1. Controller
The controller responsible for data processing on this website is:
StudiStep, Im Zollhafen 18, 50678 Köln, Germany
Email: info@studistep.com · Phone: +49 (0) 221 96267727
[If a data protection officer has been appointed: insert contact details here.]
2. Principles
The protection of your personal data is important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, the German Federal Data Protection Act (BDSG), and the German Telecommunications-Telemedia Data Protection Act (TDDDG)). Personal data is any information relating to an identified or identifiable natural person.
3. Hosting
This website is hosted by an external service provider (host) in Germany/the EU. The data collected on this website is stored on the host's servers. The legal basis is our legitimate interest in providing the service securely and efficiently (Article 6 (1) (f) GDPR). A data processing agreement (Article 28 GDPR) is in place with the host.
4. Access Data / Server Log Files
When the website is accessed, information transmitted by your browser is automatically collected (server log files):
- browser type and version
- operating system used
- referrer URL
- date and time of the request
- anonymized or shortened IP address
This data serves the technical provision, security and stability of the service (Article 6 (1) (f) GDPR) and is not merged with other data sources.
5. Cookies & Local Storage
We use only technically necessary cookies or local storage – for example for the session (login), your language selection and the display theme (light/dark). These are required for operation (Article 6 (1) (f) GDPR or Section 25 (2) TDDDG) and do not require consent. We only set consent-based cookies after your express consent. For details, see Cookie Settings.
6. Contacting Us
When you contact us via the contact form, email or telephone, we process your information (name, contact details, request) to handle your inquiry. The legal basis is Article 6 (1) (b) GDPR (pre-contractual measures) or (f) (legitimate interest in responding).
7. Registration & User Account
To use the customer area, you can create an account. In doing so, we process: first and last name, email address, telephone number and a password chosen by you (which is stored exclusively in encrypted/hashed form). The purpose is to provide the account and the services; the legal basis is Article 6 (1) (b) GDPR (performance of a contract).
8. Participation in the Lottery
When you participate in our notary-supervised lottery, we process the numbers you have selected as well as the chosen degree program, linked to your account. The purpose is to carry out the lottery (Article 6 (1) (b) GDPR).
9. Uploaded Documents
In the customer area, you can upload documents (e.g. supporting documents). These are stored with access protection and used exclusively to process your request (Article 6 (1) (b) GDPR). They are only shared insofar as this is necessary for the provision of services (e.g. to universities, authorities) and you have consented.
10. Embedded Videos
Videos on this website are delivered directly from our own servers (self-hosting). No data is transmitted to third-party providers such as YouTube in the process.
11. Recipients & Processors
Your data is only transmitted to third parties if this is necessary for the performance of the contract, you have consented, or we are legally obliged to do so. Processors used (e.g. for hosting) are contractually bound in accordance with Article 28 GDPR.
12. Transfer to Third Countries
Insofar as a transfer to a third country (e.g. to Turkey for on-site consulting) is necessary for the provision of services, this is carried out only in compliance with the requirements of Articles 44 et seq. GDPR.
13. Retention Period
We store personal data only for as long as is necessary for the stated purposes or as long as statutory retention periods (e.g. under commercial and tax law) apply. The data is deleted thereafter.
14. Your Rights
You have the right at any time to:
- access (Article 15 GDPR)
- rectification (Article 16 GDPR)
- erasure (Article 17 GDPR)
- restriction of processing (Article 18 GDPR)
- data portability (Article 20 GDPR)
- object to processing (Article 21 GDPR)
- withdraw consent given (with effect for the future)
To exercise these rights, an informal message to info@studistep.com is sufficient.
15. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence or the place of the alleged infringement.
16. SSL/TLS Encryption
For security reasons, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the "https://" in the address bar of your browser.
This Privacy Policy is current as of 2026. We reserve the right to amend this policy in order to adapt it to changed legal situations or features.