Privacy policy
Last updated: 27 September 2026
1. Controller, scope and roles
COLD3 UG (haftungsbeschränkt), Speditionsstraße 15a, 40221 Düsseldorf, Germany, operates einmalfilm.online and is responsible for the processing described in this policy. Contact: support@einmalfilm.com. This site is used to check a purchase code, create a private event, join it, capture moments and provide a shared archive. The person who creates an event is both the event creator and its first confirmed participant. Someone who joins later through the guest link is a participant, not an event creator. People pictured in a moment may not have used this website. Purchasing codes and payment on einmalfilm.com are described in that website's separate Privacy Policy.
2. Simply visiting or following a link
A visit can generate technical information such as your IP address, request time, pages accessed, browser details, response status and security or error records. Our hosting and security providers may process or log this information even if you arrived by accident, do not enter a code and do not register. We use it to deliver the website, detect problems and protect the service. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a reliable and secure website. A simple visit does not by itself make you an event participant. Essential browser storage may be used where needed for a function you request. Optional cookies or comparable technologies will be explained separately and used with consent where required.
3. Codes and event creation
If you enter a purchase code, we process the code and its status to decide whether an event can be created. A status check does not itself use up the code. If you create an event, we process the event name, chosen date and time zone, duration, creator email address, selected archive recipients, participant limit, code redemption and the confirmations needed for the event. The creator is automatically added as its first confirmed participant and receives event access information and a personal camera link by email. These data are needed to provide the requested event service (Article 6(1)(b) GDPR) and to prevent code misuse and resolve technical problems (Article 6(1)(f) GDPR). Without the necessary code and event details, the event cannot be created.
4. Guests and participation
A guest opens the shareable event link, registers an email address and receives a personal activation and camera link. We process the address, reservation and confirmation status, event participation, the personal access link and the number of successfully stored moments. An activation link must be opened within the period shown in the guest flow; only confirmed participants count towards the package limit. The creator, as a participant, also has a personal camera link and moment allowance. This processing is needed to deliver the participant service (Article 6(1)(b) GDPR) and protect links and event capacity (Article 6(1)(f) GDPR). Event emails may include the guest link, personal access information and, for selected recipients, archive information.
5. Photos and people pictured
Each confirmed participant, including the creator, can capture up to 25 successfully stored moments during the event. We process the uploaded image content and technical information needed to accept, count, prepare and deliver the event archive. A photo may show people who never registered or visited this site; their appearance does not mean they accepted these Terms or consented to photography. We process the images to provide the private event service for its users under Article 6(1)(b) GDPR. Where images contain personal data of other people, limited processing may rely on Article 6(1)(f) GDPR only insofar as their rights and the circumstances permit. Event creators and photographers must respect applicable laws and the wishes and rights of people they photograph. Our Terms of Use do not create a blanket permission to photograph anyone or publish their image.
6. Archive, links and access
The event creator selects, at creation, whether only the creator or all confirmed participants are sent the shared private archive link after the event. When the ZIP archive is ready, it contains the event's stored moments. The selected recipients may receive the same download link by email. Anyone to whom that link is forwarded may be able to download the archive; a recipient email address is not a guarantee that only that individual can access it. We process the link, event and delivery status and information needed to serve and protect downloads (Article 6(1)(b) and, for abuse prevention, Article 6(1)(f) GDPR). There is no public live gallery.
7. Storage periods and deletion
The archive download is available until seven days after the event ends. After the archive is prepared and checked, deletion of the separate original uploads is scheduled. Access to the archive ends at the stated deadline and the archive is then scheduled for deletion. Operational event and participant records are scheduled for cleanup by the tenth day after the event ends; limited evidence of code use or service events may be retained for up to one year where needed to resolve misuse, disputes or legal claims. Correspondence and technical or security records may be retained for the time needed to handle a matter or meet applicable duties. Provider logs and backups can follow separate deletion cycles.
8. Recipients, providers and transfers
To deliver the website, event email, private photo processing and archive, we use hosting, email, data-handling and media service providers. The documented service providers include Hostinger, Supabase and Cloudflare. They may access the personal data needed for their task, subject to the relevant role and arrangements. The selected archive recipients and anyone they share the link with can access photos in the ZIP; we cannot control copies downloaded by others. Some providers or their support teams may process information outside the European Economic Area. Where an international transfer takes place, an applicable adequacy decision or legally required safeguards must be in place; contact support@einmalfilm.com for information about safeguards relevant to your data.
9. Rights, pictured people and complaints
Subject to the conditions of applicable law, you may ask for access to, correction or deletion of your personal data, restriction of processing or data portability. You can object on grounds relating to your particular situation where processing relies on Article 6(1)(f) GDPR. Where consent is the legal basis, you may withdraw it for the future. A person who appears in a photo can contact us even if they never joined the event. Contact support@einmalfilm.com and include enough information for us to find the event or image without sending additional sensitive material unless necessary. We will assess the request and measures available to us. If others have already downloaded the archive, we cannot erase copies from their devices. You may also complain to a data protection authority, in particular LDI NRW at https://www.ldi.nrw.de.
10. Other website and updates
The purchase and payment website einmalfilm.com has its own Privacy Policy. This policy concerns einmalfilm.online and may be updated if our service or legal obligations change. The current version date should appear on the published page.