Back

Privacy Policy

Last updated: July 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is: unbubble GmbH Schloßstr. 46–48 51429 Bergisch Gladbach Germany Email: contact@unbubble.social

2. General information on data processing

As a rule, we process personal data of our users only to the extent necessary to provide a functioning website as well as our content and services. Processing regularly takes place only with the user's consent (Art. 6 (1) (a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR), or on the basis of our legitimate interest (Art. 6 (1) (f) GDPR).

3. Cookies & consent management

Our website uses only technically necessary storage mechanisms and – subject to your explicit consent – cookies or comparable technologies for statistics and marketing. On your first visit, a consent banner is displayed via which you can freely decide which categories to allow. Your choice is stored locally in your browser (localStorage, key “ub-consent”) and can be changed at any time via the “Cookie settings” link in the footer.

For control we use Google Consent Mode v2: statistics and marketing services are only activated after your consent. Without consent, no analytics or marketing cookies are set. The legal basis for the use of non-essential cookies is your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG); for technically necessary storage, § 25 (2) TDDDG.

4. Google Analytics 4 & Google Tag Manager

Subject to your consent, we use Google Analytics 4 and Google Tag Manager, services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable an analysis of the use of the website. The IP address is processed by Google Analytics 4 in a truncated/anonymised form prior to storage. The information collected is generally transmitted to and stored on a Google server; this may involve a transfer to Google LLC (USA), which is safeguarded on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future via the “Cookie settings”.

5. Meta Pixel & Conversions API (Facebook/Instagram)

Subject to your consent, we use the Meta Pixel and the Meta Conversions API, technologies provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. We use them to measure and optimise the effectiveness of our advertising (e.g. on Facebook and Instagram). We record interactions on the website (e.g. page views and clicks on “Book a call”, “Email” or “Call”) as well as technical data such as IP address, browser information and – where present – the Meta cookies (_fbp/_fbc).

Some of these events are additionally transmitted to Meta server-side via the Conversions API; browser-side and server-side events are deduplicated using a shared event ID. A transfer to Meta Platforms, Inc. (USA) is possible and is safeguarded via the EU-US Data Privacy Framework or EU standard contractual clauses. With regard to the collection and transmission of the data, we and Meta are joint controllers (Art. 26 GDPR). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via the “Cookie settings”.

6. Reach measurement (Vercel Analytics & Speed Insights)

We use Vercel Web Analytics and Vercel Speed Insights for the anonymous measurement of page views and the optimisation of loading performance. These services operate cookieless and without collecting personal, identifiable profiles. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a technically optimised, secure website).

7. Appointment booking (Google Calendar)

To arrange appointments we link to Google's appointment scheduling function (Google Calendar / Appointment Scheduling). If you book an appointment there, Google processes the data you enter (e.g. name, email address, request). Google's privacy policy applies. The legal basis for the contact / appointment arrangement is Art. 6 (1) (b) GDPR.

8. Contact by email

If you contact us by email, your details will be stored for the purpose of processing the enquiry and in case of follow-up questions. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures/contract) or Art. 6 (1) (f) GDPR (legitimate interest in responding to your enquiry). The data will be deleted as soon as it is no longer required to achieve the purpose and no statutory retention obligations prevent deletion.

9. Live chat

On our website we offer a live chat through which you can send us messages directly. The messages you enter are stored with a timestamp in our database (Supabase; data centre within the EU, Frankfurt am Main) so that we can process and answer your enquiry. To associate replies, a random, non-identifying session identifier is stored locally in your browser (localStorage, key “ub-chat-token”). We only process personal data insofar as you provide it yourself in the messages. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in efficient communication). Chat histories are deleted as soon as they are no longer required for processing.

10. Social media links

On our website we link to our LinkedIn and Instagram profiles. These are simple links – no social media plugins are embedded that would already transfer data to the providers when the page loads. Only when you click the link are you taken to the respective provider, whose privacy policy then applies.

11. Fonts

The fonts used on this website are served locally from our server (self-hosting). No connection is made to third-party servers (e.g. Google Fonts) and therefore no related transfer of your data takes place.

12. Content management / database (Supabase)

The content of this website is provided and stored via the Supabase platform (Supabase, Inc.). Supabase serves as the technical infrastructure (database) for delivering the page content as well as for the live chat. The legal basis is Art. 6 (1) (f) GDPR. A data processing agreement is in place; data is stored in a data centre within the European Union (Frankfurt am Main).

13. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the website is accessed, the server automatically collects and temporarily stores information (server log files) that your browser transmits:

  • IP address of the requesting device
  • date and time of access
  • page accessed / file requested
  • amount of data transferred and notification of successful retrieval
  • referrer URL, browser and operating system used

Processing takes place on the basis of Art. 6 (1) (f) GDPR (legitimate interest in a secure and stable provision of the website). A data processing agreement (Art. 28 GDPR) is in place with Vercel. Any data transfer to the USA is safeguarded on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses.

14. Your rights as a data subject

You have the following rights under the GDPR:

  • access to the data stored about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing (Art. 21 GDPR)
  • withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to contact@unbubble.social is sufficient.

15. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2–4 40213 Düsseldorf, Germany

16. Data security

During your visit to the website we use the widely used TLS (Transport Layer Security) procedure in combination with the highest level of encryption supported by your browser. You can tell whether an individual page is transmitted in encrypted form by the lock symbol in your browser's address bar.