an enquiry after clicking one of our ads on Facebook or Instagram, and target ads more precisely. The pixel sets cookies (e.g. “_fbp”, lifetime 3 months) and sends information such as pages viewed, events and browser data to Meta. If your device is linked to a Meta account, Meta may associate the data with that account.

We are joint controllers with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Provider's privacy notice: facebook.com/privacy/policy/

Vercel Web Analytics

Only if you agree to “Statistics” in the banner do we additionally use Vercel Web Analytics (Vercel Inc., see Hosting) for anonymous audience statistics such as page views, referring page, country and device type. Vercel Web Analytics does not set cookies; visitors are distinguished by a hash of request data that is discarded after 24 hours.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. For transfers to the USA, see the Hosting section.

Provider's privacy notice: vercel.com/docs/analytics/privacy-policy

Videos

Some pages link to videos stored on the Bunny Stream service of BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. The videos are not embedded and only open in a new tab after you click; only then does Bunny process technical data such as your IP address to deliver them. The legal basis is Art. 6(1)(f) GDPR.

Provider's privacy notice: bunny.net/privacy

Applications

We process applications confidentially and solely to carry out the application process. The legal basis is Art. 6(1)(b) GDPR (initiation of an employment relationship). If no employment relationship results, we delete the documents no later than 6 months after the process ends. Longer storage, for example in a talent pool, only takes place with your explicit consent (Art. 6(1)(a) GDPR).

Storage period

Unless a more specific storage period is stated in this policy, your data remains with us until the purpose of processing no longer applies, you request deletion or you withdraw consent, provided no statutory retention periods apply (up to 6 years under the German Commercial Code or 10 years under the Fiscal Code).

Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

For any request, simply write to info@weber-media.com.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your data (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.