Privacy Policy

Last updated: 01/10/2026

1. Overview

The protection of your personal data is of central importance to us. This privacy policy informs you in accordance with Art. 13 and 14 GDPR about which personal data we process when you visit www.step7.at or use our services, on what legal basis and for how long.

2. Data Controller (Art. 13 para. 1 lit. a GDPR)

Step7 Solution GmbH Traunfeldstrasse 58a, 4050 Traun, Austria E-mail: office@step7.at Phone: +43 664 4111854 VAT ID: ATU82394115, Company Register: FN 657793 v, Regional Court Linz

For data protection inquiries, please contact: office@step7.at

3. Data Processed, Purposes and Legal Bases (Art. 13 para. 1 lit. c, e GDPR)

3.1 Website access and technical log data

When you access our website, the following data is automatically stored in server logs: IP address (anonymized after 7 days), date and time of access, URL accessed, data volume transferred, browser type and operating system, HTTP status code.

Purpose: Ensuring technical operation, detection and prevention of misuse. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure operation). Storage period: 7 days, then deletion or complete anonymization.

3.2 Contact form

When you use our contact form, we process: name, e-mail address, phone number (optional), selected topic and your message.

Purpose: Processing your inquiry and getting in touch with you. Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 para. 1 lit. f GDPR (legitimate interest in processing inquiries). Storage period: Inquiries are retained for 3 years (statutory retention obligations pursuant to UGB); thereafter deletion.

4. Cookies

We use only technically necessary cookies that are strictly required for the operation of the website (e.g. language setting). These cookies do not require consent pursuant to applicable telecommunications law.

We do not use analytics cookies, tracking cookies or marketing cookies. No data is transmitted to advertising platforms or third-party analytics services.

5. AI-Supported Processing

5.1 This website

The operation of www.step7.at involves no AI processing. Your entries in the contact form and the server logs are processed exclusively on our own servers in Austria and are not passed to any AI service.

5.2 Our products

For the products we develop, this does not apply across the board. Part of the AI functionality runs on our own physical hardware within our own network: a server in Germany is in operation, and our own installation in an Austrian data centre is being set up. Two functions of Komiona currently also involve a service provider in the USA:

automatic appointment recognition from uploaded calendar documents,
machine translation of dynamic content.

For these, the content concerned is transmitted to Anthropic Ireland, Limited (the "Claude" service) as a processor. This is the contracting party designated by the provider's terms for customers in the European Economic Area. Processing may also take place in the USA, by Anthropic PBC as a sub-processor; point 7 states the basis for this.

The details - in particular the consent we obtain separately before a document is uploaded, the legal basis and the deletion periods - are set out in the privacy policy of the respective product and in the application's consent dialog.

We are working to move these two functions to our own hardware as well. This section will be changed once that migration is complete - not before.

6. Recipients of Data / Processors (Art. 13 para. 1 lit. e GDPR)

We do not generally pass on your personal data to third parties. Data is only shared:

with processors whom we have contractually bound pursuant to Art. 28 GDPR and who act exclusively according to our instructions: e-mail delivery infrastructure for notifications about contact inquiries (processed within the EU) and, for the product functions named under point 5.2, Anthropic Ireland, Limited (Ireland), with sub-processing including in the USA;
where we are legally obliged to do so (Art. 6 para. 1 lit. c GDPR);
where it is necessary to assert, exercise or defend legal claims.

No data is passed on for advertising purposes or to analytics platforms.

7. International Data Transfers (Art. 13 para. 1 lit. f GDPR)

The data collected via this website - server logs and contact inquiries - is processed exclusively on our own servers in Austria. To that extent, no transfer to countries outside the European Economic Area (EEA) takes place.

For the product functions named under point 5.2, processing may take place in the USA. The transfer is based on the European Commission's Standard Contractual Clauses under Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (controller to processor) and Module Three (processor to processor). They are incorporated in Section I.1 of the provider's Data Processing Addendum (version of 24 February 2025) and are thereby deemed executed between the parties; that addendum forms part of the contract under Section C of the provider's Commercial Terms (version of 17 June 2025) (Art. 46 para. 2 lit. c GDPR).

A copy of these safeguards, together with our transfer impact assessment, can be requested at office@step7.at. We keep both on file as a dated version.

8. Storage Period (Art. 13 para. 2 lit. a GDPR)

We store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations:

Server logs: 7 days
Contact inquiries: 3 years (UGB retention obligation)
Contract data: 7 years (accounting obligations pursuant to Austrian tax and commercial law)

After expiry of the respective period, data is deleted or anonymized so that no personal reference can be established.

9. Your Rights (Art. 13 para. 2 lit. b-d GDPR)

You have the following rights under GDPR, which you can exercise at any time by contacting office@step7.at:

Access (Art. 15 GDPR): Confirmation of whether and what data we process.
Rectification (Art. 16 GDPR): Correction of inaccurate or incomplete data.
Erasure (Art. 17 GDPR): Deletion of your data, provided no statutory retention obligations apply.
Restriction (Art. 18 GDPR): Restriction of processing under certain conditions.
Data portability (Art. 20 GDPR): Provision of your data in a common, machine-readable format.
Objection (Art. 21 GDPR): Objection to processing based on legitimate interests.
Withdrawal (Art. 7 para. 3 GDPR): Withdrawal of given consent at any time with effect for the future.

You also have the right to lodge a complaint with the Austrian Data Protection Authority:

Datenschutzbehoerde (Austrian Data Protection Authority) Barichgasse 40-42, 1030 Vienna, Austria E-mail: dsb@dsb.gv.at Web: www.dsb.gv.at

10. Security Measures (Art. 32 GDPR)

We implement technical and organizational measures in line with the state of the art to protect your data. These include: encrypted data transmission (TLS/HTTPS), access restrictions, regular security reviews and data backup concepts. The systems of this website are within our physical access and area of responsibility.

11. No Automated Decision-Making

We do not make decisions based solely on automated processing pursuant to Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

12. Data Protection for Minors

Our website is not directed at children under 14 years of age. We do not knowingly collect personal data from minors. Should such data have been inadvertently submitted to us, we will delete it immediately upon becoming aware of it.

13. Changes to This Policy

We reserve the right to update this privacy policy in response to technical or legal changes. The current version is always available at www.step7.at/en/datenschutz. In case of material changes, we will notify you by means of a notice on the home page.