Privacy policy

1. Controller

Smile Unlocked is a social media project of:
C&I Business 5.0 GmbH
Aachener Straße 37–39
50674 Cologne
Germany

This company is the controller for data protection purposes.

Email: impressum@smileunlocked.com

2. Hosting, website delivery and server logs

The website is hosted on a server operated by us in an IONOS data centre in Berlin. IONOS provides the data-centre infrastructure. Connections between your browser and the website are TLS encrypted.

When you access the website, the server processes connection data required for delivery and security, in particular IP address, date and time, requested address, transferred data volume, HTTP status, referrer where supplied, browser and operating-system information. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Server logs are generally deleted after no more than seven days unless a security incident exceptionally requires longer retention for investigation or legal enforcement.

3. Campaign and landing-page statistics

When someone enters through one of our base domains or through an address containing campaign parameters such as utm_source, utm_medium or utm_campaign, the website sends a counting signal to our own server. We store only the day, landing page, domain or campaign labels and aggregated number of views.

For an unmarked home-page request, the browser checks only whether the previous page belongs to the same website so that an internal return to the home page is not counted as a new entry. The specific referrer address is neither transmitted nor stored in the statistics.

The statistics use no cookies, local browser storage, visitor IDs or fingerprinting. IP address and user agent are not entered into the statistics table. The necessary server connection is covered by section 2. The purpose is to measure our marketing campaigns; the legal basis is Art. 6(1)(f) GDPR. Aggregated rows are deleted after 24 months.

4. Submissions, nominations and uploads

For a wish, nomination or idea we process first and last name, email address, age, country/location, optional social-media handle, description and submission type. Optional images or videos are stored with filename, type and size. Information and uploads may relate only to the submitting person; personal data or content about nominees or other third parties should not be submitted.

The sole purposes are receipt, internal assessment and editorial selection of the non-binding proposal. The legal basis for the ordinary personal data required for this purpose is Art. 6(1)(f) GDPR, based on our legitimate interest in operating and organising the format. Where the submitting person voluntarily provides their own special-category data under Art. 9(1) GDPR, its processing is additionally based on their explicit consent under Art. 9(2)(a) GDPR.

Uploads are stored technically with the submission and viewed only internally. They are not published, edited for content or passed to partners. Preparation, filming or publication takes place only after separate contact and the necessary agreements and consents.

Submissions not selected, including uploads, are deleted no later than six months after receipt. Selected submissions are retained for further coordination and possible fulfilment and thereafter only for as long as consents, agreements, statutory evidence or limitation periods require.

5. Nominations without nominee data

At the initial nomination stage, we do not request the nominee’s name, contact details or other personal information. The description should contain only the wish and should not identify the nominee. We initially contact only the submitting person.

If a proposal is pursued, later contact and the required privacy information are handled separately. Nominee data is not published or used for a production solely on the basis of the initial submission.

6. Minimum age and minors

A person may submit from age 16. For a younger person, another person aged at least 16 may submit a proposal without providing personal data about the younger person or any other nominee. Before any later fulfilment, recording or publication involving a minor, we obtain the required separate consents from the legal representative and, according to maturity, the minor.

7. Partner enquiries and other contact

For partner enquiries we process company, name, email and message. Through the general contact form we process name, email address and message. Form data is not stored in the website database; it is transmitted directly to our contact mailbox through our mail server.

The legal basis is Art. 6(1)(b) GDPR for pre-contractual communication and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is handling and answering enquiries. General enquiries are deleted once finally handled and no later than twelve months after receipt unless statutory retention or evidence obligations require longer storage. The same maximum period applies to partner enquiries not followed by a contract.

8. Email delivery

Confirmation and contact emails are sent through our SMTP mail server at mx1.blera.io. Recipient and sender addresses, subject, message content and technical delivery data are transmitted to that server and the recipient’s email provider. The legal basis depends on the relevant process described in sections 4, 6, 7 and 9.

9. Newsletter

For the newsletter we process email address, language, sign-up and confirmation times, and technical confirmation/unsubscribe tokens. Delivery starts only after confirmation through a double-opt-in link. The legal basis is your consent under Art. 6(1)(a) GDPR.

You may withdraw consent at any time using the unsubscribe link or by emailing us. Unconfirmed sign-ups are deleted after 14 days; confirmed data is deleted after unsubscribing unless a limited record is required to defend legal claims. The newsletter currently creates no individual open or click profiles.

10. Protection against automated submissions: Cloudflare Turnstile

The submission page, general contact form and newsletter sign-up use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to detect automated and abusive form submissions. The service is loaded only after you interact with a protected form. Cloudflare processes signals including IP address, TLS fingerprint, user agent, sitekey, origin and other browser signals.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting forms, systems and stored data. Where Turnstile stores or accesses information on a device for this security function, it is strictly necessary for the secure form service requested by the user under section 25(2)(2) TDDDG.

Cloudflare may process data in the United States and identifies the EU-US Data Privacy Framework and EU Standard Contractual Clauses as safeguards. See the Turnstile Privacy Addendum and Cloudflare Privacy Policy.

11. Security and administration data

To limit excessive form or login attempts, IP addresses are used only as cryptographic hashes in short-lived rate-limit files, deleted after no more than 24 hours. The protected admin area uses a technically necessary session cookie. The legal basis is Art. 6(1)(f) GDPR and, for the cookie, section 25(2)(2) TDDDG.

12. Recipients, international transfers and automated decisions

Access is limited to authorised internal staff and necessary data-centre, email and security providers. Partners receive personal data only where required and legally covered for a selected fulfilment. There is no solely automated decision-making or profiling; stories are selected by people.

13. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons arising from your situation and withdraw consent at any time for the future.

Contact us through our contact form or email impressum@smileunlocked.com. You may also complain to a supervisory authority, in particular the North Rhine-Westphalia Data Protection and Freedom of Information Commissioner, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

14. External links and changes

Links to social networks and other external sites transfer data to those providers only after you click them. No social-media or YouTube content is currently embedded. We update this policy when functions, providers or the legal position change.