Privacy policy

NewStep UG (haftungsbeschränkt)
Thierschstraße 20
80538 München
Deutschland

Email: info@newstep-talents.com
Phone: +49 (0)174 8715132

We process personal data only where necessary to provide this site, communicate with you, take pre-contractual steps, perform a contract, comply with legal duties or pursue legitimate interests. The legal bases are Article 6(1)(b), (c), (f) and, where consent is requested, (a) GDPR.

This website is provided through ChatGPT Sites. OpenAI group infrastructure providers and Cloudflare may process IP address, time, requested URL, referrer, browser, device, operating system and security or error data to deliver and protect the site. The legal basis is our legitimate interest in secure and reliable operation.

More information: OpenAI Privacy Policy and Cloudflare Privacy Policy.

Language and display mode are stored locally in your browser. Our public website currently does not use its own analytics, advertising or marketing cookies. Stripe may use necessary technologies on its separately hosted checkout page under its own policy.

To improve the service, we record visited pages, time, a random session identifier, device type and, where available, the referring domain and UTM campaign parameters. We do not store full IP addresses or create cross-site advertising profiles. The identifier is held only in browser session storage. Do Not Track and Global Privacy Control signals are respected. Admin-area visits are excluded.

The legal basis is our legitimate interest in understanding and improving the reach, usability and conversion of the website under Article 6(1)(f) GDPR.

When you request the free checklist, we process your name, email address, delivery status, time and download activity to provide the requested resource and evaluate its use in aggregate. An optional consent to receive occasional tips and relevant offers is separate and is not required for the download. It can be withdrawn at any time.

When you contact us by email or through the contact form, we process your name, email address, talent field, selected plan, message, time and technical delivery data to respond and, where relevant, prepare or perform a contract.

For a free talent-profile application, we additionally process the public profile name, location, category-specific details, biography, goals, portfolio and social links, uploaded images and, where supplied, one PDF. Media stays protected in object storage until a decision is made. Personal update links are time-limited and allow only the applicant to edit their own application.

Review and publication of an accepted profile rely on the consents requested under Article 6(1)(a) GDPR. Acceptance is not guaranteed. Selected profile information and media become public only after approval in the protected admin area. Consent may be withdrawn for the future and a profile may be paused. Applications that are not accepted are normally deleted no later than six months after the review ends unless longer retention is required or agreed.

We use Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to send contact and transactional email. Resend processes sender and recipient addresses, message content, and delivery information. Transfers to the United States rely on safeguards provided in Resend’s data processing agreement, including EU Standard Contractual Clauses. More information: Resend Privacy Policy and Resend Data Processing Addendum.

We use Stripe for paid orders. Stripe may process contact, billing, payment, product, price, tax, device and fraud-prevention data.

After payment confirmation, Stripe sends technical order and status information to us through a secured webhook. We store the order number, Stripe references, plan, amount, payment status and processing status. Through the personal project questionnaire, we process content, goals, design preferences, share links and any images or documents uploaded voluntarily. Draft answers are stored so the questionnaire can be continued. The legal basis is performance of the contract.

Direct uploads are held temporarily in the protected object storage of the website, made available to NewStep Talents for project work and removed after confirmed transfer to the internal project folder or no later than the intended 30-day temporary retention period, unless longer storage is agreed or legally required. Clearly labelled test-copy submissions are stored separately as test data and are not treated as orders.

Full card or bank details are not stored on our servers. More information: Stripe Privacy Policy.

When you use our order, withdrawal or cancellation functions, we store your contact and contract information, declaration, timestamp and reference number in the website database. This is required to process and document your request.

To create profiles, websites, branding or social content, we process the text, media, links, professional information and preferences you provide. Publication is limited to the agreed scope. If content includes other people, you must have the required rights and permissions.

Talents may voluntarily allow NewStep Talents to use approved profile content and images for organic features on the official NewStep social-media channels. This permission is not required for a talent profile.

Profile linking and name or image credits can be selected separately. Individual images can be excluded even when the general permission is active. We store the selected settings, consent version and time of the latest change so that the choice can be respected and documented.

These settings can be changed or withdrawn for the future at any time in the protected talent area. Withdrawal does not affect the lawfulness of processing before withdrawal. Existing posts will be reviewed after withdrawal and, where technically and organisationally possible, adjusted or removed.

Recipients can include hosting, infrastructure, payment, email, domain and technical providers. Transfers outside the EEA take place only on an adequacy decision, EU Standard Contractual Clauses or another lawful basis.

Data is retained only as long as needed for its purpose. Unfinished talent upload sessions are valid for seven days and are then cleaned up regularly. Media belonging to an accepted profile remains stored while the profile is published. Rejected applications and their media are normally deleted no later than six months after review.

Temporary project-onboarding uploads are deleted after transfer to the internal project folder and additionally carry a 30-day deletion deadline. Contract, payment and invoice data is retained for statutory commercial and tax periods. Withdrawal and cancellation records are retained for the contract term and relevant limitation or evidence periods. Hosted sites are normally archived for 60 days after termination before deletion, unless continuation or transfer is agreed.

Subject to legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent for the future and complain to a supervisory authority. Contact info@newstep-talents.com. Our competent authority is the Bavarian State Office for Data Protection Supervision, www.lda.bayern.de.

Paid contracts are generally concluded only with adults or with the approval or representation of a guardian. We do not make decisions producing legal or similarly significant effects solely by automated means. Stripe may use its own automated fraud-prevention processes.

We update this policy when our website, providers or legal requirements change. The version published here applies.