Privacy policyPrivacy policy

This is a courtesy translation. The German version (Datenschutzerklärung, namuba.de/datenschutz/) is legally binding. In case of doubt, the German text prevails.

1 Controller and scope

The controller for data processing on our websites and in our client relationships is Christian Janzen, acting under the brands NAMUBA, HERZKOLLEKTIV and TRIPFABRIK.

Christian Janzen, Büscherweg 21, 33609 Bielefeld, Germany. Email: hallo@namuba.de (HERZKOLLEKTIV: hallo@herzkollektiv.de). Phone: +49 157 570 34 754

This privacy policy applies to namuba.de, namuba.com, herzkollektiv.de, tripfabrik.de, to our social media profiles and to our communication with clients and prospective clients.

2 Basis of processing

We process personal data only as far as this is necessary to run our websites, to provide our services and to manage client relationships. We rely on the following legal bases:

• Consent, Art. 6(1)(a) GDPR
• Contract or pre-contractual measures, Art. 6(1)(b) GDPR
• Legal obligations, for example tax retention requirements, Art. 6(1)(c) GDPR
• Legitimate interests, for example secure operation of the website or efficient communication, Art. 6(1)(f) GDPR
• Storing or accessing information on your device (for example cookies), Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act)

3 Hosting and server log files

Our websites are hosted by external service providers: ALL-INKL.COM (Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany).

When you visit our websites, the following data is stored automatically in server log files: IP address, date and time, page requested, referrer URL, browser, operating system and status code. We use it to deliver the pages and to keep the service secure. The legal basis is Art. 6(1)(f) GDPR. Log data is deleted after 7 days.

We have a data processing agreement with ALL-INKL.COM under Art. 28 GDPR.

4 Contact and enquiries

If you contact us, we process the data you give us in order to handle your enquiry.

Contact and price enquiries: Through the forms we collect your name, email address, where applicable your phone number, your message, and the package and add-on services you chose. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR. We delete the data once the enquiry has been dealt with, unless a contract is concluded (section 11).

Email and phone: We store your message and contact details in order to handle it. The legal basis is Art. 6(1)(b) or (f) GDPR.

WhatsApp Business: If you write to us on WhatsApp, Meta Platforms Ireland Limited (Ireland) processes connection and usage data under its own privacy notices. We only reply to messages you send yourself. The legal basis is Art. 6(1)(f) GDPR.

WeChat: If you contact us on WeChat, Tencent processes the communication data under its own privacy notices, including outside the EU. Use is voluntary. The legal basis is Art. 6(1)(f) GDPR.

5 Web analytics with Matomo and cookies

We use Matomo to understand how our websites are used and to improve them. Matomo runs on our own server at ALL-INKL.COM. The data is not passed on to third parties.

Matomo is configured so that no cookies are set and IP addresses are shortened before they are stored. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is designing the websites to meet demand.

We keep the statistics for 13 months.

We only set other cookies if they are technically necessary (Section 25(2) TDDDG).

6 External content and services

At present we do not embed any external content. We load fonts, images and videos from our own server. If we embed external content in future, the providers will receive your IP address and information about your browser. We will then load such content only with your consent (Art. 6(1)(a) GDPR, Section 25 TDDDG) or, where it is technically necessary, on the basis of Art. 6(1)(f) GDPR.

The operators of third-party websites we link to are responsible for those sites.

7 Social media profiles

We run profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Ireland), X, YouTube (Google Ireland Limited, Ireland), LinkedIn (LinkedIn Ireland Unlimited Company, Ireland) and TikTok (TikTok Technology Limited, Ireland).

When you visit our profiles, the platforms process usage data, also for their own purposes and partly outside the EU. For page statistics there is in part joint controllership under Art. 26 GDPR. We only receive aggregated statistics. If you send us a message or comment, we process your details for handling and moderation on the basis of Art. 6(1)(f) GDPR.

Details can be found in the platforms' privacy notices.

8 Client projects, photo and film

In client projects we process name, address, email, phone, invoicing and payment data, and the content needed for the project (texts, images, access credentials, image and video material). The legal basis is Art. 6(1)(b) GDPR, and for bookkeeping and retention Art. 6(1)(c) GDPR.

Recordings of people: In photo and film productions (for example business, weddings, family, events) we make image and sound recordings of people. Towards the client we process them to perform the contract (Art. 6(1)(b) GDPR). Towards other people who appear in them we rely on our legitimate interest in performing the project (Art. 6(1)(f) GDPR) or on their consent (Art. 6(1)(a) GDPR). The client informs the people shown in advance.

Recordings can reveal special categories of data (for example religious ceremonies). We process them only where the people concerned have consented (Art. 9(2)(a) GDPR).

Our own publication: We publish our own recordings from client projects in our portfolio, on our websites and on our social media profiles only with express consent. You can withdraw it at any time with effect for the future.

Processing on behalf of clients: If we process personal data on behalf of a client (for example during website maintenance), we conclude a contract under Art. 28 GDPR beforehand.

9 Cloud services and third-party software

To edit, store and share image, video and project data we use software and cloud services from Adobe (Adobe Systems Software Ireland Limited, for example Photoshop and Creative Cloud) and Google (Google Ireland Limited). AI-based features of these services may be used. Personal data, for example of people shown, may be processed on the providers' servers, including outside the EU.

The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. Where required, we have data processing agreements and appropriate safeguards with the providers (section 10).

If you do not want your material to be processed with cloud services, please tell us in text form before work begins. This may affect price and delivery time.

10 Recipients and transfers to third countries

Where necessary, your data is passed to: hosting provider (ALL-INKL.COM), cloud and software providers (Adobe, Google), communication and social media platforms (Meta, Tencent, YouTube, LinkedIn, TikTok, X), tax advisers, banks and payment service providers, authorities, debt collection and factoring companies in the case of unpaid claims, and freelancers, subcontractors and cooperation partners who support us in projects (for example in the case of double bookings or larger events). Where required, we have contracts under Art. 28 GDPR with them.

Some providers process data in third countries, in particular the USA and, in the case of WeChat, also China. For the USA we rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified [prüfen], and otherwise on standard contractual clauses under Art. 46 GDPR. There is no adequacy decision for China. Data is processed there only if you contact us on WeChat.

11 Retention periods

We delete personal data as soon as the purpose ceases to apply and no retention obligation prevents it.

12 Your rights under the GDPR

You have the following rights against us:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). We will then stop processing the data unless we demonstrate compelling legitimate grounds.

To exercise your rights, write to us at hallo@namuba.de.

13 Right to complain, provision of data and automated decisions

You can lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Providing your data is necessary to conclude and perform a contract. Without it we cannot handle your enquiry or order. There is no automated decision-making, including profiling, under Art. 22 GDPR.

14 Changes to this privacy policy

We update this privacy policy when our services or the legal situation change. The current version on our website applies.

Last updated: November 2026