Privacy Policy

Last updated: 26 June 2026

This Privacy Policy explains how Steppaffid GmbH ("we", "us", "our") collects, uses, and protects your personal data when you visit steppaffid.life or contact us. We process data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

Steppaffid GmbH
Torstraße 102, 10119 Berlin, Germany
Email: [email protected]
Phone: +49 30 5564 8921
Register: HRB 198452 B · VAT ID DE298456731

2. Data We Collect

• Contact form data: name, email, phone, project details, and budget range when you submit an enquiry.
• Communication data: content of emails and phone correspondence.
• Technical data: IP address, browser type, device information, pages visited, and referral source.
• Cookie data: consent preferences stored locally (see Cookie Policy).

3. Legal Basis for Processing

• Art. 6(1)(a) GDPR — Consent: contact form submission, optional analytics cookies, marketing communications where applicable.
• Art. 6(1)(b) GDPR — Contract: processing necessary to respond to enquiries and perform design services.
• Art. 6(1)(f) GDPR — Legitimate interests: website security, fraud prevention, and service improvement.
• Art. 6(1)(c) GDPR — Legal obligation: tax and commercial record-keeping requirements.

4. How We Use Your Data

We use personal data to respond to enquiries, deliver design services, issue invoices in EUR, improve our website, comply with legal obligations, and — with your consent — send relevant studio updates.

5. Data Retention

Enquiry data is retained for 24 months unless a business relationship is established, in which case data is kept for the duration of the relationship plus statutory retention periods (typically 6–10 years for commercial records under German law).

6. Data Sharing

We do not sell personal data. We may share data with: IT hosting providers (EU-based), email service providers, accounting professionals, and fit-out partners when necessary for project delivery — all bound by data processing agreements under Art. 28 GDPR.

7. International Transfers

We prefer EU-based processors. Where data is transferred outside the EEA, we ensure appropriate safeguards such as Standard Contractual Clauses.

8. Your Rights

Under GDPR you have the right to: access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restrict processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), and withdraw consent at any time without affecting prior lawful processing.

To exercise your rights, contact [email protected]. We respond within 30 days.

9. Right to Complain

You may lodge a complaint with the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

10. Security

We implement appropriate technical and organisational measures including HTTPS encryption, access controls, and staff training on data protection.

11. Changes

We may update this policy periodically. Material changes will be indicated by updating the date above.