Data protection

1) Information about the collection of personal data and contact details of the person responsible

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how your personal data is processed when you use our website. Personal data is any data by which you can be personally identified.

1.2 The data controller for this website within the meaning of the General Data Protection Regulation (GDPR) is Msstep. The controller of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the data controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string "https://" and the padlock in the address bar of your browser.

2) Data collection when you visit our website

If you use our website solely for informational purposes, that is to say without registering or otherwise providing us with information, we only collect data that your browser transmits to our server (the so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary to display the website to you: - The website visited - Date and time of access - Amount of data transmitted in bytes - Source/referrer from which you arrived at the page - Browser used - Operating system used - IP address used (if necessary in anonymized form). The processing takes place in accordance with Article 6, paragraph 1, letter f of the GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not transmitted or used in any other way. However, we reserve the right to subsequently check the server log files if there are concrete indications of illegal use. By using our website, you (the visitor) agree that third parties may process your IP address to determine your location for currency conversion. You also agree that this currency may be stored in a session cookie in your browser (a temporary cookie that is automatically deleted when you close your browser). We do this so that the chosen currency remains selected and consistent while browsing our website, so that prices can be converted into your (the visitor's) local currency.

3) Cookies

To make visiting our website more enjoyable and to enable the use of certain features, we use so-called cookies on various pages. These are small text files that are stored on your device. Some cookies we use are deleted at the end of the browser session, i.e., after you close your browser (so-called session cookies). Other cookies remain on your device and enable us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies). When cookies are placed, they collect and process certain user information, such as browser and location data and IP address values, on an individual basis. Persistent cookies are automatically deleted after a certain period. In some cases, cookies are used to simplify the ordering process by saving settings (for example, remembering the contents of a virtual shopping cart for a later visit to the website). If personal data is also processed by the individual cookies we use, the processing takes place in accordance with Article 6, paragraph 1, letter b of the GDPR, either for the performance of the contract, or in accordance with Article 6, paragraph 1, letter f of the GDPR to protect our legitimate interests as best as possible, namely the functionality of the website and a user-friendly and effective design of the page display.

We may collaborate with advertising partners to make our website more attractive to you. To this end, cookies from partner companies are also stored on your hard drive when you visit our website (third-party cookies).

If we collaborate with the aforementioned advertising partners, you will be informed individually and separately in the following paragraphs about the use of such cookies and the extent of the data collected.

You can configure your browser so that you are informed about the placement of cookies and that you can decide individually whether to accept them or to exclude the acceptance of cookies for specific cases or in general. Each browser differs in the type and the way in which cookie settings are managed. How to change your cookie settings is described in the help menu of the respective browser. You can find this for the relevant browser via the following links:
Internet Explorer: https://support.microsoft. com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-allow-und-reject
Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Safari: https://support.apple.com/kb/ph21411?locale=de_DE
Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Please note that the functionality of our website may be limited if you do not accept cookies.

4) Contact When you contact us (for example via a contact form or email), personal data is collected.

You can see which data is collected in the case of a contact form in the relevant contact form. This data is stored and used exclusively to answer your question or to contact you and for the associated technical administration.
The legal basis for the processing of the data is our legitimate interest in responding to your request in accordance with Article 6(1)(f) of the GDPR. If your contact is aimed at concluding an agreement, the additional legal basis for the processing is Article 6(1)(b) of the GDPR. Your data will be deleted after your request has been processed, insofar as this can be inferred from the circumstances.

5) Data processing when opening a customer account and for contract processing In accordance with Article 6 (1) (b) of the GDPR, personal data is collected and processed if you provide it to us for the performance of a contract or the opening of a customer account. You can see which data is collected in the relevant input forms. Your customer account can be deleted at any time by sending a message to the above address of the controller. We retain and use the data provided by you for the performance of the contract. Once the contract has been fully performed or your customer account has been deleted, your data will be blocked in accordance with the statutory retention periods for tax and commercial law purposes and deleted upon the expiry of these periods.

6) Use of the Facebook connection single sign-on procedure
You can create a customer account on our website or log in via the social plug-in "Facebook Connect" from the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA ("Facebook"). Register using the so-called single sign-on technology if you have a Facebook profile. You can recognize the "Facebook Connect" social plug-ins on our website by the blue button with the Facebook logo and the text "Log in with Facebook", "Connect with Facebook", "Sign in with Facebook", or "Log in with Facebook".

If you visit a page on our website that contains such a plug-in, your browser establishes a direct connection to Facebook's servers. The content of the plug-in is transmitted directly by Facebook to your browser and integrated into the page by your browser. Through this integration, Facebook receives information that your browser has visited the relevant page on our website, even if you do not have a Facebook profile or are not currently logged in to Facebook. This information (including your IP address) is transmitted directly from your browser to a Facebook server in the USA and stored there. This data processing takes place in accordance with Article 6, paragraph 1, letter f) of the GDPR, based on Facebook's legitimate interest in displaying personalized advertisements based on browsing behavior.

By using the "Facebook Connect" button on our website, you also have the option to log in or register on our website using your Facebook user credentials. Only if you expressly consent to this in accordance with Article 6, paragraph 1, letter a) of the GDPR, prior to the registration process and through an accompanying notification regarding data exchange with Facebook, do we receive the general and publicly accessible information stored in your profile, depending on your personal data protection settings on Facebook. This information includes user ID, name, profile picture, age, and gender.

We would like to point out that, following changes to Facebook's privacy rules and terms of use, your profile photos, your friends' user IDs, and your friends list may also be transferred if you have marked them as 'public' in your privacy settings on Facebook. Data transmitted by Facebook is stored and processed by us to create a user account with the necessary details, provided you have given consent for this on Facebook (title, first name, last name, address details, country, email address, date of birth). Conversely, based on your consent, we may transfer data (for example, information about your browsing or purchasing behavior) to your Facebook profile.

The consent granted can be withdrawn at any time by sending a message to the responsible person named at the beginning of this statement.

Facebook Inc., based in the USA, is certified under the US-European Data Protection Agreement "Privacy Shield", which guarantees compliance with the level of data protection applicable in the EU.

The purpose and scope of data collection and the further processing and use of the data by Facebook, as well as your rights and settings options to protect your privacy, can be found in Facebook's privacy statement: http://www.facebook.com/policy.php. If you do not want Facebook to directly link the data collected via our website to your Facebook profile, you must log out of Facebook before visiting our website. You can also completely block the loading of Facebook plugins using browser add-ons, for example "Adblock Plus" (https://adblockplus.org/de/).

7) Use of your data for direct marketing

Sign up for our email newsletter
If you sign up for our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing all other data is voluntary and serves to enable us to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an email newsletter if you have explicitly confirmed to us that you agree to receive newsletters. We will then send you a confirmation email asking you to confirm that you wish to receive newsletters in the future by clicking on a link.

By clicking on the confirmation link, you give us permission to use your personal data in accordance with Article 6, paragraph 1, sub a of the GDPR. When you sign up for the newsletter, we store your IP address, as provided by your Internet Service Provider (ISP), as well as the date and time of registration, so that we can trace any potential misuse of your email address later. The data we collect when you sign up for the newsletter is used exclusively for advertising purposes via the newsletter. You can unsubscribe from the newsletter at any time via the link in the newsletter or by sending a message to the contact person mentioned above. After your unsubscription, your email address will be immediately removed from our newsletter mailing list.

8) Data processing for order processing

8.1 The personal data we collect is transferred to the carrier responsible for delivery in the context of contract processing, to the extent necessary for the delivery of the goods. We transfer your payment details to the engaged credit provider in the context of payment processing, to the extent necessary for payment processing. When we use payment service providers, we will explicitly inform you of this below. The legal basis for the transfer of the data is Article 6(1)(b) of the GDPR.
8.2 In order to fulfill our contractual obligations towards our customers, we cooperate with external shipping partners. We transfer your name and delivery address to a shipping partner selected by us, solely for the purpose of delivering the goods, in accordance with Article 6(1)(b) of the GDPR.

8.3 Use of payment service providers (payment service providers)
- Amazon Pay

If you choose the payment method "Amazon Pay", the payment will be processed via the payment service provider Amazon Payments Europe sca, 5 Rue Plaetis, L-2338 Luxembourg (hereinafter: "Amazon Payments"), to whom we will transmit the data you provided during the ordering process, together with the information about your order, in accordance with Article 6, paragraph 1, letter b) of the GDPR. Your data will be transmitted to the payment service provider Amazon Payments exclusively for the processing of payments and only to the extent necessary for that purpose. You can find more information about Amazon Payments' data protection regulations at the following internet address: https://pay.amazon.com/de/help/201751600
- PayPal
When you pay via PayPal, credit card via PayPal, direct debit via PayPal or – if offered – 'purchase on account' or 'payment in installments' via PayPal, we provide your payment data to PayPal (Europe) Sarl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). The transfer takes place in accordance with Article 6(1)(b) of the GDPR and only to the extent necessary for payment processing. PayPal reserves the right to perform a credit check for the payment methods: credit card via PayPal, direct debit via PayPal or – if offered – 'purchase on account' or 'payment in installments' via PayPal.

For this purpose, your payment details may be passed on to credit bureaus in accordance with Article 6(1)(b) of the GDPR. f) GDPR on the basis of PayPal's legitimate interest in establishing your creditworthiness. PayPal uses the result of the credit check regarding the statistical probability of a payment default to determine whether the relevant payment method is offered. The credit report may contain probability values (so-called score values). To the extent that score values are included in the result of the credit report, these are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things, but not exclusively, address data. More information on data protection, including the credit bureaus used.
You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the processing of payments in accordance with the agreement.

- SOFORT
If you choose the payment method "SOFORT", the payment will be processed via the payment service provider SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (hereinafter "SOFORT"), to whom we will transmit the data provided by you during the ordering process together with the information about your order in accordance with Article
b of the GDPR. Sofort GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden). Your data will only be transmitted to the payment service provider SOFORT for the purpose of payment processing and only to the extent necessary for this. You can find more information about SOFORT's data protection regulations at the following internet address: https://www.klarna.com/sofort/datenschutz
- Stripe: If you choose a payment method from the payment service provider Stripe, the payment will be processed by Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland. We will provide the data you provide during the ordering process, including your passport details (name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number), to Stripe Payments Europe Ltd in accordance with Article 6, paragraph 1, letter b of the GDPR.

-Stripe

If you choose a payment method from the payment service provider Stripe, the payment will be processed by the payment service provider Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland. We will transmit the data provided by you during the ordering process and the transmission data for your order (name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number) to you in accordance with Article 6, paragraph 1, letter b of the GDPR.

Your data will be used exclusively for the processing of the payment by the payment service provider transmitted to you, Stripe Payments Europe Ltd, and only to the extent necessary.

You can find more information about data protection at Stripe at https://stripe.com/de/terms.

In order to offer you Klarna payment methods, we may transmit your personal data, such as contact and order details, to Klarna during the ordering process. Klarna will then use this data to verify your eligibility for Klarna payment methods and to tailor the payment methods to you. Your submitted personal data is processed in accordance with Klarna's privacy statement.

9) Rights of the data subject 9.1 Applicable data protection legislation grants you extensive rights (right to information and intervention) vis-à-vis the controller regarding the processing of your personal data, about which we inform you below:

- Right to information in accordance with Article 15 GDPR: In particular, you have the right to information regarding your personal data processed by us, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be transferred, the planned retention period or the criteria for determining the retention period, the existence of a right to correction, deletion, restriction of processing, objection to the processing, complaint to a supervisory authority, the origin of your data if it was not obtained from you by us, the existence of automated decision-making, including profiling, and relevant information regarding the logic involved and the scope and intended effects of such processing on you, as well as your right to information regarding the safeguards of Article 46 GDPR if your data are transferred to third countries;

- Right to rectification in accordance with Article 15 GDPR: Article 16 GDPR: You have the right to immediate correction of inaccurate data concerning you and/or completion of your incomplete data stored by us; - Right to erasure in accordance with Article 17 GDPR: You have the right to request the erasure of your personal data if the requirements of Article 17(1) GDPR are met. However, this right does not apply, in particular if the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;

- Right to restriction of processing in accordance with Article 16 GDPR: You have the right to restrict the processing of your personal data while the accuracy of your data, which you dispute, is being verified; if you request the erasure of your data due to unlawful data processing, reject this request and instead request the restriction of the processing of your data; if you need your data to assert, exercise or defend legal claims after we no longer need this data, after the purpose has been achieved; or if you have objected for reasons relating to your specific situation, as long as this is still the case and it is not clear whether our justified reasons outweigh yours;

- Right to information in accordance with Article 19 GDPR: If you have invoked the right to correction, deletion, or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed about this correction or deletion of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.

- Right to data portability in accordance with Article 18 GDPR: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format or to request that it be transferred to another controller, if this is technically feasible; - Right to withdraw your consent in accordance with Article 7(3) GDPR: You have the right to withdraw your consent to the processing of your data at any time with future effect. In the event of withdrawal, we will immediately delete the data in question, unless further processing can be based on a legal basis for processing without consent.

- Right to lodge a complaint in accordance with Article 77 GDPR: If you believe that the processing of your personal data is in violation of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you reside, work or where the alleged infringement took place, without prejudice to other administrative or judicial remedies.

9.2 Right of objection: If we process your personal data on the basis of our compelling legitimate interests, you have the right to object to this processing at any time with future effect on grounds relating to your specific situation.

If you exercise your right to object, we will stop processing the data in question. However, further processing is reserved if we can demonstrate compelling grounds for the processing that outweigh your interests, fundamental rights and freedoms, or if the processing serves to establish, exercise or defend legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. You may object as described above. If you exercise your right to object, we will cease processing the relevant data for direct marketing purposes.

10) Retention period of personal data The retention period of personal data depends on statutory retention periods (e.g. retention periods under commercial and tax law). After the expiry of the period, the relevant data will be routinely deleted, unless they are no longer necessary for the performance or conclusion of the agreement and/or we have no legitimate interest in further retention.