Launch offer -24% ends in 00000000
ELEVSTEP
Mein Shop

Privacy Policy

Last updated: September 2026

1. Who is responsible

The controller responsible for processing personal data in our online store ElevStep is:

Glowy Zone
Owner: Vincent Thron
Hollandweg 9
25421 Pinneberg
Germany
Phone: +49 179 4400036
Email: elevstep.official@gmail.com

We are based in the European Union, so the EU General Data Protection Regulation (GDPR) applies to how we handle your data, wherever you live. We have not appointed a data protection officer because we are not legally required to.

2. Legal bases

We only process personal data where there is a legal basis. The most important ones are:

  • Art. 6(1)(a) GDPR: your consent, for example to non-essential cookies
  • Art. 6(1)(b) GDPR: performing a contract with you or taking steps before a contract, for example your order or your customer account
  • Art. 6(1)(c) GDPR: legal obligations, for example tax and commercial record-keeping
  • Art. 6(1)(f) GDPR: legitimate interests, for example running the store securely and preventing fraud

Storing or accessing information on your device, for example through cookies, is governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG): without your consent, we only do this where it is strictly necessary for the service you request.

3. Store platform and hosting: Shopify

Our store runs on the e-commerce platform Shopify. The contracting party for merchants in Europe is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify hosts the store, provides the cart and checkout, and processes the resulting data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

When you visit the store, technically necessary data is processed, in particular your IP address, the date and time of access, the page requested, browser and device information and the page you came from. This is needed to deliver the store and keep it secure (Art. 6(1)(f) GDPR).

Shopify may transfer data to affiliated companies such as Shopify Inc. in Canada and to sub-processors in other countries, including the United States. Canada is covered by an adequacy decision of the European Commission. Transfers to the United States are based on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can find more in Shopify's privacy policy.

4. Cookies and consent

On your first visit, our cookie banner asks which cookies and similar technologies you accept. There are four categories:

  • Strictly necessary: for the cart, checkout, login, security and remembering your cookie choice. We set these without consent because the store cannot work without them (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).
  • Personalisation: these cookies remember, for example, what you did in the store to tailor your next visit.
  • Analytics: Shopify Analytics shows us how the store is used, for example which pages are viewed.
  • Marketing: Shopify and its partners may use this data to improve advertising and to show you ads on other websites.

We only set personalisation, analytics and marketing cookies with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We have not added any third-party advertising or tracking pixels such as Meta (Facebook, Instagram), TikTok or Google Ads.

You can change or withdraw your choice at any time with effect for the future: Open cookie settings.

5. Orders

When you place an order, we process the data we need to fulfil it: your name, delivery and billing address, email address, optionally your phone number, the items ordered, payment and shipping information, and your messages to us about the order. The legal basis is Art. 6(1)(b) GDPR. Without this data we cannot conclude the contract.

To prevent fraud, Shopify automatically screens orders for irregularities (Art. 6(1)(f) GDPR).

German tax and commercial law requires us to keep order and invoice records for up to ten years (Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code). After that, they are deleted.

6. Customer account

You can order without a customer account. If you choose to create one, we store your email address, your addresses and your orders so that you can view them (Art. 6(1)(b) GDPR). To sign in, Shopify sends a code to your email address. We delete your account on request; statutory retention obligations remain unaffected.

7. Payment

Payments are processed through Shopify Payments. Your payment details go directly to Shopify and the payment service providers involved; we never receive your full card details. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for fraud prevention. Depending on the payment method, the following are also involved:

  • Cards (Visa, Mastercard, Maestro, American Express, UnionPay): payment data is passed to the card schemes and payment providers as far as needed to process the payment.
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna processes your data as an independent controller and may check your identity and creditworthiness. Klarna's privacy notice is shown when you choose Klarna at checkout.
  • Apple Pay: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
  • Google Pay: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Shop Pay: a payment service provided by Shopify. If you save your details for faster checkout or enter your mobile number for it, Shopify creates a Shop account for you, which is subject to Shop's own terms and privacy policy.

8. Shipping and order tracking

To deliver your order, we pass your name and delivery address to the carrier and, where the goods are shipped directly by our supplier, to that supplier. We only share your email address or phone number where this is needed for delivery or you have agreed to it (Art. 6(1)(b) or (a) GDPR). Our supplier and carriers may be located outside the EU, including in China. Such transfers take place because they are necessary to perform the contract with you (Art. 49(1)(b) GDPR).

On our order tracking page, you can look up your tracking number with the external service 17TRACK. The number is then sent to 17TRACK, and that provider's privacy policy applies. Using it is optional.

9. Contacting us by email, phone or contact form

When you contact us, we process the details you give us (such as your name, email address, order number and message) to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, and Art. 6(1)(f) GDPR otherwise. Shopify forwards messages from the contact form to our email inbox, which is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We delete requests once they have been dealt with, unless retention obligations apply.

10. Emails

We do not send newsletters. We send you emails about your order, such as the order confirmation and shipping updates (Art. 6(1)(b) GDPR). If you enter your email address at checkout but do not complete your order, Shopify may send you a reminder about your cart (Art. 6(1)(f) GDPR). You can object to this at any time using the link in the email or by writing to us.

11. Fonts from Google Fonts

Our store loads the fonts "Bricolage Grotesque" and "Manrope" from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To do this, your browser sends your IP address to Google when a page loads; the data may be transferred to the United States. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a consistent and readable presentation of the store.

12. How long we keep data

We only keep personal data for as long as we need it for the relevant purpose. After that we delete it, unless statutory retention obligations require longer storage, in which case we restrict its processing. Data processed on the basis of your consent is kept until you withdraw your consent.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). A simple email to elevstep.official@gmail.com is enough.

Right to object: where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany. If you live in the United Kingdom, you can also contact the Information Commissioner's Office (ico.org.uk). If you live in Canada, you can also contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We do not sell your personal information.

14. Automated decisions

We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR. If you pay with Klarna, Klarna may carry out an automated credit check; details are in Klarna's privacy notice.

15. Changes

We update this privacy policy when our store or the law changes. The version published here applies.