Arc- Privacy Policy - Step V Studio

Arc. - Privacy Policy

1) Introduction and Contact Information of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data is any data by which you can be personally identified.

1.2 The controller responsible for data processing on this website, in accordance with the General Data Protection Regulation (GDPR), is Vasilii Gurev, Step V Studio, Plittersdorf Rödereckring 83, 76437 Rastatt, Germany, Tel.: +4917621129718, Email: vasilii.gurev@stepv.studio. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

1.3 The controller has appointed a Data Protection Officer, who can be reached as follows: "Vasilii Gurev, Rödereckring 83, 76437, Rastatt, +4917621129718, contact@stepv.studio.

2) Data Collection When Visiting Our Website

2.1 When you use our website for informational purposes only, i.e., if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to the server of our website (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you:

Our visited website
Date and time of access
Amount of data sent in bytes
Source/reference from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be shared or used for other purposes. However, we reserve the right to review the server log files retrospectively if specific evidence points to unlawful use.

2.2For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the "https://" string and the lock symbol in your browser line

3) Hosting & Content Delivery Network

To host our website and display the page content, we use a provider that provides its services either itself or through selected subcontractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers

We have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and to prevent unauthorized disclosure to third parties.

4) Contacting Us

4.1WhatsApp Business

We offer visitors to our website the opportunity to contact us via the WhatsApp messaging service from WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We use the "Business version" of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (e.g., a placed order), we store and use the mobile phone number you used on WhatsApp as well as your first and last name if provided, pursuant to Art. 6(1)(b) GDPR, to process and respond to your inquiry. Based on the same legal basis, we may ask you via WhatsApp to provide additional data (order number, customer number, address, or email address) to assign your inquiry to a specific transaction.

If you use our WhatsApp contact for general inquiries (e.g., about our services, availability, or our website), we store and use the mobile phone number you used on WhatsApp and your first and last name if provided, pursuant to Art. 6(1)(f) GDPR, based on our legitimate interest in efficiently and promptly providing the requested information.

Your data will always be used exclusively to respond to your inquiry via WhatsApp. It will not be shared with third parties.

Please note that WhatsApp Business has access to the address book of the mobile device we use for this purpose and automatically transfers phone numbers stored in the address book to a server of the parent company, Meta Platforms Inc., in the USA. We use a mobile device for our WhatsApp Business account that stores only the WhatsApp contact details of users who have also contacted us via WhatsApp.

This ensures that each person whose WhatsApp contact details are stored in our address book has already consented to the transmission of their WhatsApp phone number from the address books of their chat contacts by accepting WhatsApp's terms of use on their device for the first time, in accordance with Art. 6(1)(a) GDPR. The transmission of data from users who do not use WhatsApp and/or have not contacted us via WhatsApp is excluded.

For the purpose and scope of data collection and further processing and use of the data by WhatsApp, as well as your rights in this regard and settings options for protecting your privacy, please refer to WhatsApp's privacy policy: [https://www.whatsapp.com/legal/?eea=1#privacy-policy](https://www.whatsapp.com/legal/?eea=1#privacy-policy)

As part of the above processing, data may be transferred to servers of Meta Platforms Inc. in the USA.

For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

4.2In the course of contacting us (e.g., via contact form or email), personal data is collected. The specific data collected when using a contact form is evident from the respective contact form. This data is stored and used solely for the purpose of responding to your inquiry or contacting you and the related technical administration.

The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted after the final processing of your inquiry, provided that no legal retention obligations oppose this.

5) Website Functionalities

5.1 Youtube

This website uses plugins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transmitted to: Google LLC, USA.

When you visit a page on our website that contains such a plugin, your browser establishes a direct connection to the provider's servers to load the plugin. In the process, certain information, including your IP address, is transmitted to the provider.

If the playback of embedded videos is started via the plugin, the provider also uses cookies to collect information about user behavior, compile playback statistics, and prevent misuse.

If you are logged into a user account with the provider during your visit, your data will be directly associated with your account when you click on a video. If you do not wish to be associated with your account, you must log out before clicking the play button.

All the aforementioned processing, particularly the setting of cookies for reading information on the used device, is carried out only if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can revoke the consent granted at any time with effect for the future by deactivating this service in the "Cookie-Consent-Tool" provided on the website.

5.2 Adobe Fonts (Typekit)

This site uses so-called web fonts provided by the following provider to ensure a consistent display of fonts: Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA.

When you access a page, your browser loads the required web fonts into its browser cache to display texts and fonts correctly and establishes a direct connection to the provider's servers. In this process, certain browser information, including your IP address, is transmitted to the provider.

The processing of personal data in connection with the connection to the font provider is only carried out if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can revoke the consent granted at any time with effect for the future by deactivating this service via the "Cookie-Consent-Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

5.3 Google Web Fonts

This site uses so-called web fonts provided by the following provider to ensure a consistent display of fonts: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transmitted to: Google LLC, USA.

5.4 Google reCAPTCHA

On this website, we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transferred to: Google LLC, USA. For the visual design of the captcha window, the provider uses "Google Fonts", i.e., fonts loaded from Google via the internet. No additional information beyond the ones mentioned above, which are already transmitted to Google through the functionality of ReCaptcha, is processed in this regard.

The service checks whether an input is made by a natural person or abusively by machine and automated processing, and blocks spam, DDoS attacks, and similar automated harmful accesses. To ensure that an action is performed by a human and not by an automated bot, the provider collects the IP address of the used device, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits these to the provider's servers for evaluation.

The legal basis is our legitimate interest in determining individual responsibility on the internet and preventing misuse and spam in accordance with Art. 6 para. 1 lit. f GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European data protection level.

5.5 Zoom

For conducting online meetings, video conferences, and/or webinars, we use this provider: Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA.

The provider processes various data, the scope of which depends on what data you provide before or during participation in an online meeting, video conference, or webinar. Your data as a communication participant is processed and stored on the provider's servers. This may include, in particular, your registration data (name, email address, phone number (optional), and password) and session data (topic, participant IP address, device information, description (optional)).

Additionally, image and audio contributions from participants as well as voice inputs in chats may be processed.
For the processing of personal data necessary for the performance of a contract with you (this also applies to processing operations required for the execution of pre-contractual measures), Art. 6 para. 1 lit. b GDPR serves as the legal basis. If you have given us consent to process your data, the processing is based on Art. 6 para. 1 lit. a GDPR. You can revoke a given consent at any time with effect for the future.
Otherwise, the legal basis for data processing during the execution of online meetings, video conferences, or webinars is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in the effective execution of the online meeting, webinar, or video conference.

We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

6) Rights of the Data Subject

6.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) against the controller regarding the processing of your personal data, with the specific legal basis for the conditions of exercise being referenced:

Right of access according to Art. 15 GDPR;
Right to rectification according to Art. 16 GDPR;
Right to erasure according to Art. 17 GDPR;
Right to restriction of processing according to Art. 18 GDPR;
Right to notification according to Art. 19 GDPR;
Right to data portability according to Art. 20 GDPR;
Right to revoke consent granted according to Art. 7 para. 3 GDPR;
Right to lodge a complaint according to Art. 77 GDPR.

6.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE AFFECTED DATA. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU CAN EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE AFFECTED DATA FOR DIRECT MARKETING PURPOSES.

7) Duration of Storage of Personal Data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing, and – if applicable – additionally by the respective statutory retention period (e.g., commercial and tax retention periods).

If personal data is processed based on explicit consent in accordance with Art. 6 para. 1 lit. a GDPR, the affected data will be stored until you revoke your consent.

If there are statutory retention periods for data that is processed within the scope of legal or quasi-legal obligations based on Art. 6 para. 1 lit. b GDPR, this data will be routinely deleted after the retention periods have expired, provided it is no longer required for contract fulfillment or contract initiation and/or there is no legitimate interest on our part in continuing the storage.

If personal data is processed based on Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object under Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If personal data is processed for direct marketing purposes based on Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object under Art. 21 para. 2 GDPR.

Unless otherwise stated in the specific information provided in this declaration regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.