1. Controller and processor roles
Basal, CVR/VAT 41543582, Ved Lunden 4, 8230 Åbyhøj, Denmark, is the controller for information about StepGiant’s customers, visitors and contacts. Contact us at support@stepgiant.com or +45 43 17 17 13.
When a business uses StepGiant to process its clients’ information, including booking data, Basal acts as a processor on that business’s instructions under a separate data processing agreement.
2. Data we process
- Account and business details, including names, contact and login details and company registration information
- Subscription, invoicing and payment-related information; full card details are normally handled by the payment provider
- Support requests and communications
- Technical data including IP address, device information, security and activity logs
- Content, instructions and outputs submitted through AI-assisted features
- Booking data such as client contact details, requested service and appointment time when processed for a StepGiant customer
3. Purposes and legal bases
- Providing, administering and securing the service and handling subscriptions and support: performance of the contract
- Invoicing, bookkeeping and legal compliance: legal obligation
- Preventing misuse, faults and security incidents and improving stability: legitimate interests
- Sending operational notices and booking reminders: performance of the contract; marketing is sent only with valid consent or another lawful basis
- Optional analytics, personalisation and marketing technologies: consent
4. AI-assisted features
When you use the AI builder, your instructions, business information and generated content may be processed to provide the feature. Do not enter sensitive personal or confidential information that is not necessary.
Before publication, the AI providers, processing locations, retention and training use must be confirmed. StepGiant does not use AI to make decisions producing legal or similarly significant effects about you.
5. Recipients and subprocessors
We may use providers for hosting, databases, communications, email and SMS, analytics, support, AI and payments. Where they are processors, they may process data only on documented instructions.
A current list of specific subprocessors, processing locations and roles must be inserted before publication. Payment providers may act as independent controllers for parts of payment processing.
6. Transfers outside the EU/EEA
Where data is transferred outside the EU/EEA, we use a valid transfer mechanism, such as the European Commission’s Standard Contractual Clauses, and supplementary safeguards where required. Specific transfers and safeguards must be confirmed in the final policy.
7. Retention
We retain data only as long as required for its purpose, the contract or law. Accounting records are generally retained for five years after the relevant financial year. Exact periods for account, booking, support, security, AI and marketing data must be confirmed before publication.
9. Security
We use appropriate technical and organisational measures to protect data against loss, misuse, unauthorised access and alteration. Access is limited by need, and security incidents are handled under applicable law.
10. Your rights
- Access to personal data we process about you
- Correction of inaccurate information
- Erasure or restriction where the conditions apply
- Data portability for certain information
- Objection to legitimate-interest processing and always to direct marketing
- Withdrawal of consent without affecting earlier lawful processing
11. Complaints and contact
Contact support@stepgiant.com to exercise your rights or ask a question. You may also complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, at datatilsynet.dk.
12. Changes
We update this policy when our processing or the law changes. We will provide appropriate notice of material changes.