Privacy Policy

1. Controller

Patrick Adeniji, trading as "SmarterStars", Marienplatz 8, 94081 Fürstenzell, Germany · support@smarterstars.com · +49 155 67269263.

2. Roles

SmarterStars acts partly as controller (own website, pre-contractual contact, billing) and partly as processor for business customers (processing end-customer data within StarDesk — governed by the DPA, Doc 06).

3. Data subjects and categories

Prospects/customers (B2B contacts): name, business contact and company data, contract/usage data, communication content. End-customer data processed via StarDesk (as processor), including in particular data that the customer's end-customers enter on the feedback domain "WriteYourFeedback" (writeyourfeedback.[TLD]) (e.g. rating, free-text feedback, optional contact details), processed on behalf of the respective customer (DPA, Doc 06). Voicemail data: if a caller voluntarily leaves a message, we/the engaged Caller process the audio file and the caller's number. No recording of live calls takes place. Website usage data: see Cookie Policy (Doc 04). For the free profile analysis via the website form, we also store the time of consent and the IP address at submission (consent_ip) as proof of consent and for abuse prevention (Art. 6(1)(f) GDPR).

4. Purposes and legal bases (Art. 6 GDPR)

Contract performance (b); legal obligations (c); legitimate interests (f: security, abuse prevention, B2B direct marketing within legal limits, product improvement); consent (a: non-essential cookies, certain communications — revocable).

5. Telephony and voicemail

Telephone outreach is performed by independent Callers. Calls are not recorded. If a Caller is unavailable, the caller may voluntarily leave a message on an answering machine. We process that message and the transmitted number to handle the request and delete it once handled or upon expiry of retention periods. The answering-machine greeting informs about storage.

6. Recipients and processors

Carefully selected providers (Art. 28 processing — see subprocessor list in Doc 06): Stripe, Inc. (payment processing/billing), Twilio Inc. (telephony/numbers/voicemail), MXRoute/DirectAdmin (mailboxes), Cal.com (scheduling), Supabase (hosting/database/storage).

7. International transfers

Where recipients are outside the EU/EEA (e.g. USA), transfers rely on an adequacy decision (e.g. EU-US Data Privacy Framework where certified) or appropriate safeguards (EU Standard Contractual Clauses, with a transfer impact assessment where required).

8. Retention

Data is kept only as long as necessary for the respective purposes, observing statutory retention periods (e.g. 6–10 years for commercial/tax records).

9. Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with a supervisory authority. Country-specific authorities: see Part C.

10–11

Provision of contract-necessary data is required; no automated decision-making with legal effect under Art. 22 GDPR.

Prevailing language: For DE/AT/CH the German Part A prevails; otherwise this English Part B prevails. Local-language versions in mandatory-language countries (Part C) take precedence as stated there.

Note: Country addenda (Part C) will follow after counsel sign-off.