Privacy policy

Last updated: 15 October 2026

This privacy policy explains which personal data we process when you visit our shop at stepmasters.de, buy from us, subscribe to our newsletter, contact us or use our portal at partner.stepmasters.de (project submission, partner area and withdrawal function). It also explains the legal basis for this, to whom we pass data, how long we store it and what rights you have.

This privacy policy is available in German, English, French, Spanish, Italian and Polish. All versions have the same content.

Controller

The controller responsible for data processing is:
STEPMASTERS, owner Nico Rotter
Dörfer Kamp 19a
59394 Nordkirchen
Germany
Email: info@stepmasters.de
Phone: +49 163 4054907

We have not appointed a data protection officer because we are not required to do so. If you have questions about data protection or wish to exercise your rights, please use the contact details above.

Summary

  • We sell digital products only (CAD models and building plans for download). We therefore do not need a delivery address.
  • Our shop runs on the Shopify platform. Shopify processes data on our behalf and, for certain features, also under its own responsibility (see “Shopify as our platform”).
  • Cookies for personalisation, analytics and marketing are only set with your consent. The cookie banner is shown to visitors from all countries. You can change your choice at any time via “Cookie preferences” at the bottom of every page.
  • You will only receive the newsletter if you subscribe to it yourself. You can unsubscribe at any time.
  • Among other things, you have the right of access, rectification and erasure, a right to object (see “Your right to object”) and the right to lodge a complaint with a data protection supervisory authority.

What data we process

Depending on how you use our services, we process the following categories of personal data:

  • Contact data: name, email address, billing address and, if you provide it, phone number.
  • Order and contract data: products purchased, prices, order number, time of the order, your consent to the immediate provision of the downloads, withdrawals, refunds and cancellations.
  • Payment data: payment method chosen, payment status, transaction number and, for card payments, card type and the last digits of the card. We do not receive your full card details.
  • Account data: data of your customer account, such as customer ID, language setting and newsletter status. There is no password; you sign in with a code that you receive by email.
  • Communication data: the content of your messages to us and of our replies.
  • Device and usage data: IP address, browser and device information, pages visited, time of access as well as cookies and similar identifiers.
  • Partner data: for partners, additionally address, details and files of submitted projects, agreements, sales of their own projects, statements as well as bank details and tax details for payouts.

Where the data comes from

We receive most data directly from you, for example when you place an order, sign in, write to us or submit a project. Device and usage data is generated automatically when you visit our pages. From Shopify, our payment service providers and banks we receive information on payment status, risk checks, refunds and chargebacks. For our portal, Shopify sends us your customer ID, your email address and information about your orders.

Shopify as our platform

Hosting of the shop

Our shop is operated by Shopify. Our contractual partner is Shopify International Limited, c/o Intertrust Ireland, 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify processes the data arising when you visit and shop in our store on our behalf (Art. 28 GDPR). For this purpose Shopify provides the shop pages, the checkout, the customer account, the sending of emails about your order and the downloads. This includes technical access data such as your IP address, which Shopify needs to deliver the pages and to protect the shop against attacks.

The legal basis is Art. 6(1)(b) GDPR where your order or your customer account is concerned, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is a secure and reliable online shop.

Shopify passes data that you submit to the shop to its parent company Shopify Inc. in Canada and to other Shopify group companies and service providers, which may also be located in countries other than your country of residence, for example in the USA or in Singapore. For Canada there is an adequacy decision of the European Commission (Decision 2002/2/EC). According to Shopify, transfers within the Shopify group are based on binding corporate rules (Art. 47 GDPR) and transfers to other service providers on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

Technical operating data

When you visit our pages, Shopify’s program code sends technical operating and event data to Shopify servers, for example loading times, error messages, the page visited and information about your browser and device. Shopify uses this data to operate and secure the platform and to fix errors. This transmission is part of the platform; we cannot switch it off. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a stable and secure shop. Shopify only sets cookies for analytics and advertising if you have agreed in the cookie banner (see “Cookies and cookie banner”).

Advanced Shopify features (Shopify Network Intelligence)

We use advanced Shopify features that incorporate data from your interactions with our shop, with other merchants and with Shopify, for example for analytics, the tailoring of offers and advertising. For these features, Shopify may use personal data collected during your interactions with our shop, with other merchants and with Shopify. Shopify itself is responsible for this processing and also answers your requests regarding your rights for these purposes. Shopify may also transfer this data to other countries for this purpose. Shopify only uses data from our shop for non-essential purposes such as analytics, the tailoring of offers and advertising based on your activity if you have consented in the cookie banner (Art. 6(1)(a) GDPR). If you decline in the banner or withdraw your consent, Shopify flags your device’s data so that it is not used for such purposes. For essential purposes, for example fraud prevention, we base the disclosure to Shopify on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and economic operation of our shop.

You can find more information in the Shopify Consumer Privacy Policy. You can exercise your rights against Shopify via the Shopify privacy portal.

Shop app and Shop Pay

We do not offer the Shop Pay payment service or sign-in with Shop. If you have a Shop account with Shopify under the email address you provide with your order, Shopify may display your orders with us there; Shopify itself is responsible for this. If you use Shopify’s “Shop” app or a Shop account, for example to track orders, Shopify processes your data for this under its own responsibility in accordance with the Shopify Consumer Privacy Policy. When you visit our shop, Shopify also loads a component from shop.app that Shopify classifies as strictly necessary. It may set the cookie _shop_app_essential in your browser if your browser allows third-party cookies. Shopify is responsible for this processing by shop.app.

Cookies and cookie banner

Our shop uses cookies and similar technologies, such as your browser’s local storage. On your first visit, a cookie banner provided by Shopify asks which categories you agree to. The banner is shown to visitors from all countries. It distinguishes four categories:

  • Strictly necessary cookies. They are always active because the shop cannot be used without them, for example for the basket and checkout, for the country, language and currency you have chosen and to store your choice in the cookie banner. Examples according to Shopify’s cookie policy: _shopify_essential (session and checkout data, 1 year), cart (basket, 2 weeks), cart_currency (basket currency, 2 weeks) and localization (country and language, 1 year). The legal basis for storing and reading them is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); for further processing it is Art. 6(1)(b) and (f) GDPR. Our legitimate interest is a secure and usable shop.
  • Personalisation. These cookies store information about your actions and settings in order to tailor your next visit.
  • Marketing. These cookies are set in particular by Shopify to measure and improve advertising, for example _shopify_marketing (1 year). We do not currently use our own advertising services such as Google Ads or Meta.
  • Analytics. These cookies help us understand how visitors use the shop, for example through Shopify’s statistics. Examples: _shopify_y (1 year), _shopify_s (30 minutes) and _shopify_analytics (1 year).

Cookies in the personalisation, marketing and analytics categories are only set if you have consented in the banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, only the strictly necessary cookies remain active. Via the “Cookie preferences” link at the bottom of every page you can change your choice at any time and withdraw your consent with effect for the future. You can also delete cookies in your browser at any time. Which cookies Shopify sets and for how long is described in Shopify’s cookie policy.

For visitors from the regions for which we have set up a page for objecting to the disclosure of their data, Shopify also honours the “Global Privacy Control” browser signal. If you visit us from one of these regions, you can also object to the disclosure of your data for advertising purposes on our page on privacy choices.

Ordering, payment and download

When you order from us, we process your contact data, your billing address and the order and payment data in order to conclude and perform the contract with you: we accept the order, process the payment, send you the order confirmation and the download links by email, provide the files and handle withdrawals, refunds and queries. The download links and the files are provided by the Shopify app “Digital Products”. You can order as a guest; a customer account is not required. The legal basis is Art. 6(1)(b) GDPR. Without this information we cannot carry out your order.

Before ordering, you agree in the basket that we start providing the downloads immediately. We store this declaration with the wording shown and the language as an attribute of your order so that we can prove it. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is being able to prove your declaration.

To secure payments and to prevent fraud, for example through an automated risk assessment of the order, we, Shopify and our payment service providers also process your data on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is protection against payment defaults and misuse. We retain order and payment records because of statutory obligations (Art. 6(1)(c) GDPR, see “Storage periods”).

We only accept orders from customers in our delivery area (Section 1(3) of our terms and conditions). In addition, because of the sanctions of the European Union, we do not conclude contracts with customers from certain states and territories (Section 1(4) of our terms and conditions); none of these states or territories is part of the delivery area. We therefore check, on the basis of the country of your billing address, whether an order comes from the delivery area and, on the basis of the country and, where applicable, the postcode, whether it comes from one of these states or territories. At checkout, a validation rule of the Shopify app “BCV: Billing Country Validator”, which runs at Shopify, automatically prevents orders from being completed if the billing country is not part of the delivery area. This also applies to all of these states and territories. The rule only takes into account the country of your billing address (see also “Obligation to provide data and automated decisions”). Shopify Flow, a Shopify tool, flags orders that are nevertheless received with a billing country outside the delivery area or without a billing country and notifies us by email. We check every order notified to us ourselves and decide case by case whether to cancel it. The legal basis for checking the delivery area, including at checkout, is Art. 6(1)(b) GDPR, because it determines whether an order can be completed and whether we carry it out or cancel it. The legal basis for checking for sanctions is Art. 6(1)(c) GDPR insofar as the EU sanctions regulations oblige us to carry out this check, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to avoid breaches of sanctions and the related checking effort.

Payment processing and payment service providers

The payment methods we offer are shown at the bottom of every page of our shop and at checkout. For all payment methods, the legal basis for transmitting the data required for the payment is Art. 6(1)(b) GDPR.

Shopify Payments (cards, Apple Pay, Google Pay, Klarna and local payment methods)

We process card payments, for example with Visa, Mastercard, American Express, Maestro or UnionPay, as well as payments with Apple Pay, Google Pay, Klarna and the local payment methods via Shopify Payments. The provider of Shopify Payments for us is Shopify International Limited, Dublin, Ireland. Shopify processes the payment data on our behalf in order to provide the payment services (Art. 28 GDPR).

The actual payment processing is carried out by a payment processor that Shopify uses for Germany, namely one or more of the following companies: Stripe Payments Europe, Limited (Ireland), Adyen N.V. (Amsterdam, Netherlands) or PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). The payment processor may also process your data as an independent controller, in particular to comply with legal obligations to prevent money laundering and fraud, to carry out sanctions screening and to verify identity. The privacy policy of the respective payment processor applies to this: Stripe, Adyen, PayPal.

To authorise a card payment, the necessary transaction data is transmitted to the relevant card scheme (for example Visa, Mastercard, American Express or UnionPay) and to the bank that issued your card. They process the data as independent controllers.

Local payment methods

Depending on the country, we also offer local payment methods via Shopify Payments, for example Bancontact, BLIK, EPS, MB WAY, MobilePay or Satispay. If you choose such a payment method, the data required for the payment is additionally transmitted to the provider of the payment method concerned and to your bank or payment service. They process the data as independent controllers in accordance with their own privacy notices.

Apple Pay

When you pay with Apple Pay, you confirm the payment on your Apple device. Apple does not share your card number with us. The information required for the payment is transmitted, for example a device- or merchant-specific account number and, if you release them, your email address and billing address. Apple itself is responsible for processing your data within Apple Pay; for people in the European Economic Area this is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple may transfer data to Apple Inc. in the USA and, according to Apple, bases this on standard contractual clauses. More information: Apple Pay & Privacy and Apple Privacy Policy.

Google Pay

When you pay with Google Pay, you confirm the payment via your Google account. Google transmits the information required for the payment to Shopify Payments; this may include information about your payment method and your postcode. Google itself is responsible for processing your data within Google Pay; for people in the European Economic Area this is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data within the Google group of companies, including in the USA. More information: Google Payments Privacy Notice.

Klarna

Klarna is integrated in our shop via Shopify Payments. If you choose a Klarna payment method, the data required for processing is transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”), in particular your name, your email address, your billing address, where applicable your phone number and information about the order (products, amount, order number). Klarna processes this data as an independent controller.

For payment methods where Klarna grants you credit, for example if you pay later or in instalments, Klarna checks your identity and creditworthiness. For this purpose Klarna may transmit your name, address, date of birth and phone number to credit reference agencies; in Germany these are SCHUFA Holding AG (Wiesbaden), Creditreform Boniversum GmbH (Neuss), Deutsche Post Direkt GmbH (Troisdorf) and infoscore Consumer Data GmbH (Baden-Baden). According to Klarna, this transmission is based on Art. 6(1)(f) GDPR. Klarna decides automatically whether to accept the payment. You have the right to obtain human intervention on the part of Klarna, to express your point of view and to contest the decision, by email to datenschutz@klarna.de.

Klarna may also process data outside the EU and the European Economic Area and, according to Klarna, ensures a level of protection equivalent to the GDPR. More information: Klarna’s privacy notice and credit reference agencies Klarna works with in Germany (in German).

PayPal

When you pay with PayPal, you authorise the payment on a PayPal page or in a PayPal window. For this purpose the necessary data (name, email address, billing address, order amount and order number) is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). PayPal processes your data as an independent controller and, depending on the PayPal payment method chosen, may check your identity and creditworthiness with the help of credit reference agencies. According to PayPal, transfers within the PayPal group are based on approved binding corporate rules (Art. 47 GDPR). More information: PayPal Privacy Statement.

Customer account in the shop

You can use a customer account with us; it is not required for placing an order. The customer account is provided by Shopify, and its pages are located at shopify.com. You sign in with your email address and a one-time code that Shopify sends you by email; there is no password. In the customer account you can see your orders and your contact details. The legal basis is Art. 6(1)(b) GDPR.

We store your customer account until you ask us to delete it. Data that we are required to retain is then restricted until the end of the retention period (Art. 17(3)(b) GDPR). Deletion with us does not cover data that Shopify stores under its own responsibility for a Shop account; for this, please contact Shopify.

Contacting us

If you write to us by email, call us or use the contact form, we process your details, such as name, email address, phone number, order number and the content of your message, in order to answer your enquiry. Shopify forwards messages from the contact form to us by email; Shopify protects the form with hCaptcha (see “Spam protection (hCaptcha)”). Our email mailbox is operated on our behalf by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (Art. 28 GDPR).

The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns an order or a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering your enquiry. We delete enquiries that are not related to an order no later than two years after the end of the calendar year in which the enquiry was concluded. We retain correspondence about orders, withdrawals and refunds as business letters for six years (see “Storage periods”).

Newsletter

You will only receive our newsletter by email, with new projects (CAD models and building plans), news about STEPMASTERS and offers, if you subscribe to it yourself. You can subscribe in the footer of every page. All we need for this is your email address.

If you subscribe in the footer, you first receive an email with a confirmation link (double opt-in). You will only receive the newsletter after you have opened the link. This ensures that nobody can sign up someone else’s email address. Shopify protects the sign-up in the footer with hCaptcha.

Shopify stores your email address and the status of your consent, with the time, on our behalf. We send the newsletter with the Shopify app “Messaging”; Shopify acts as our processor (Art. 28 GDPR).

Shopify Messaging records which links in the newsletter you click and attributes to the newsletter any visits, items added to the cart and orders in our shop that follow such a click. This shows us which content interests you and helps us improve the newsletter. We do not record whether you open the newsletter. We point out both of these when you sign up in the footer.

The legal basis for sending and measurement is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every newsletter or by email to info@stepmasters.de.

After you unsubscribe, we no longer use your address for the newsletter. We keep the proof of your consent (email address, type and time of your consent or confirmation, time of your unsubscription and the wording of the sign-up text) until the end of the third calendar year after you unsubscribe, so that we can prove that we sent you the newsletter lawfully. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR, alternatively Art. 6(1)(f) GDPR.

Spam protection (hCaptcha)

Shopify protects our contact form and the newsletter sign-up in the footer of every page with the hCaptcha service of Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. hCaptcha checks whether an entry comes from a human or from an automated program. Shopify only loads hCaptcha when you click into one of these forms or type something into it. On our page on privacy choices, Shopify also protects the opt-out form with hCaptcha and loads hCaptcha there as soon as the page is opened. From then on and when the form is submitted, in particular your IP address, date and time, browser and device information and your usage behaviour on the page (for example mouse movements, scroll position, keyboard and touch input) are transmitted to hCaptcha and evaluated there. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting our shop against spam and misuse.

According to its own statements, Intuition Machines, Inc. is certified under the EU-U.S. Data Privacy Framework. Transfers to the USA therefore take place on the basis of the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795). According to hCaptcha, technically collected data is deleted as soon as possible, usually no later than after one year; if abuse is suspected, hCaptcha may keep it longer. More information: hCaptcha privacy policy.

Partner portal (partner.stepmasters.de)

At partner.stepmasters.de we operate a portal for individuals and companies resident or established in Germany who submit projects for marketing by STEPMASTERS (partners). The withdrawal function of our shop also runs via the portal. The controller is STEPMASTERS (see “Controller”). For the portal, the following applies in addition to the other sections.

Project submission

If you submit a project via the submission form, we process your name or company name, your email address, your address, your details about the project, your confirmations regarding the agreement (with time and version) and the uploaded files, for example CAD files, drawings, photos and documents. We use this data to review your project and to conclude and perform the marketing agreement. The legal basis is Art. 6(1)(b) GDPR.

From your details we create a project sheet as a PDF, which we send to you and to us by email. The uploaded files are stored in non-public storage at Vercel (see “Service providers and transfers to third countries”). Only we can retrieve them, via signed download links. If no agreement is concluded, we delete the files and the details of the submission unless statutory retention obligations prevent this.

Partner account and statements

You sign in to the partner area with your customer account; the sign-in runs via Shopify. For this we store your customer ID, your name, your email address and your partner number. To calculate your remuneration we store the sales of your projects (order number, product, quantity, amounts, refunds) and your payouts. For payouts we process the information you provide in the partner area: account holder, IBAN, BIC, address, tax classification and tax number or VAT ID. We additionally receive the account holder, IBAN, BIC, address and tax classification by email; the tax number or VAT ID remains only in our database. You receive a confirmation by email with the account holder and the shortened IBAN. For the transfer we send the account holder, IBAN, amount and payment reference to our bank. We use this information exclusively for payouts and the related statements. The legal basis is Art. 6(1)(b) GDPR and, for statement and accounting records, additionally Art. 6(1)(c) GDPR in conjunction with the retention obligations under tax law.

For signing in, the portal sets strictly necessary cookies that store your session. Without them, signing in is not possible (Section 25(2) no. 2 TDDDG). The portal does not use analytics or advertising cookies.

Withdrawal function

If you withdraw from a contract via our withdrawal function (stepmasters.de/pages/widerruf), we process your name, your email address, the order number, the items concerned and, if you state it, the reason. The portal receives this information, stores it in our database and sends it by email to us and, as an acknowledgement of receipt, to you. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB) and Art. 6(1)(b) GDPR. We keep your declaration as a business letter for six years from the end of the calendar year in which it was received. If it forms part of an accounting voucher, for example because we make a refund as a result of the withdrawal, we keep it for eight years (see “Storage periods”).

Server logs

Each time the portal is accessed, our hosting provider Vercel records access data in server logs for technical reasons, in particular your IP address, date and time, the address requested (URL), the status code, the browser identifier (user agent) and the previously visited page (referrer), as well as error messages of the portal. We need this data for the operation and security of the portal, for example to detect errors and attacks. Vercel deletes the logs automatically after 30 days at the latest. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the portal.

Protection against misuse

To protect the portal against misuse, for example mass uploads, we count requests to the file upload, the submission form and the withdrawal function per IP address. For this we do not store the IP address itself, but only a pseudonymised check value, a counter and the start of the time window. We delete these entries daily once they are older than one day. We automatically check uploaded files for their file type; we do not accept executable programs. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure operation of the portal.

Service providers and transfers to third countries

We use the following service providers for the portal:

  • Vercel Inc. (USA): hosting of the portal and storage of the uploaded files. The portal’s servers are located in Frankfurt am Main, Germany. Vercel may cache files in its network for delivery, and individual Vercel services may also process data in the USA. According to its own statements, Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA therefore take place on the basis of the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795).
  • Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513: database for partner accounts, sales, payouts and withdrawal declarations. The database is located in Frankfurt am Main, Germany. Supabase may also access the data from Singapore or other countries outside the EU for operation and support. There is no adequacy decision for Singapore. The basis is therefore the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which form part of Supabase’s data processing agreement.
  • Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA): sending emails, for example acknowledgements of receipt and notifications. Resend processes the data mainly in the USA. According to its own statements, Resend is certified under the EU-U.S. Data Privacy Framework; transfers to the USA therefore take place on the basis of the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795), and standard contractual clauses have also been agreed (Art. 46(2)(c) GDPR).
  • Shopify: sign-in via the customer account and order and product data for the statements (see “Shopify as our platform”).

Storage periods in the portal

We delete details and files of submissions that are not accepted as soon as it is clear that no agreement will be concluded. We store accepted projects and agreements for the duration of the cooperation and then until eight years after the end of the calendar year of the last statement for the project, because our statements are based on them. We store the partner account and correspondence with partners for the duration of the cooperation and then for six years from the end of the calendar year in which the cooperation ends. We keep statements and payout records as accounting vouchers for eight years and the records of sales and partner remuneration for ten years, in each case from the end of the calendar year. If a project is withdrawn from sale, we delete working copies that are no longer needed within 30 days. The note on tax retention periods in the “Storage periods” section also applies.

Recipients at a glance

Your data is only received by parties that need it for the purposes stated:

  • Processors acting on our behalf and in accordance with our instructions: Shopify International Limited (shop, checkout, customer account, newsletter sending, downloads), Intuition Machines, Inc. (hCaptcha, protection of the forms, engaged by Shopify), STRATO GmbH (email mailbox), Supabase Pte. Ltd. (portal database) and Plus Five Five, Inc. (Resend, emails from the portal).
  • Further service provider: Vercel Inc. (USA), hosting of the portal and storage of the uploaded files (see “Service providers and transfers to third countries”).
  • Independent controllers processing data for the service you have chosen or for their own purposes: Shopify for the advanced features and the “Shop” app, the payment processors of Shopify Payments, card schemes and banks, providers of local payment methods, Apple, Google, Klarna and PayPal, in each case as described above.
  • Our bank for payouts to partners.
  • Authorities, for example tax authorities, where we are legally obliged to do so (Art. 6(1)(c) GDPR).

Transfers to countries outside the EU

Some recipients also process data outside the European Union and the European Economic Area. The bases for this are given in the relevant sections. In summary:

  • Canada (Shopify Inc.): adequacy decision of the European Commission.
  • USA: for recipients certified under the EU-U.S. Data Privacy Framework (according to their own statements Resend, Vercel and hCaptcha), the European Commission’s adequacy decision; otherwise standard contractual clauses of the European Commission.
  • Singapore and other countries (Supabase, Shopify’s service providers): standard contractual clauses of the European Commission or, within the Shopify group, binding corporate rules.

Payment service providers, card schemes and card-issuing banks may also process data outside the European Economic Area. According to their own statements, the providers base such transfers on adequacy decisions of the European Commission, on standard contractual clauses or on approved binding corporate rules. If none of these bases applies, for example if the card scheme of your card is based in a third country, the transfer takes place because it is necessary for the performance of the contract with you (Art. 49(1)(b) GDPR). You can request a copy of the standard contractual clauses from us.

Storage periods

We only store personal data for as long as is necessary for the respective purpose or as we are legally obliged to. We then delete it. In detail:

  • Invoices and accounting vouchers, for example order confirmations containing invoice details, order, payment and refund records: eight years (Section 147(1) no. 4 and (3) of the German Fiscal Code (AO), Section 14b of the German VAT Act (UStG)).
  • Commercial and business letters, for example correspondence about orders, withdrawals and refunds: six years (Section 147(1) nos. 2 and 3 and (3) AO).
  • Books and records, for example the sales ledger and the records of partner remuneration: ten years (Section 147(1) no. 1 and (3) AO).

These periods begin at the end of the calendar year in which the document was created or the letter was received or sent. They are extended for as long as the documents are relevant for taxes whose assessment period has not yet expired (Section 147(3) AO). The legal basis is Art. 6(1)(c) GDPR. During this time we only use the data to comply with these obligations.

  • Other data relating to your order (such as phone number, IP address at the time of the order or the result of the risk assessment): we use it until the end of the third calendar year after the purchase (standard limitation period), so that we can assert or defend claims (Art. 6(1)(f) GDPR). Shopify stores it together with the order. After that, we use it only as part of retaining the order records and delete it together with them (Art. 6(1)(f) GDPR; our legitimate interest is keeping the order at Shopify complete, because some of these details cannot be deleted separately there).
  • Customer account in the shop: until you request deletion; data subject to retention obligations is then restricted until the end of the period.
  • Enquiries not related to an order: until the end of the second calendar year after the enquiry was concluded.
  • Newsletter: until you unsubscribe; the proof of consent until the end of the third calendar year after you unsubscribe.
  • Cookies: for the duration stated in the “Cookies and cookie banner” section, unless you delete them in your browser beforehand.
  • hCaptcha: according to hCaptcha, usually no later than after one year, longer if abuse is suspected.
  • Partner portal: see “Storage periods in the portal”.
  • Data held by independent controllers such as Shopify for the advanced features, payment service providers, Apple, Google, Klarna and PayPal: in accordance with their privacy notices.

Your rights

You have the following rights against us with regard to your personal data:

  • access to the data we process about you (Art. 15 GDPR),
  • rectification of inaccurate or incomplete data (Art. 16 GDPR),
  • erasure of your data (Art. 17 GDPR), unless we still have to retain it,
  • restriction of processing (Art. 18 GDPR),
  • data portability: to receive data you have provided to us in a structured, commonly used and machine-readable format or to have it transmitted to another controller (Art. 20 GDPR),
  • withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal,
  • objection to certain processing (Art. 21 GDPR, see next section),
  • complaint to a data protection supervisory authority (Art. 77 GDPR, see “Complaint to a supervisory authority”).

To exercise your rights, an informal message to info@stepmasters.de or a letter to the address above is sufficient. We will reply without undue delay and within one month at the latest. So that we do not disclose data to unauthorised persons, we may ask you to confirm your identity, for example by sending a message from the email address you use with us. Exercising your rights will not result in any disadvantage for you. For data that Shopify processes under its own responsibility, you can also exercise your rights directly via the Shopify privacy portal.

Your right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing purposes, for example for the newsletter, you can object to this at any time without giving reasons. We will then no longer process your data for these purposes.

You can send your objection informally to info@stepmasters.de or by post to STEPMASTERS, owner Nico Rotter, Dörfer Kamp 19a, 59394 Nordkirchen, Germany. You can also unsubscribe from the newsletter via the link in every email.

Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Online complaint (in German): www.ldi.nrw.de/beschwerde

You can also contact the supervisory authority in your country. A list of the supervisory authorities in the European Economic Area is available from the European Data Protection Board. You are also welcome to contact us first.

Obligation to provide data and automated decisions

You are not legally obliged to provide us with data. However, we need the details marked as mandatory to conclude the contract, for the account or for a submission; without them we cannot conclude or perform the contract. If the validation rule at checkout does not allow an order with a billing country outside our delivery area (see “Ordering, payment and download”), this may be a decision based solely on automated processing within the meaning of Art. 22 GDPR. The rule only compares the country of your billing address with the countries of the delivery area; if it is outside, the order cannot be completed. Insofar as Art. 22 GDPR applies, we base this decision on Art. 22(2)(a) GDPR because it is necessary for entering into the contract: we provide the downloads immediately after the order, so whether the order comes from the delivery area must already be established at checkout. You have the right to obtain human intervention on our part, to express your point of view and to contest the decision; to do so, please contact us using the contact details above. If you are from the delivery area and still cannot complete the order, please first check the country of your billing address. We ourselves do not make any other decisions based solely on automated processing within the meaning of Art. 22 GDPR. Payment service providers and Klarna may refuse a payment on the basis of an automated check (see “Klarna”); you can then choose another payment method.

Children

Our services are not directed at children under 16. We do not knowingly collect data from children. If a child has provided us with data, parents or guardians can ask us to delete this data using the contact details above.

Security

Our pages transmit data in encrypted form (TLS). We protect your data through technical and organisational measures in accordance with Art. 32 GDPR, for example access restrictions and encrypted backups. However, nobody can guarantee completely secure transmission over the internet. Please do not send us confidential information such as bank details by email; partners enter them in the partner area.

Links to other websites

Our pages contain links to websites of other providers, for example to the privacy notices of our service providers. The respective providers are responsible for their content and data processing. If you follow such a link, their privacy notices apply.

Changes to this privacy policy

We update this privacy policy when our data processing or the legal situation changes. The version published here applies; the date at the top shows when it was last updated. We will send you earlier versions on request.