Privacy Policy
1. Controller and contact
The controller responsible for personal data processed through this website is:
Marcus Sievertsen
MeMa Crew UGC
Weidtmanstr. 25
56072 Koblenz, Germany
Email: info@memacrew.de
2. Website access and hosting
Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When pages and files are requested, technical connection data is processed, including your IP address, the requested address, the date and time of access, browser and operating system information and, where transmitted, the referring page.
This processing provides the website and helps detect and prevent faults and attacks. It is based on Article 6(1)(f) GDPR and our legitimate interest in a secure, functioning website. STRATO receives the data as our hosting provider. STRATO states that visitor IP addresses retained for attack detection are stored for a maximum of seven days. This does not automatically cover every other log or the security data described below.
STRATO processes the data under our hosting contract, including the incorporated data processing agreement pursuant to Article 28 GDPR.
3. Website security with Wordfence
We use Wordfence, a security plugin provided by Defiant, Inc., 1700 Westlake Ave N, Suite 200, Seattle, WA 98109, USA, to protect the website against unauthorised access and malicious requests. Security and connection data such as IP addresses, requested URLs, timestamps and browser information is processed for this purpose. IP location lookups through Wordfence’s servers are enabled, which transfers IP addresses to the provider. Processing in the United States is therefore possible.
Local Live Traffic logging is set to security-related events and a maximum retention period of 30 days. Other blocking or incident records may be needed until their security purpose ends. We do not claim that all data held by Defiant is deleted after 30 days.
Necessary security processing is based on Article 6(1)(f) GDPR and our interest in protecting the website and the data processed through it against misuse.
Wordfence’s licence terms incorporate Defiant’s Data Processing Addendum. For transfers from the European Economic Area to the United States, it provides for the European Commission’s standard contractual clauses under Article 46(2)(c) GDPR. The agreement and safeguards are accessible through the link below. Provider-side data is subject to the provider’s purpose-based retention criteria and contractual deletion provisions, which are separate from our local 30-day setting.
Wordfence Privacy Policy · Defiant Data Processing Addendum
4. Contact forms and email
When you contact us, we process the contact details and message you provide to respond to your enquiry. The form requires your name, email address and project description. Company or brand details are optional. We cannot process a form enquiry without the required fields. You are not legally required to provide these details.
Where you contact us to enter into or perform a contract as a party yourself, processing is based on Article 6(1)(b) GDPR. Other correspondence, including communication with company representatives, is based on Article 6(1)(f) GDPR and our legitimate interest in responding to business enquiries.
The form is processed by WPForms Lite on our web server and delivered by email. Lite Connect entry backups are disabled. With the reviewed configuration, complete submissions are not stored as an entry archive in WordPress. Separate technical server and security logs are described above.
We use STRATO for our business mailboxes info@memacrew.de and ugc@memacrew.de. Project enquiries from both contact forms are sent to ugc@memacrew.de. We handle email using Microsoft Outlook on our own devices, including a computer and iPhone. The configured Microsoft synchronisation transfers copies of messages, including contact details and enquiry contents, between STRATO and Microsoft data centres. Website security alerts are also received through a Microsoft mailbox.
Microsoft’s processing may involve transfers to the United States. Microsoft describes its processing and participation in the EU-US Data Privacy Framework for covered transfers in its Privacy Statement. The provider’s information does not replace our own obligations concerning business email processing. The purposes and legal bases for responding to enquiries stated above also apply to receiving and handling those messages.
We delete enquiry content when it is no longer required for handling the enquiry. Documents required to meet legal obligations or establish, exercise or defend legal claims are retained longer for those purposes. The applicable statutory retention and limitation periods determine that duration. An informal enquiry is not automatically retained as though it were an invoice.
5. Cookies, language and consent
We use Complianz to manage your cookie choices. It stores selected categories and the status of your choice in your browser and controls which scripts are released. You can reopen the settings using “Cookie settings” in the footer at any time. Rejecting optional statistics does not prevent you from using our content, videos or contact options.
Strictly necessary storage or access falls under section 25(2)(2) of Germany’s TDDDG. Where consent is required, section 25(1) TDDDG applies, together with Article 6(1)(a) GDPR for subsequent personal data processing. Necessary consent administration and documentation is based on compliance with consent obligations or our legitimate interest in reliable consent management under Article 6(1)(c) or (f) GDPR, as applicable.
The reviewed setup includes:
cmplz_*: Selected categories, banner status and policy version – Banner expiry is configured to 365 days; existing cookies may expire earlier.pll_language: Keeps the current language choice through Polylang – Session cookie without a persistent expiry date; browsers may restore sessions when configured to do so._ga,_ga_YZD6M4XREG: Distinguishing visits and sessions for Google Analytics, following statistics consent – Google states a default of up to two years; browsers may shorten this. The Firefox test showed a 400-day limit.
The language cookie supports delivery of the German or English version during the current use of the website. This functional session storage is used under section 25(2)(2) TDDDG. To the extent personal data is processed, Article 6(1)(f) GDPR applies to our legitimate interest in consistent language selection. Existing longer-lived language cookies are converted to session storage on the next dynamic page request.
You can delete browser storage and cookies in your browser settings. With the reviewed setup, existing Analytics cookies remain after consent is withdrawn, but measurement stops. Their presence alone therefore does not show that new measurement requests are sent.
6. Google Analytics 4
Following your explicit consent to statistics, we use Google Analytics 4 to understand usage and improve the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data includes visited pages, usage events, timestamps, visit sources, technical device and browser information, approximate location and pseudonymous browser and session identifiers. Your IP address is also processed during technical transmission. We do not describe this data as fully anonymous.
Processing is based on consent under Article 6(1)(a) GDPR and, for storage or access, section 25(1) TDDDG. The Analytics tag is not loaded before consent. You can withdraw consent through “Cookie settings” in the footer with effect for the future. This does not affect the lawfulness of earlier processing. The website can be used without Analytics consent.
Data may be transferred to Google LLC and processed in the United States. Google states that it participates in the EU-US Data Privacy Framework. The corresponding adequacy decision covers only certified recipients and processing within its scope; it does not replace consent or required data protection agreements.
The data processing terms have been accepted in the Analytics account we use. Google Signals and the additional sharing options for Google products and services, modelling and business insights, technical support and business recommendations are disabled. Detailed location and device collection is enabled, including location metadata at city level. Google Ads, Ad Manager, Display & Video 360, Search Ads 360 and BigQuery are not linked to this property.
Retention is set to two months for event data and 14 months for user data. User-data retention resets on new user activity. These settings do not automatically apply to aggregated standard reports. Browser-cookie lifespan is separate from these retention periods.
Google Privacy Policy · Google international transfer frameworks
7. Our images and videos
Images and videos embedded on this website are supplied through our hosting. These videos do not use embedded YouTube or TikTok players. Loading the files processes the connection data described under hosting. Provision is based on Article 6(1)(f) GDPR and our interest in presenting our work and services.
8. Links to Instagram, Facebook and other websites
Social media icons and links lead to external services. No social media feeds or corresponding players are embedded on this website. Opening those links connects you to the external service, where the platform also processes data. See the privacy information provided by Meta and Instagram.
If you communicate with our profiles, we process your messages and publicly shared content to respond and present our services. Article 6(1)(b) GDPR applies to your own specific contractual enquiries; otherwise Article 6(1)(f) GDPR applies to our legitimate interest in business communication. Additional joint-controller obligations can arise, particularly for Facebook Page Insights; simply linking to a platform’s privacy notice does not exclude those obligations.
Meta’s information about Facebook Page Insights and the intended allocation of responsibilities is available in its Page Insights information and Page Insights Addendum. You can contact info@memacrew.de about our own profile communications and exercise rights regarding platform processing directly with Meta. These notices concern the linked profiles; this website does not itself embed a Meta Insights function.
9. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–18 and 20 GDPR.
Objection: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR.
You may withdraw consent at any time with effect for the future. Contact info@memacrew.de to exercise these or your other rights. You may also complain to a supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. The authority for our registered location is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.
The contact forms do not make automated decisions about your enquiry with legal or similarly significant effects within the meaning of Article 22 GDPR.
10. Encryption and date
This website uses HTTPS to encrypt transmission between your browser and our web server.
Last updated: 17 October 2026.