Privacy Policy

1. Who is responsible and what this policy covers

COLD3 UG (haftungsbeschränkt), Speditionsstraße 15a, 40221 Düsseldorf, Germany, is responsible for the processing described here. Contact us at support@einmalfilm.com. This policy concerns the informational and sales website einmalfilm.com, including its checkout entry point, purchase communications and withdrawal form. Creating an event, joining it, using the camera and receiving an archive take place on einmalfilm.online and are explained in that website's separate Privacy Policy. Purchasing a code on .com and using it on .online may involve the same provider but different processing activities.

2. Visiting the website

When you open our website, information needed to deliver and protect it is processed. It may include your IP address, the time and address of the request, browser and device information, response status and error or security events. Our hosting provider may keep access and security logs containing IP addresses. We do not need to maintain a separate customer profile based on your IP address to sell a code. Processing is necessary to provide the site and protect its availability and security (Article 6(1)(f) GDPR); our legitimate interest is a reliable, secure website. Technical information may also be needed to respond to errors and abuse.

3. Website choices and browser storage

If you choose a currency in the pricing area, your browser can remember that preference on your device, so it can be displayed when you return. You can remove locally stored information using your browser settings. Essential browser storage or cookies may also be used for security and for steps you request, such as a withdrawal submission. If optional analytics or advertising technologies are introduced, we will provide information about them and obtain consent where required.

4. Purchases, payment, taxes and codes

When you start a purchase, we process the selected package, quantity, currency and the information needed to create your checkout. Stripe provides the payment page and processes the information you enter there, including contact, payment and billing details and, where relevant, tax details and a promotion code. We receive information needed to confirm the payment, calculate or record the order, issue the purchased code or codes, send your purchase email and handle an invoice, refund or dispute. This can include your purchase email address, order and payment references, amounts, tax and discount information, invoice references, code status and payment time. We do not need your full payment card number for these activities.

The legal bases are Article 6(1)(b) GDPR for taking steps to enter into and perform the purchase contract; Article 6(1)(c) for applicable tax, accounting and invoice duties; and Article 6(1)(f) for preventing abuse, tracing errors and establishing or defending legal claims. Without the information required for checkout, payment and delivery, we cannot complete the purchase. Stripe may also process certain payment information under its own privacy terms where it acts independently. See https://stripe.com/privacy for more information.

5. Purchase emails, support and withdrawal

We use the purchase email address to send purchased codes and service-related messages. If you contact support, we process your address, message, any order details you provide and the correspondence to answer you and resolve the issue. If you withdraw by email or through the website, we process your declaration, contact and identifying information, the time of receipt, the relevant order and code status, and records needed to acknowledge, assess and handle the request. An online withdrawal submission also uses a security check to protect the form against misuse. The legal bases are Article 6(1)(b) GDPR for handling the contractual matter, Article 6(1)(c) where legal duties apply and Article 6(1)(f) for security and documenting legitimate claims. You can send a clear withdrawal statement to support@einmalfilm.com; the separate Withdrawal page explains your rights.

6. Service providers and recipients

To operate .com we use service providers for website hosting and email delivery, payments and invoicing, data handling and form security. These include Hostinger, Stripe, Supabase and Cloudflare. They receive information relevant to their respective service. Depending on the activity, a provider may act on our instructions or as an independent controller. Access can also be given to professional advisers, payment partners and authorities where required for a specific matter or by law.

7. Processing outside the European Economic Area

Some providers or their support teams may process or access personal data outside the European Economic Area. Where such a transfer takes place, it must be covered by an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, as required by law. You may contact us at support@einmalfilm.com for information about the safeguards relevant to your data.

8. How long information is kept

We keep data for the purpose for which it was collected and then delete it or restrict access unless a legal duty or a legitimate claim requires further retention. Invoices and accounting vouchers are retained for eight years from the end of the calendar year in which the relevant record arose. Records required for EU One Stop Shop (OSS) VAT are retained for ten years from the end of the calendar year in which the transaction took place. The order-specific record of accepted Terms and Conditions, including its version, text snapshot and hash, is retained for three years after the purchase contract ends. It is an order record and is kept independently of the code, an event created with that code, participant data and media. Support and withdrawal correspondence is retained while the matter is handled and for any applicable documentation or limitation period. Website access and security information is kept for the periods needed to operate and protect the site, including the configured logging periods of our providers. Locally remembered preferences remain on your device until removed or changed through your browser.

The responsible process is the purchase and accounting retention process. Historical order records remain unchanged. No automatic final deletion process for the stated purchase-record periods is currently implemented; before introducing one, we will define and test a separate retention and deletion process that preserves records subject to a legal hold or another applicable retention duty.

9. Your data protection rights

Subject to the conditions of applicable law, you can request access to, correction or deletion of your personal data, restriction of processing or data portability. You may object to processing based on Article 6(1)(f) GDPR for reasons relating to your particular situation. Where processing is based on consent, you can withdraw that consent for the future. Contact support@einmalfilm.com to exercise your rights. You may also complain to a supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), https://www.ldi.nrw.de. If your request concerns Stripe's own processing, you can also contact Stripe directly.

10. Updates and the other website

This policy may be updated when our services or legal obligations change. When you follow a link to einmalfilm.online to create or join an event, the separate Privacy Policy on that domain explains the processing there.