Data Privacy

Personal data is saved only with your knowledge and consent. In cases in which Users are asked for personal data, they will be treated confidentially and in compliance with the laws on data protection. Personal data is only collected and used when needed to configure or process the content of the commitments acquired. Users may at any time request information on their personal data at no charge. Users may also request deletion of their personal data, as long as they have fulfilled all the commitments in the contract and the retention of their data is not mandatory.

You can contact us by e-mail or via our contact form. In this case, we store the personal data you provide in order to process your request and to contact you to handle your request. If we request information via our contact form, we have marked the mandatory fields required for contacting us accordingly. The voluntary information is used to specify your request and to improve the processing of your request. The requested data is transmitted to us by you on a purely voluntary basis.
Depending on the type of request, the legal basis for this processing is Art. 6 para. 1 lit. b GDPR for requests that you yourself make as part of a pre-contractual measure or Art. 6 para. 1 sentence 1 lit. f GDPR if your request is of a different nature. If personal data is requested that we do not need for the fulfillment of a contract or for the protection of legitimate interests, the transfer to us is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR.
If you are located outside the EU or the EEA, we reserve the right to forward your request within our group of companies to StepOver International GmbH. The legal basis for the data transfer is Art. 6 para. 1 lit. f GDPR.

Data is stored during every visit to the page. We receive usage data, which are stored exclusively for statistical purposes and no conclusions are extracted about Users. Nor are Users evaluated in any way.

The following data are stored for statistical purposes:
    • Location of the visitors (without indicating the specific place, only the country)
    • Web browser type
    • Date and time of the visit to our website
    • Pages visited on our website
    • Data accessed on our website
    • Duration of the visit to the different sections of our website (visits resulting from search engines)

The User’s IP address remains hidden and is not transmitted to us.

The contact data published owing to the duty of disclosure of the legal notice may not be used for sending advertising and information materials that have not been explicitly requested. StepOver reserves the right to take legal action in case of receiving unsolicited promotional information, as well as spam.

Data collected for invoices will be stored until the expiration of a 10 year time limit. Information about the contractional relationship required by commercial law and taxation law up to the legally imposed time limits according to article 6, paragraph 1, sentence 1, letter c GDPR.
During this time period, the data will only be processed again in case of an examination by fiscal authorities. After the expiration of this time limit, the data collected for invoices will be deleted or the access to it will be blocked if deletion is not possible. If the we do not process your data (anymore) for operational purposes, the data is saved until the expiration of the time limit of at most 6 month.

We use Google Analytics on our website. This is a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as “Google”.

We process data with the help of Google Analytics for the purpose of optimizing our website and for marketing purposes on the basis of your consent pursuant to Art. 6 (1) lit. a. GDPR. Usage and user-related information, such as IP address, location, time or frequency of visits to our website, is transferred to a Google server in the USA and stored there.

The data collected in this way is in turn used by Google to provide us with an evaluation of the visit to our website and the usage activities there. This data may also be used to provide other services related to the use of our website and the use of the internet.

Google states that it will not associate your IP address with any other data. Google also provides further information on data protection at: www.google.com/intl/en/policies/privacy/partners
Google also provides you with further information on data protection law, including information on how to prevent the use of your data. The concrete storage period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the data protection declaration for Google Analytics: policies.google.com/privacy.

In addition, Google offers a so-called deactivation add-on at tools.google.com/dlpage/gaoptout
offers a so-called deactivation add-on together with further information on this. This add-on can be installed with the usual Internet browsers and offers you further control over the data that Google collects when you call up our website. The add-on informs the JavaScript (ga.js) of Google Analytics that information about your visit to our website should not be transmitted to Google Analytics. However, this does not prevent information from being transmitted to us or to other web analytics services. Of course, you can also find out whether and which other web analytics services we use in this privacy policy.

In our website, we use the advertising component Google AdWords and the so-called conversion tracking. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as “Google”.
We process your data with the help of Google Ads for the purpose of optimising our website and for marketing purposes on the basis of your consent pursuant to Art. 6 para. 1 lit. a. GDPR.

If you click on an ad placed by Google, the conversion tracking we use saves a cookie on your terminal device. These so-called conversion cookies lose their validity after 30 days and do not serve to identify you personally.
If the cookie is still valid and you visit a specific page of our website, both we and Google can evaluate the fact that you have clicked on one of our advertisements placed with Google and that you have subsequently been redirected to our website.

Google uses the information obtained in this way to create statistics for us about visits to our website. In addition, this provides us with information about the number of users who clicked on our ad(s) and about the pages of our website that were subsequently accessed. However, neither we nor third parties who also use Google AdWords are able to identify you in this way.

You can also prevent or restrict the installation of cookies using the appropriate settings in your internet browser. At the same time, you can delete cookies already stored at any time. However, the steps and measures required for this depend on the specific internet browser you use. If you have any questions, please use the help function or documentation of your Internet browser or contact its manufacturer or support.

Furthermore, Google also offers the following services at:
services.google.com/sitestats/en.html
www.google.com/policies/technologies/ads/
www.google.com/policies/privacy/

Google also offers further information on this topic and in particular on the possibilities of preventing the use of data.

Type and scope of processing
We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage website tags through one interface and allows us to control the precise integration of services on our website.
This allows us to flexibly integrate additional services to evaluate user access to our website.

Purpose and legal basis
Google Tag Manager is used on the basis of our legitimate interests, i.e. interest in optimizing our services in accordance with Art. 6 para. 1 lit. f. GDPR.

Storage period
The specific storage period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Tag Manager: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

This website uses Borlabs Cookie, which sets a technically necessary cookie (borlabs-cookie) to store your cookie consents.

Borlabs cookie does not process any personal data.

The borlabs-cookie cookie stores your consents that you gave when you entered the website. If you wish to revoke these consents, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked again for your cookie consent.

This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA. When you visit one of our pages embedded with Vimeo videos, a connection to the Vimeo servers is established. This tells the Vimeo server which of our pages you have visited. Vimeo also obtains your IP address. However, we have configured Vimeo so that Vimeo does not track your user activities and does not set any cookies. The use of Vimeo is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commission and, according to Vimeo, on “legitimate business interests”. You can find details here: https://vimeo.com/privacy. Further information on the handling of user data can be found in Vimeo’s privacy policy at: https://vimeo.com/privacy.

With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. The advertised goods and services are named in the declaration of consent.
For the registration to our newsletter we use the so-called double-opt-in procedure. This means that after your registration we will send you an e-mail to the e-mail address you provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store your respective IP addresses used and times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

Mandatory information for sending the newsletter is only your e-mail address. The provision of further, separately marked data is voluntary and will be used to address you personally. After your confirmation, we store your e-mail address for the purpose of sending the newsletter. The legal basis is Art. 6 para. 1 p. 1 lit. a GDPR.
Your personal data may be processed on our behalf on the basis of order processing agreements pursuant to Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the General Data Protection Regulation.

For the processing of our newsletter, we use the service Mailchimp. Mailchimp is operated by The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA. Using Mailchimp, you can manage prospects and content for our newsletter. Mailchimp is a recipient of your personal data and acts as a processor for us as far as sending our newsletter is concerned. The processing of the data provided under this section is not required by law or contract. Without your consent and the transmission of your personal data, we cannot send out a newsletter to you.
In addition, Mailchimp collects the following personal data using cookies and other tracking methods: Information about your terminal device (IP address, device information, operating system, browser ID, information about the application you use to read your emails and other information about hardware and internet connection. In addition, usage data is collected such as date and time, when you opened the email / campaign and browser activity (e.g. which emails / web pages were opened). Mailchimp needs this data to ensure the security and reliability of the systems, compliance with the terms of use and the prevention of abuse. Furthermore, Mailchimp evaluates performance data, such as the delivery statistics of emails and other communication data. This information is used to create usage and performance statistics of the services.
The legal basis for the processing of your data is your consent in accordance with Art. 6 (1) lit. a GDPR. You can revoke your consent to the processing of your personal data at any time. By declaring the revocation, the lawfulness of the processing carried out so far is not affected.

Your data will be processed as long as there is a corresponding consent. Apart from that, they will be deleted after the termination of the contract between us and Mailchimp, unless legal requirements make further storage necessary.
We intend to transfer personal data to third countries outside the European Economic Area, in particular the USA. In cases where no adequacy decision of the European Commission exists (e.g. in the USA), we have agreed with the recipients of the data on otherwise suitable guarantees within the meaning of Art. 44 et seq. GDPR. These are – unless otherwise stated – standard contractual clauses of the EU Commission pursuant to Implementing Decision (EU) 2021/914 of June 4, 2021. You can view a copy of these standard contractual clauses at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN.
In addition, prior to such a third country transfer, we obtain your consent pursuant to Art. 49 (1) sentence 1 lit. a. GDPR. We would like to point out that in the case of third country transfers, there may be unknown risks in detail (e.g. data processing by security authorities of the third country, the exact scope and consequences of which for you we do not know, over which we have no influence and of which you may not become aware).
You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare the revocation by clicking on the link provided in every newsletter e-mail or by sending a message to the contact details provided in the imprint.

We would like to point out that we evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. For the evaluations, we link your collected data and the web beacons with your e-mail address and an individual ID.
The data is collected exclusively pseudonymously, i.e. the IDs are not linked to your other personal data, and direct personal reference is excluded.

On our website, we use the analysis and conversion tracking technology of the LinkedIn platform. With this technology from LinkedIn, you are shown more relevant ads based on your interests. LinkedIn also provides us with aggregated and anonymous reports of ad activity and information about how you interact with our website. You can find more information about LinkedIn’s data protection here: https://www.linkedin.com/legal/privacy-policy#choices-oblig. You can opt-out of LinkedIn’s analysis of your usage behaviour and the display of interest-based recommendations by clicking on the “Opt-out on LinkedIn” (for LinkedIn members) or “Opt-out” (for other users) box at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Type and scope of processing

We use Facebook Pixels supplied by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland to create so-called custom audiences i.e. to segment visitor groups of our online services, to determine conversion rates, and subsequently to optimize these. This occurs in particular when you interact with advertisements that we have placed with Facebook Ireland Ltd.

Purpose and legal basis

We process your data with the aid of Facebook Pixel for the purpose of optimizing our website and for marketing purposes, based on your consent pursuant to Art. 6 Para. 1 lit. a. GDPR.

Retention period

We have no influence over the specific retention period for processed data; the retention period is determined by Facebook Ireland Ltd. Further information can be found in the Privacy Policy for Facebook Pixel: https://www.facebook.com/privacy/explanation.

We only pass on your personal data that we process on our website to third parties if this is necessary for the fulfillment of the purposes and is covered by the legal basis in the individual case (e.g. consent or safeguarding legitimate interests). In addition, we disclose personal data to third parties in individual cases if this serves the assertion, exercise or defense of legal claims. Possible recipients may then be, for example, law enforcement agencies, lawyers, auditors, courts, etc.

Insofar as we use service providers for the operation of our website who process personal data on our behalf within the scope of commissioned processing pursuant to Art. 28 GDPR, they may be recipients of your personal data. You can find more information on the use of processors and web services in the overview of the individual processing operations.

StepOver GmbH only serves customers from the EU and EEA. Customers from all other countries are served by our sister company StepOver International GmbH. Within the framework of our cooperation, we pass your data on to StepOver International GmbH in order to process your request.

StepOver GmbH
Otto-Hirsch-BrĂĽcken 17
70329 Stuttgart

Dr. Timo Hoffmann

Am Rebberg 4
78078 Niedereschach
Germany

datenschutzbeauftragter@stepover.de

In accordance with the EU Data Protection Regulation, we hereby inform you about your rights

You have the following rights:

  1. The data subject shall have the right to obtain confirmation from the controller (StepOver GmbH – Otto-Hirsch-BrĂĽcken 17 – 70329 Stuttgart), as to whether personal data concerning him or her are being processed; if so, he or she shall have the right to obtain access to such personal data and to obtain the following information:
    (a) the purposes of processing;
    b) the categories of personal data processed;
    (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organizations;
    (d) if possible, the envisaged duration for which the personal data will be stored or, if this is not possible, the criteria for determining that duration;
    (e) the existence of a right to obtain the rectification or erasure of personal data concerning him or her, or the restriction of processing by the controller, or a right to object to such processing;
    (f) the existence of a right of appeal to a supervisory authority;
    (g) if the personal data are not collected from the data subject, any available information on the origin of the data;
    (h) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) and, at least in such cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.
  2. Where personal data are transferred to a third country or to an inter-national organization, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 in relation to the transfer.
  3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless he or she indicates otherwise.
  4. The right to receive a copy under paragraph 1b shall not prejudice the rights and freedoms of other persons.

The data subject shall have the right to obtain from the controller (StepOver GmbH – Otto-Hirsch-Brücken 17 – D–70329 Stuttgart) without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

  1. The data subject shall have the right to obtain from the controller (StepOver GmbH – Otto-Hirsch-Brücken 17 – D–70329 Stuttgart) the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
    (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
    (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
    (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
    (d) the personal data have been unlawfully processed;
    (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
    (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
  2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
  3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
    (a) for exercising the right of freedom of expression and information;
    (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
    (c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
    (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
    (e) for the establishment, exercise or defense of legal claims.
  1. The data subject shall have the right to obtain from the controller (StepOver GmbH – Otto-Hirsch-Brücken 17 – D – 70329 Stuttgart) restriction of processing where one of the following applies:
    (a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
    (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
    (c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
    (d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
  2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
  3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. 

The controller (StepOver GmbH – Otto-Hirsch-Brücken 17 – D – 70329 Stuttgart) shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

  1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller (StepOver GmbH – Otto-Hirsch-Brücken 17 – D – 70329 Stuttgart), in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
    (a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
    (b) the processing is carried out by automated means.
  2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
  3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others. 
  1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller (StepOver GmbH – Otto-Hirsch-Brücken 17 – D – 70329 Stuttgart) shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
  2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
  3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
  4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
  5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
  6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest. 

You are entitled to file a complaint with your competent data protection authority at any time. If you would like to assert your right to lodge a complaint, you may do so with the following authority:
Baden-WĂĽrttemberg

State Commissioner for Data Protection and Freedom of Information in Baden-WĂĽrttemberg:
Dr Stefan Brink
Postfach 10 29 32
D–70025 Stuttgart
or:
Königstraße 10a
D–70173 Stuttgart

Tel.: +49 (0)711/615541-0
Fax: +49 (0)711/615541-15

Email: poststelle@lfdi.bwl.de

Shopping Cart
Scroll to Top