top of page

Privacy Policy

Last updated: June 2025

​

1. General Information

This privacy policy informs you about how JUMBMEDIA DESIGN STUDIO – FZCO (hereinafter “we” or “us”) processes your personal data in connection with the use of our website, our services, and our marketing activities. We take the protection of your data very seriously and comply – where applicable – with the provisions of the EU General Data Protection Regulation (GDPR) and the data protection regulations applicable to us in the United Arab Emirates (UAE).



2. Company Headquarters:

​

JUMBMEDIA DESIGN STUDIO – FZCO


Building A1, Dubai Digital Park
Dubai Silicon Oasis, Dubai
United Arab Emirates (UAE)

​

Managing Director: Clemens Fritsch

​

Email: info@jumbmedia.com
Phone/WhatsApp: +971 50 674 5475

​

3. What Data We Collect
Depending on your usage context, we process the following categories of personal data in particular:

Contact details: e.g., name, email address, telephone number, address, which you provide to us. Contract and payment data: e.g., information necessary for contract fulfillment, as well as payment information when using Stripe (e.g., invoice data, transaction IDs). Content and correspondence: Information that you actively submit to us via forms, uploads, or otherwise (e.g., messages in the contact form, project briefings, files). Usage data: Data that is automatically generated when using the website, in particular technical information (IP address, browser type/version, device type, pages/files accessed, date/time of access, previously visited page (referrer), etc.), which is recorded in server log files. Advertising and analytics data: Interaction data related to our online advertisements (e.g., whether you reached us via an ad, clicks on ads) and pseudonymous identifiers that are collected via tracking technologies (e.g., meta pixels, Google advertising cookies), provided you consent.

​

 

4. Web Hosting and Server Log Files (Wix)

Our website is created using the Wix.com website builder and hosted on the servers of Wix.com Ltd, 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel. Each time you visit our website, Wix collects technically necessary data in server log files as part of the service. This data includes, for example: Your IP address in anonymized form, Browser type and version, operating system and device type used, The page/file accessed and the amount of data transferred, Date and time of access, and the previously visited website (referrer URL). This log data is automatically processed by Wix to ensure the connection and stability of the website, to guarantee technical security (e.g., detection of attacks), and, if necessary, to generate anonymized usage statistics. Wix acts as a data processor on our behalf (see also Section 10. Data Processing). The processing of log file data is based on our legitimate interest in the secure and functional provision of the website (Art. 6 para. 1 lit. f GDPR). The server log files are used exclusively for the aforementioned purposes and are generally automatically deleted or anonymized after a short period (at the latest after approximately 30 days). Note: Wix is ​​a provider based in Israel. The EU Commission has issued an adequacy decision for Israel, meaning that a level of data protection equivalent to that of the EU is recognized. Further details on international data transfers can be found in Section 9. Data Transfer to Third Countries.

 


5. Use of Cookies and Consent Management

Our website uses cookies and similar technologies (e.g., local storage) to provide certain functions and – with your consent – ​​to analyze user behavior or enable personalized advertising. Cookies are small text files that are stored on your device. We distinguish between technically necessary cookies and optional (functional or marketing) cookies. On your first visit, a cookie banner (consent manager) gives you the option to consent to or decline the use of optional cookies. Your preference is stored in a special cookie (“consent policy”, storage period 12 months, essential) so that the banner remembers your decision for future visits. You can adjust your cookie settings at any time via the corresponding link/button on our website and revoke any consent you have given with effect for the future.

​

Technically Required Cookies (Essential Cookies):

These cookies are necessary for the website and its core functions to operate securely and properly. They are set even without consent, as the website would not be usable without them. This includes, in particular, cookies set by the Wix platform:

  • XSRF-TOKEN (Session) – Protects against cross-site request forgery attacks (security cookie). Stored only for the duration of the session.

  • hs (Session) – Security cookie, stored for the duration of the session. Set per session and deleted once the session ends.

  • TS (e.g. TS01***) (Session)** – Various Wix security cookies used to detect and prevent attacks.

  • svSession (12 months) – Recognizes returning visitors (based on an anonymous ID) and enables basic site functionality (e.g., login recognition). Very short lifetime (seconds range).

  • SSR-caching (1 minute) – Identifies from which server the page was delivered to optimize performance. Automatically deleted after 30 minutes.

  • bSession (30 minutes) – Used to measure system effectiveness (performance measurement).

  • _wixCIDX (3 months) – Used for system monitoring and debugging within the Wix platform.

  • fedops.logger.sessionId (12 months) – Analyzes Wix system stability and performance efficiency (error/performance tracking without personal data).

  • consent-policy (12 months) – Stores your cookie consent preferences (required for consent management).

  • (Note: “Session” means that the cookie remains on your device only until you close your browser and is deleted once the session ends.)

The essential cookies mentioned above do not contain any information that directly identifies you, and opting out is not possible since they are required for the operation of the website.

​

Optional Cookies (Marketing & External Services):

Such cookies are set only with your explicit consent (Art. 6(1)(a) GDPR). They help us improve our services and tailor them to your interests. If you disable these cookies, certain functions (e.g., specific media or personalized advertising) may not be available. We use the following optional cookies and tracking technologies on our website: They are functionally necessary to process online payments securely.

Stripe – Our payment processing (see Section 8.1) sets cookies to ensure secure payment transactions and prevent fraud. Specifically, the Stripe.js script sets the following cookies as soon as you use a payment feature:
__stripe_mid (1 year) and __stripe_sid (30 minutes). These cookies are used for device identification and fraud prevention.

Meta Pixel (Facebook/Instagram) – Our use of the Meta Pixel (see Section 8.5) sets a _fbp (first-party) cookie with a lifetime of 90 days. This cookie helps recognize you during future visits and allows us to display relevant ads to you on Facebook/Instagram based on your visit to our website. (Category: Marketing)

Google Ads – As part of Google Ads Conversion Tracking and Remarketing (see Section 8.4), cookies are set to measure advertising effectiveness and enable personalized ads. This includes, in particular, _gcl_au (first-party, 90 days) for tracking ad clicks and conversion events. In addition, Google uses a third-party cookie IDE (DoubleClick.net, approx. 1 year) for displaying personalized ads and possibly for frequency capping (limiting how often the same ad is shown).

You can generally block the acceptance of cookies through your browser settings. Cookies that have already been set can be deleted via your browser. However, please note that blocking technically necessary cookies may affect the usability of the website. You can find more information about your cookie preferences regarding advertising cookies in the following sections and within our cookie banner.

​

​

6. Purposes of Data Processing

We process personal data for various purposes and will not use this data beyond the purposes listed below. Specifically, we process your data for the following purposes: Contract performance and customer communication:


To initiate, execute, and manage contracts or projects you enter with us (e.g., project requests, service delivery), and to communicate with you within the scope of customer service or general inquiries (e.g., responding to contact form messages).

​

Provision and optimization of our services:
We use data to technically provide our services (e.g., website hosting, content display) and to continuously improve them. This also includes the analysis of anonymized usage data to enhance usability and our overall offering.

​

Payment processing (Online Payments):
To process online payments for our services, we use Stripe. The necessary payment information is used to execute transactions and prevent fraud (see Section 8.1 for details).

​

Marketing and remarketing:
We process data to promote our services and display interest-based advertising. This includes, in particular, tracking conversions (successful actions after ad clicks) and remarketing to reach visitors of our website with ads on other platforms. We use tools such as Google Ads and the Meta Pixel (Facebook/Instagram) in accordance with the consents you have provided (see Sections 8.4 and 8.5).

​

Security measures and abuse prevention:
To ensure the integrity, availability, and security of our IT systems. For example, log file data is used to detect and prevent unauthorized access attempts, and services like Google reCAPTCHA help us prevent automated spam or abusive form submissions (see Section 8.3).

​

​

7. Legal Bases of Processing

Where the GDPR applies (i.e., for processing operations subject to EU data protection law), we base the processing of your personal data on the following legal bases under Art. 6 GDPR: Consent (Art. 6(1)(a) GDPR):
If you voluntarily give us consent, e.g., by confirming the cookie banner (for marketing cookies) or expressly agreeing to be contacted. You may withdraw your consent at any time with future effect (see also data subject rights).

​

Contract performance or pre-contractual measures (Art. 6(1)(b) GDPR):
When processing is necessary to perform a contract with you or to carry out pre-contractual measures — for example, when you request a service via our contact form, we use your data to handle your inquiry and possibly conclude a contract. Payment processing via Stripe also falls under this legal basis since it is necessary for executing the contract (payment of fees).

​

Legal obligation (Art. 6(1)(c) GDPR):
Where we are subject to legal obligations, we process data accordingly. This particularly applies to recordkeeping obligations under commercial or tax law (e.g., storage of invoice data for the required period) or disclosure obligations to authorities.

​

Legitimate interest (Art. 6(1)(f) GDPR):
In certain cases, we process data to safeguard our legitimate interests or those of third parties. We always weigh your interests against ours. Examples include storing server logs to ensure IT security and perform error analysis, using reCAPTCHA to protect against bots (security interest), or directly contacting existing customers by email about similar services.

If we rely on legitimate interests, you may object to such processing under Art. 21 GDPR if reasons arise from your particular situation that speak against the processing (see data subject rights below).

​

​

8. Services and Third-Party Providers Used

We use various external service providers and technologies to deliver our services and website. Below you will find detailed information about the main third-party providers integrated into our website and how personal data is processed in this context. Depending on the service type, these providers may act as processors on our behalf (strictly following our instructions) or as joint or independent controllers. In all cases, we ensure that appropriate contractual arrangements and security measures are in place. Data is only shared with third parties under the following conditions:

  • You have given your explicit consent (Art. 6(1)(a) GDPR), or

  • The transfer is necessary for contract performance (Art. 6(1)(b) GDPR) — e.g., transferring data to our hosting provider or payment processor to handle your order, or

  • We are legally obliged to disclose the data (Art. 6(1)(c) GDPR), or

  • The transfer is based on our legitimate interest (Art. 6(1)(f) GDPR) and is permissible because no overriding interests of the data subject exist.

We conclude data processing agreements (DPAs) under Art. 28 GDPR with all service providers processing data on our behalf to ensure that your data is processed securely and purposefully. All processors listed below are contractually obligated to process the data only under our instructions and in compliance with strict data protection standards. The main third-party services used on our website are as follows:

​

​

8.1 Payment Processing via Stripe

For online payments (e.g., when you pay for our services online), we use the payment service Stripe.
The provider within the EU is Stripe Payments Europe Ltd., Grand Canal Street Lower, Dublin 2, Ireland.
When payment is made via Stripe, the payment data you enter (e.g., credit card number, name, amount) is transmitted directly to Stripe and processed there to execute the transaction. Stripe may also collect additional data about your device (e.g., IP address, device characteristics) to prevent fraud and verify identity. This ensures payment security and the prevention of credit card fraud.

​

Role of Stripe:
Regarding payment and transaction data, Stripe primarily acts as a data processor on our behalf since it processes the data to carry out the payment for us. However, Stripe may also act as its own controller where required by law (e.g., anti-money laundering). We have concluded a data processing agreement with Stripe. For European users, payment processing is carried out by Stripe Payments Europe (Ireland); any transfer to Stripe Inc. in the USA is based on Standard Contractual Clauses between the European and U.S. entities and, where applicable, the EU-U.S. Data Privacy Framework (see Section 9 on international transfers).

​

Legal basis:
Processing is carried out for contract performance (Art. 6(1)(b) GDPR), as payment is required to fulfill the contract concluded with you. Where certain operations (e.g., fraud prevention via Stripe cookies or device fingerprinting) are not strictly necessary for contract performance, we rely on Art. 6(1)(f) GDPR (legitimate interest in preventing fraud and payment defaults). If legally required, we obtain your consent (e.g., for cookies set by Stripe — see Section 5 on cookies).

​

Additional information:
Stripe generally stores your payment data as long as necessary to execute the payment and for compliance purposes. We do not receive full credit card details — only limited data such as a payment confirmation, customer number, and the last four digits of your card.


For more details on Stripe’s data processing, please refer to the Stripe Privacy Policy.

​

8.2 Embedded Fonts (Google Fonts)
Our website uses Google Fonts, a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. By using external fonts, we can design our website in an attractive and consistent way. Google Fonts are integrated into our website so that when you access a page, your browser loads the required fonts from Google’s servers. In doing so, your IP address is transmitted to Google, as this is necessary for the font to be delivered to your browser.

​

According to Google, no cookies are set for the Google Fonts service itself, and no other personal data is stored apart from the IP address and, if applicable, technical parameters required for font delivery. The IP address is usually transmitted by Google to servers in the United States. Google claims to use this data solely for the efficient delivery of fonts and not to link it with other Google services. Nevertheless, the integration constitutes a data transfer to Google.

​

Legal basis: Our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing an attractive and consistent online appearance. The use of external fonts saves loading time and system resources. We have implemented Google Fonts so that they are cached locally; on repeat visits, they are loaded from your browser cache whenever possible. If you do not agree to the transfer of your IP address to Google, you can block access to Google Fonts in your browser settings (e.g., via an add-on).

(Note: Due to a court ruling in Germany, the external use of Google Fonts is viewed critically under data protection law. Therefore, we are currently evaluating a local hosting option. At present, we rely on legitimate interest since the delivery of fonts is part of the technically necessary website display.)

​

8.3 Google reCAPTCHA
To protect our online forms (e.g., contact form) from spam and automated attacks, we use Google reCAPTCHA (version v2 or v3), a service provided by Google Ireland Ltd. (see address above). reCAPTCHA analyzes user behavior in the background (e.g., mouse movements or typing patterns) to determine whether the visitor is a human or a bot. This ensures that automated scripts cannot send mass messages through our form.

​

When using reCAPTCHA, a connection is established with Google servers. Google receives the user’s IP address, mouse movements, typing behavior, and other data necessary for the Turing test function. This transmission is subject to Google’s privacy policy.

​

Google sets a necessary cookie or local storage entry called _GRECAPTCHA on your device, allowing recognition across sessions. The current storage period is six months. Google may also read cookies such as NID or SID from the Google domain if you are logged into Google services to create a risk profile.

​

Data transfer to the USA: Google reCAPTCHA may transmit data to Google servers in the United States. Google is certified under the EU–US Data Privacy Framework (as of 2023), so an adequate level of data protection can be assumed. In addition, we have entered into Standard Contractual Clauses with Google to ensure protection in case the adequacy level is not maintained.

​

Legal basis: The use of reCAPTCHA is based on our legitimate interests (Art. 6(1)(f) GDPR), namely the protection of our infrastructure against abuse, spam, and automated data scraping. This typically outweighs your interest in preventing such data transfers, as reCAPTCHA is necessary to ensure the proper functioning of our contact forms.

​

If a stricter interpretation requires consent (because Google reCAPTCHA collects more data than is strictly necessary for security), we obtain this via our cookie banner. Currently, we consider reCAPTCHA a technically required security measure.

Further information: Details on functionality and data usage can be found in the Google Privacy Policy and the Google reCAPTCHA Terms of Service.

​

8.4 Google Ads (Conversion Tracking & Remarketing)
Our website uses features of Google Ads, an online advertising program provided by Google Ireland Ltd. (see address above). We use Google Ads to promote our services in Google search results and across the Google advertising network. In this context, we use conversion tracking (to measure the success of our ads) and remarketing (to re-engage visitors with targeted advertising).

​

Conversion Tracking: When you click one of our Google Ads, Google stores a cookie (_gcl_aw or _gcl_dc) on your device. This cookie enables Google to associate your visit to our website with a specific ad click. For example, if you visit a specific landing page or submit a form, Google can register this as a conversion (successful action). We then receive a report from Google indicating how many users came to us via ads and performed the desired action. We do not receive information that personally identifies you — only anonymized statistics.

​

Remarketing: We use Google remarketing tags to display targeted ads to users who have already visited our website and shown interest in our services. Our site includes a Google script that recognizes a unique cookie (IDE via doubleclick.net domain or _gcl_au via our domain) in your browser. This cookie stores that you visited our site and which content interested you. Google can then recognize you later and display relevant ads.

​

Data and disclosure: The data collected as part of Google Ads (in particular, cookie ID, IP address, and website usage) is transmitted to Google and processed on Google servers (potentially in the USA). Google may link this data with your Google account (if logged in) or use it to create pseudonymous user profiles. We ourselves do not receive personal data from Google — only aggregated reports.

​

Legal basis: Google Ads and related tracking functions are activated only with your consent (Art. 6(1)(a) GDPR). You can choose whether to allow conversion tracking and remarketing via our cookie banner. Without consent, these Google services are not loaded. You can withdraw your consent at any time via our cookie settings.

Opt-out options: Regardless of our cookie banner, you can disable personalized Google advertising by adjusting your ad personalization settings in your Google account (adssettings.google.com) or by setting opt-out cookies. Alternatively, you can install the Google browser plugin that disables Google tracking.

​

Data transfer to the USA: Google Ireland may transfer data to Google LLC in the United States. Google is certified under the EU–US Data Privacy Framework, ensuring an adequate level of data protection. Additionally, we have concluded Standard Contractual Clauses with Google. For more information, see Section 9. Further details are available in the Google Privacy Policy and Google Ads Data Protection Information.

​

8.5 Meta Pixel (Facebook/Instagram Ads)
Our website integrates the Meta Pixel of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This pixel (also known as the Facebook Pixel) allows us to track the effectiveness of our Facebook and Instagram ads and display targeted advertisements to users who show interest in our services.

​

Functionality: When you access our pages, the pixel may establish a direct connection with Meta’s servers. Meta is informed that you have visited our website and possibly which actions you performed (e.g., visiting specific pages, submitting a form, clicking buttons). Meta assigns this information to your Meta/Facebook account if you are logged in. Even if you are not a Facebook/Instagram member, the pixel can collect certain data (e.g., pseudonymous cookie ID, device data).

​

Purpose: We use the pixel for conversion tracking — to determine whether users perform a desired action on our website after clicking a Facebook/Instagram ad (e.g., sending a request). This helps us measure and optimize campaign success. The pixel also enables remarketing/retargeting, allowing us to create target groups for showing ads to Facebook/Instagram users who visited our website or showed specific interests.

​

Data processing by Meta: The collected data (pixel events) may be stored and processed by Meta. Meta may link this data with user profiles on Facebook/Instagram and use it for its own advertising purposes, in accordance with the Meta/Facebook Data Policy. This means Meta may create interest profiles and show targeted ads within Meta products (Facebook, Instagram) or on partner sites. We do not receive personal details from Meta — only anonymized reports in the Facebook Ads Manager regarding audience and campaign performance.

​

Joint controllership: For the initial collection and transmission of pixel data from our website to Meta, we and Meta Platforms Ireland act as joint controllers under Art. 26 GDPR. We have concluded the “Controller Addendum” (Meta’s standard agreement), which specifies that Meta assumes primary responsibility for fulfilling data subject rights regarding data processed after transmission. You can therefore direct access or deletion requests to Meta. Once transferred, Meta processes the data under its own responsibility.

​

Data transfer to third countries: Information collected by Meta may be transferred to and stored on servers in the USA. Meta Platforms Inc. (USA) is certified under the EU–US Data Privacy Framework (as of July 2023), ensuring an adequate level of data protection. In addition, transfers to Meta USA rely on EU Standard Contractual Clauses, incorporated by Meta into its terms.

Legal basis: We use the Meta Pixel only with your prior consent (Art. 6(1)(a) GDPR). Through our cookie/consent banner, you can choose whether to allow tracking via the Meta Pixel. Without your consent, the pixel remains inactive. You may withdraw your consent at any time via the cookie settings.

​

Objection: If you have consented to the use of the pixel but later wish to prevent Meta from collecting data, you can withdraw your consent (see above) or object within your Meta account settings to the use of your data for advertising purposes. You can also manage ad preferences and disable many trackers centrally via https://www.youronlinechoices.com.

Further information about the Meta Pixel can be found in the Meta Data Policy and the Facebook Pixel Help Center.

​

8.6 Google Tag Manager
We use the Google Tag Manager (GTM) provided by Google Ireland on our website. The Tag Manager is used for the administrative integration of scripts and tags (such as the Google and Meta scripts mentioned above). GTM itself does not collect personal data and does not set its own cookies. It merely ensures that the tags configured within it are triggered—e.g., Google Ads tracking or the Meta Pixel—and that the data is forwarded to the respective services. The actual data processing therefore takes place within the individual services described above.

 

We have configured the Tag Manager so that tags are only triggered if you have given the corresponding consent. GTM respects the settings you make in the consent banner: for example, the Google Ads tag is only loaded if you have agreed to marketing cookies.

​

Legal basis: The use of the Tag Manager itself is based on our legitimate interest in efficiently managing various website services (Art. 6(1)(f) GDPR). Since the Tag Manager does not store or analyze data about you, it does not by itself interfere with your rights. The services triggered via GTM, however, are based— as outlined above—on consent.

​

For more information about the Tag Manager, please refer to the Google Tag Manager Terms of Use.

​

8.7 Contact Form and Communication
If you contact us via the contact form provided on our website or by email/WhatsApp, we process the contact details and message content you provide in order to handle your inquiry. Typically, we collect your name, email address, phone number (if applicable), and the subject of your message in the contact form. Providing additional details is optional.

​

The data you enter in the form is used solely for the purpose of responding to your inquiry and for the related technical administration. Depending on the content of your inquiry, this may also involve pre-contractual measures (e.g., a specific offer for our services) or general information requests.

​

Legal basis: The processing of contact inquiries is based on Art. 6(1)(b) GDPR (if related to pre-contractual or contractual matters, e.g., your inquiry seeks an offer or contract) or on our legitimate interest under Art. 6(1)(f) GDPR in enabling communication and responding to inquiries. In the latter case, you may object to processing at any time for reasons arising from your particular situation.

​

Communication via WhatsApp takes place only upon your initiative and with your consent. Please note that WhatsApp (operated by Meta) gains access to metadata (your phone number, time of communication, etc.); we use WhatsApp mainly for quick, informal exchanges. Upon request, we are happy to offer alternative, more privacy-friendly communication channels.

Retention period: Contact inquiries and communications are stored as long as necessary to handle your request. Once your inquiry has been fully resolved and there are no further retention obligations, we delete your request no later than 12 months afterward. If the inquiry results in a contractual relationship, communication content may be added to our client records and retained in accordance with the retention periods for contractual data mentioned below.

​

8.8 Internal Project Management (Google Drive)
For internal project management and data storage, we use Google Drive and Google Workspace (provider: Google Ireland Ltd.). This means that we store and process certain client or project data on Google’s cloud servers (e.g., project briefs, graphics/layouts, project deliverables, or planning spreadsheets). If this includes personal data of our clients or contacts (e.g., names, contact details, project-related information), such data is processed on Google’s systems.

​

Data processing agreement: Google acts as a data processor on our behalf. We have entered into a comprehensive Data Processing Agreement (including EU Standard Contractual Clauses) with Google, ensuring your data is adequately protected.

According to Google, servers for Google Drive are primarily located within the EU. In our case, the storage location may be restricted to European data centers. However, it cannot be entirely excluded that data may be transferred to the USA during support or backup operations. Google, however, is certified under the EU–US Data Privacy Framework, ensuring a recognized level of protection.

​

Purpose: We use the cloud to work efficiently as a team (e.g., joint document editing) and to store data securely. Personal data is used only within the scope of each project and contractual purpose (e.g., to successfully deliver your project).

Legal basis: Depending on the content of the data, processing is either necessary for contract performance (Art. 6(1)(b) GDPR)—for example, storing project results containing personal details—or based on our legitimate interest in maintaining a modern, secure IT infrastructure and effective team collaboration (Art. 6(1)(f) GDPR).

​

Storage and deletion: Personal data within our project archives is deleted once the purpose ceases to exist. Generally, we retain project-related data for the duration of the project and for as long as subsequent inquiries or warranty claims may arise. Afterward, we delete or anonymize any personal components unless legal retention requirements apply.

Further information on data protection at Google Workspace/Drive can be found in the Google Privacy Policy and the Google Data Processing Terms.

​

8.9 Social Media Links
Our website contains links to our profiles on social networks, specifically WhatsApp, Instagram, and LinkedIn. These are simple external links (e.g., visible through the corresponding icons). No data is transmitted to these platforms unless you click on the links. When you click such a social media button, you leave our website and are redirected to the respective platform. The privacy policies of the respective provider apply there.

​

Please note that particularly Meta (as operator of WhatsApp and Instagram) and LinkedIn (LinkedIn Corporation, owned by Microsoft) may collect data about you when you visit their platforms. This may also occur if you do not have your own profile there (e.g., by storing cookies or evaluating your IP address). We have no influence over this data collection.

To learn more about how these providers handle personal data, please refer to their respective privacy policies:

  • WhatsApp Privacy Policy (a product of Meta Platforms, Inc.)

  • Instagram Data Policy (also Meta Platforms)

  • LinkedIn Privacy Policy (LinkedIn Ireland Unlimited Company)

Our own social media profiles on these platforms are operated in accordance with the respective terms of use. When you interact with us via social media (e.g., by sending us a message), the privacy policies of the respective platform also apply. We may view the profile data you have shared publicly and process your communication in accordance with Art. 6(1)(b) or (f) GDPR (responding to inquiries, public relations).

​

Any analysis of page statistics by the platforms (e.g., Facebook Insights) is carried out under joint controllership, as referenced in our social media privacy notices on the respective platforms.

9. Transfers of Personal Data to Third Countries

A transfer of personal data to countries outside the European Union (EU) or the European Economic Area (EEA) takes place insofar as this is necessary to achieve our purposes or you have given your consent—particularly for the services described in Section 8 (e.g., Google, Meta, Stripe) whose headquarters are outside the EU. In doing so, we comply with Art. 44 et seq. GDPR and ensure through appropriate safeguards that an adequate level of data protection is guaranteed for the individuals concerned. In detail:

​

Israel: Headquarters of our website host Wix. An adequacy decision of the EU Commission has existed for Israel since January 31, 2011. This means personal data may be processed there as within the EU, because Israel’s data protection laws are considered by the EU to provide an equivalent level of protection. Transfers to Israel are therefore permissible without additional approvals (Art. 45 GDPR). Companies in the USA that certify under the new data protection framework ensure a level of protection comparable to EU law. According to our information, Google and Meta participate in (or are certified under) the DPF, so data transfers to these entities under the DPF are to be regarded as lawful. In cases where the DPF does not apply or the recipient is not certified, we additionally use the Standard Contractual Clauses (SCCs) issued by the EU Commission pursuant to Art. 46(2)(c) GDPR as an appropriate safeguard. These standard clauses have been incorporated by U.S. service providers (Google, Meta, Stripe, etc.) into their terms of use and/or data processing agreements. They require the data recipient to ensure EU-level data protection even when processing in the USA. Upon request, we will be happy to provide you with a copy of the essential clauses.

​

United States of America (USA): Several of our service providers (Google, Meta, and, where applicable, Stripe) have corporate headquarters in the USA or store data on U.S. servers. In the past, the USA was not considered a country with an adequate level of data protection. However, on July 10, 2023, the EU Commission adopted the adequacy decision for the EU–US Data Privacy Framework (DPF).

​

UAE (United Arab Emirates): We (JUMBMEDIA DESIGN STUDIO – FZCO) are based in Dubai, UAE. This means that when you interact with us, your data is ultimately transferred to our location in a third country (e.g., we also store customer data locally in the UAE in our systems). There is currently no EU adequacy decision for the UAE. Naturally, we cannot conclude Standard Contractual Clauses with ourselves; instead, we rely on Art. 49 GDPR for such transfers. Specifically, your data is transferred to the UAE only if one of the following derogations is met: (a) Necessity for contract performance—if you request our services or conclude a contract with us, the transfer of your data to our company location is necessary to perform the service (Art. 49(1)(b) GDPR); (b) Consent—in cases where no contractual relationship exists, we obtain your explicit consent to the transfer of data to the UAE (Art. 49(1)(a) GDPR). Please note that the level of data protection in the UAE does not correspond to the European standard and, for example, authorities may have easier access to data without EU legal remedies being available to you. However, we implement internal technical and organizational measures to ensure a high level of protection (see Section 12, Data Security). In addition, as a company based in Dubai, we are subject to the local data protection laws (the UAE enacted a federal data protection law in 2021 that also regulates our handling of data).

​

In addition to the measures mentioned, we continuously review whether further safeguards (e.g., encryption or pseudonymization prior to transfer) can be implemented to minimize risks in data exports. If you have questions about the specific guarantees for data transfers, please feel free to contact us.

​

​

10. Processing by Processors (Disclosure to Processors)
A large part of the data processing operations mentioned in Section 8 is carried out with the support of external service providers who act on our behalf and in accordance with our instructions (so-called processors). With all such service providers, we have concluded a data processing agreement (DPA) pursuant to Art. 28 GDPR. Among other things, it stipulates that the service providers process the data exclusively for specified purposes, treat it confidentially, and comply with appropriate data security measures.

 

Our most important processors and the respective legal bases are:

Wix.com Ltd. (Israel) – Hosting and website operation. Wix provides the infrastructure for our website (web servers, CMS). Role: Processor (hosting provider) on our behalf. Legal basis: Art. 6(1)(b) (contract—provision of the website for requested content) and Art. 6(1)(f) (operational interest in professional hosting). Third-country transfer: Israel—EU adequacy decision, plus DPA with Wix (includes EU Standard Contractual Clauses in case sub-processors outside Israel are used).

Google Ireland Ltd. (Ireland) – Cloud services (Google Drive), and where applicable, Tag Manager. Role: Processor for cloud storage. Legal basis: Art. 6(1)(b) (storage of contractual documents) / Art. 6(1)(f) (operational interest in efficient IT). Third-country transfer: possible to Google LLC USA—secured by Standard Contractual Clauses and participation in the EU–US DPF.

(Note: For various services, Google Ireland also acts as an independent controller vis-à-vis us, e.g., for Google Ads or reCAPTCHA; see the respective sections. In these cases, no DPA applies; instead, we have accepted Google’s provided terms including Standard Contractual Clauses, and Google processes data under its own responsibility.)

​

Stripe Payments Europe Ltd. (Ireland) – Payment service provider. Role: Acts as a processor in the context of payment processing (processes payment data to execute the transaction). Legal basis: Art. 6(1)(b) (contractual payment performance) and Art. 6(1)(f) (fraud prevention). Third-country transfer: possible to Stripe, Inc. USA—secured by intra-group Standard Contractual Clauses; Stripe has also joined the EU–US DPF.

​

Meta Platforms Ireland Ltd. (Ireland) – Advertising and analytics tool (Meta Pixel). Role: Not classic processing; rather (as explained) joint controllership regarding the pixel implementation. No DPA in the strict sense; instead, Meta’s controller-to-controller addendum applies. Legal basis: Consent (Art. 6(1)(a)). Third-country transfer: to Meta USA—under the Data Privacy Framework and Standard Contractual Clauses.

​

Other service providers: Depending on the business case, additional processors may be engaged, e.g., IT support providers, email hosting providers, or similar. Appropriate data protection agreements are in place with all such providers. You may request a list of our current key processors from us.

​

We assure you that we do not sell data to third parties or disclose it unlawfully without a legal basis. All recipients of your data have been carefully selected by us, reviewed for data protection compliance, and contractually bound.

​

​

11. Your Rights as a Data Subject
When we process personal data about you, you have various data subject rights. Below we inform you about these rights in accordance with the GDPR:

Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether we process personal data concerning you. If so, you have the right to access this data and to obtain information such as the purposes of processing, the categories of personal data, the recipients, and the planned storage period. You may receive a copy of the personal data undergoing processing.

​

Right to rectification (Art. 16 GDPR): You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. You may also request that incomplete data be completed.

​

Right to erasure (Art. 17 GDPR): You have the so-called “right to be forgotten.” You may request that we delete your personal data, provided the legal requirements are met. This applies, for example, if the data is no longer necessary for the purposes for which it was collected, you withdraw consent and no other legal basis exists, or we have processed the data unlawfully. Please note that the right to erasure may be excluded in certain cases—for example, if processing is required to fulfill a legal obligation (e.g., statutory retention duties) or for the establishment, exercise, or defense of legal claims.

​

Right to restriction of processing (Art. 18 GDPR): You have the right, under certain conditions, to request the restriction of processing. This means the data will continue to be stored but will no longer be (temporarily) processed. Such a case exists, for example, if you contest the accuracy of the data—for the period that allows us to verify it—or if you have objected to processing (see below)—for the period during which it is verified whether our grounds override yours.

​

Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. You may also request—where technically feasible—that we transmit this data directly to another controller. This right applies only to data processed based on consent or a contract and by automated means.

​

Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which we carry out on the basis of Art. 6(1)(f) GDPR (legitimate interests). If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims. Objection to direct marketing: If we process your data for direct marketing purposes (e.g., newsletters), you may object at any time; we will then no longer use your data for such purposes.

​

Right to withdraw consent (Art. 7(3) GDPR): You have the right to withdraw consent you have given at any time with effect for the future. The withdrawal means we will no longer continue the processing that was based on this consent. The lawfulness of processing up until the withdrawal remains unaffected. For example, you can withdraw consent to receive a newsletter or to the use of optional cookies at any time via our cookie settings.

​

Automated individual decision-making, including profiling (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you. As a rule, we do not make such automated decisions or carry out profiling that has legal effects or similarly significant impacts. If we should do so in the future (e.g., for a credit scoring process), we will inform you separately and safeguard your rights in this context.

​

To exercise your rights, you may contact us at any time in an informal manner, e.g., by email at info@jumbmedia.com. Please provide sufficient information to allow us to assign and respond to your request (for access requests, please specify as precisely as possible which data your request concerns). We will address your request as quickly as possible and no later than within the statutory period of one month. If you believe that the processing of your personal data violates applicable data protection law, you also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

​

12. Right to Lodge a Complaint with a Supervisory Authority

You have the right to file a complaint with a competent data protection authority if you believe that your personal data has been processed in violation of applicable data protection laws.

​

If you are located within the European Union, you may contact the supervisory authority responsible for your place of residence or for our EU representative.

 

Since we serve clients in Germany and have an EU representative there, the competent authority for EU-related matters is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Website: www.ldi.nrw.de

​

For data protection matters under UAE law, you may contact the UAE Data Office (Federal Data Protection Law No. 45 of 2021) or the Dubai Digital Authority (DDA), which oversees data handling in Dubai Free Zones.

Of course, we encourage you to contact us first to resolve any issues directly. Your rights to file a complaint remain unaffected.

​

​

13. Data Security

We implement extensive technical and organizational security measures (TOMs) in accordance with Article 32 GDPR and Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE) to protect your personal data against loss, misuse, unauthorized access, alteration, or destruction. These include but are not limited to:

​

SSL/TLS Encryption:
Our website uses up-to-date encryption technology (HTTPS) to ensure that all data you enter is securely transmitted and cannot be read by third parties. You can recognize this by the “https://” prefix and the lock icon in your browser bar.

​

Access Restrictions:
Access to personal data within our company is restricted to authorized personnel who require the information to perform their duties. These employees are bound by confidentiality agreements. We use role- and permission-based access controls, and our IT systems are continuously monitored. Alerts are triggered for suspicious activity, and emergency response plans are in place.

​

Regular Updates and Monitoring:
Our systems are regularly updated and patched to maintain the latest security standards and prevent vulnerabilities.

​

Encrypted Backups and Recovery:
We create encrypted backups regularly to ensure that, in case of data loss (e.g., due to technical failure or cyberattack), information can be restored quickly and securely.

​

Firewalls and Encryption:
Our servers and devices are protected by enterprise-grade firewalls. Sensitive data is further encrypted wherever possible (e.g., hashed passwords, encrypted drives).

​

Vendor Compliance:
All processors and vendors are contractually required to implement adequate security measures and are reviewed for compliance when possible.

​

Please note that transmitting information over the Internet can carry inherent risks. While no system can guarantee 100% security, we protect our website and internal systems according to the highest industry standards applicable in both the EU and the UAE.

​

​

14. Data Retention and Deletion

We store personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable EU or UAE law. Once the purpose no longer applies, or legal retention periods expire, the data is securely deleted or anonymized.

​

Contact Requests:
Non-binding inquiries (via contact form, email, or WhatsApp) that do not result in a project or contract are deleted within 12 months after communication ends, unless legal or contractual obligations require longer retention.

​

Client Data / Contract Documents:
Personal client data (e.g., name, contact information, contracts, correspondence) is retained for the duration of the client relationship and thereafter according to applicable accounting and tax laws. In general, commercial documents are retained for up to 6 years and financial records for up to 10 years.

​

Project Files and Deliverables:
Project-related files that contain personal data (e.g., names or details in design drafts or documents) are kept as long as the project is active and for up to 3 years after project completion, unless longer storage is required due to legal or warranty claims.

​

Payment Data:
Payment records (transactions, invoices) are retained for up to 10 years in compliance with financial and accounting regulations. We do not store credit card details locally—payments are securely processed by Stripe under their PCI-compliant environment.

​

Cookies & Online Tracking:
Cookies and similar tracking data have different retention periods. Session cookies are deleted automatically when you close your browser; persistent cookies (for analytics or marketing) expire after a defined period. You can delete cookies at any time through your browser settings.

​

Server Log Files:
Server logs are stored by Wix for a few days to several weeks and then automatically deleted or anonymized. The maximum storage period for server logs is 30 days, unless security-related incidents require longer retention.

When you exercise your right to erasure and the applicable legal requirements are met, we will delete your data immediately—unless we are legally required or contractually entitled to retain it.

​

​

15. No Automated Decision-Making or Profiling

We do not use any automated decision-making or profiling (as defined by Art. 22 GDPR and UAE Federal Law No. 45/2021) that produces legal effects or similarly significant consequences for you.All evaluations (e.g., website analytics or marketing segmentation) are performed anonymously and never involve fully automated decisions about individuals. If we ever introduce automated processes in the future (e.g., for credit scoring or service eligibility), we will notify you in advance and ensure full legal compliance.

​

​

16. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our services, business structure, or applicable legal requirements under EU or UAE law.
Material changes (such as new purposes or categories of recipients) will be communicated through our website or via direct notice where required.

​

The latest version of this Privacy Policy is always available at:
👉 https://www.jumbmedia.com/datenschutz

​

Version: June 2025

​

For any questions or concerns about privacy or data handling in the UAE or EU context, please contact us directly at info@jumbmedia.com. We thank you for your trust and assure you that we handle your data with the highest level of care, transparency, and compliance with applicable laws in both the European Union and the United Arab Emirates.

bottom of page