Skip to main content

In seven cities. In stock at yours.

StegStadt

Privacy notice

Last updated: 1 September 2026

This notice explains which personal data are processed when you visit this website and what rights you have. The German version is the binding one.

1. Controller

Steg & Stadt Handels GmbH, Kölner Straße 214, 40227 Düsseldorf, Germany.
Telephone: +49 211 4790 220, email: datenschutz@steg-und-stadt.de

2. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, in a data centre in Frankfurt am Main. When you open a page, the server processes technically necessary access data: IP address, date and time, the URL requested, the volume of data transferred, the referrer and details of your browser and operating system. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the site. These data are deleted after 30 days at the latest. A data processing agreement under Article 28 GDPR is in place with Vercel, including the EU standard contractual clauses for any transfer to the USA.

3. Storage in your browser

We set no advertising or analytics cookies and embed no tracking services. So that the site works, we store the following in your browser’s local storage:

  • the shop you chose,
  • the contents of your bag and your wishlist,
  • your two-hour holds, with their code and expiry time,
  • a noted collection slot,
  • your choice in the cookie notice.

These entries stay on your device. They are not transmitted to us and not combined with other data. The legal basis is section 25(2) no. 2 TDDDG, because the storage is strictly necessary for the service you have expressly requested. You can delete it at any time by clearing this site’s data in your browser; your bag and your holds disappear with it.

4. Two-hour holds

When you hold a size, our server checks the request against the stock dataset shipped with this website and issues a four-character code and an expiry time. No personal data are collected or stored in the process: we ask for no name, no email address and no payment details, and the hold itself is kept solely in your browser. No customer account is created and nothing is recorded in a shop.

5. Questions to a shop

The form on the “Shops” page lets you send us a question. It transmits your name, email address, the shop you chose and your message. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and otherwise Article 6(1)(a) GDPR on the basis of your consent. As this is a demonstration website, the message is discarded once the entries have been checked: it is neither stored nor sent. In live operation we would delete an enquiry six months after it had been dealt with.

6. Maps from OpenStreetMap

On the “Shops” page you first see only a sketch drawn locally in your browser. A map from the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, is loaded only when you click “Load the map”. Your IP address is transmitted to their servers in the process. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG, which you give by clicking and can withdraw at any time with future effect by reloading the page.

7. Fonts

The Rethink Sans and Inter typefaces are served from our own server together with the page. There is no connection to Google Fonts and no data are transmitted to third parties.

8. Recipients

Apart from the hosting provider named above and — after your consent — OpenStreetMap, we pass no data to third parties. Data are disclosed to public authorities only where we are legally obliged to do so.

9. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20), as well as the right to object to processing based on legitimate interests (Article 21). Consent once given may be withdrawn at any time with future effect. Please write to datenschutz@steg-und-stadt.de.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

10. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR.

11. Changes to this notice

We update this notice when the website or the legal situation changes. The version published here applies.