PRIVACY POLICY

1. General Information and Scope

With this privacy policy, we inform you about which personal data we collect when you visit our website www.solea-pro.de, contact us, use the solea® software, or purchase the solea® system from us, and what we use this data for.

solea® is a brand of CNC-STEP GmbH & Co. KG. This privacy policy applies to the website www.solea-pro.de. For the website www.cnc-step.de, its own privacy policy applies.

2. Definitions

We use the terms of the General Data Protection Regulation (GDPR). The most important ones are:

Personal data (Art. 4 No. 1 GDPR) is any information relating to an identified or identifiable natural person, such as name, email address, IP address, or online identifiers. Photos can also contain personal data.
Processing (Art. 4 No. 2 GDPR) is any handling of personal data, such as collection, storage, use, transmission, or erasure.
Controller (Art. 4 No. 7 GDPR) is the person who, alone or jointly with others, decides on the purposes and means of processing.
Processor (Art. 4 No. 8 GDPR) is the person who processes personal data on behalf of and according to the instructions of the controller, for example, an IT service provider.
Third party (Art. 4 No. 10 GDPR) is any body other than the data subject, the controller, the processor, and the persons who are authorized to process data under their direct responsibility.
Consent (Art. 4 No. 11 GDPR) is any freely given, informed, and unambiguous expression of will by which you consent to the processing of your data.
Profiling (Art. 4 No. 4 GDPR) is any automated processing used to evaluate or predict personal aspects, such as interests or behavior.

3. Controller

The controller responsible for data processing on this website is:

CNC-STEP GmbH & Co. KG
Managing Director: Michael Peters
Siemensstraße 13-15
47608 Geldern
Germany

Phone: +49 2831 91021-20
Fax: +49 2831 91021-99
Email: info@solea-pro.de

Further information can be found in the Legal Notice.

4. Data Protection Officer

We have appointed an external data protection officer. You can reach them at:

Jota Rechtsanwälte PartG mbB
Schiffenberger Weg 61
35394 Gießen
Phone: 0641 97 27 668
Email: datenschutz@cnc-step.de

5. Your Rights

You have the following rights against us regarding your personal data:

Right of access (Art. 15 GDPR),
Right to rectification (Art. 16 GDPR),
Right to erasure (Art. 17 GDPR),
Right to restriction of processing (Art. 18 GDPR),
Right to data portability (Art. 20 GDPR),
Right to object to processing (Art. 21 GDPR), and
Right to withdraw consent given with effect for the future (Art. 7 Para. 3 GDPR). The lawfulness of the processing carried out until the withdrawal remains unaffected. An informal notification, for example by email, is sufficient for the withdrawal. You can also withdraw consent for cookies and comparable technologies at any time via the "Cookie Settings" in the footer of this website.

To exercise your rights, a message to the contact details mentioned in Section 3 or 4 is sufficient.

Right to object according to Art. 21 GDPR

If processing is based on Art. 6 Para. 1 lit. e or lit. f GDPR, you can object at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that outweigh your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If your data is processed for the purpose of direct marketing, you can object to this at any time; this also applies to profiling associated with it. Your data will then no longer be used for this purpose.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to complain to a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
https://www.ldi.nrw.de

A list of all supervisory authorities can be found on the website of the Federal Commissioner for Data Protection and Freedom of Information (www.bfdi.bund.de).

6. Recipients, Service Providers, and Transfer to Third Countries

We use external service providers, for example for hosting, email, shipping, and payment processing. Insofar as they process data on our behalf, we have concluded data processing agreements with them according to Art. 28 GDPR. Furthermore, we only pass on your data if you have consented (Art. 6 Para. 1 lit. a GDPR), if this is necessary for the performance of a contract or for the implementation of pre-contractual measures (Art. 6 Para. 1 lit. b GDPR), if we are legally obliged to do so (Art. 6 Para. 1 lit. c GDPR), or if we have a legitimate interest in doing so (Art. 6 Para. 1 lit. f GDPR).

In principle, we process your data within the European Union or the European Economic Area. Individual services described in this policy may transfer data to third countries, in particular to the USA or the United Kingdom. We point this out for the respective service and name the basis for the transfer, such as an adequacy decision by the EU Commission according to Art. 45 GDPR (for the USA, the EU-US Data Privacy Framework) or appropriate safeguards according to Art. 46 GDPR.

7. Storage Duration and Erasure

We store personal data only as long as it is necessary for the respective purpose or as long as you have consented. We specify concrete storage periods for the individual processing operations. If the purpose no longer applies or you withdraw your consent, we delete the data, provided that no legal retention obligations prevent this. In this case, we restrict the processing, meaning the data is blocked and not used for other purposes.

Legal retention obligations exist in particular for 10 years according to §§ 147 Para. 1 AO, 257 Para. 1 No. 1 and 4, Para. 4 HGB (for example books, accounting records, invoices) and for 6 years according to § 257 Para. 1 No. 2 and 3, Para. 4 HGB (commercial and business letters).

8. Provision of the Website

8.1 Hosting

This website is hosted by ALL-INKL.COM - Neue Medien Münnich. The hoster processes all data generated when visiting the website on our behalf. A data processing agreement exists with them. The legal basis is our legitimate interest in the secure and reliable provision of the website (Art. 6 Para. 1 lit. f GDPR).

8.2 Server Log Files

Every time the website is accessed, the server automatically collects information transmitted by your browser and stores it in so-called server log files. These are:

Referrer URL (the previously visited page),
Name and URL of the accessed page,
Date and time of access as well as time zone difference to GMT,
Browser type, version, and language,
Operating system used,
Amount of data transferred and access status (HTTP status code)

We need this data to deliver the website correctly, to ensure the functionality and security of our systems, and to ward off or investigate attacks. A merger with other data sources does not take place. The legal basis is Art. 6 Para. 1 lit. f GDPR; our legitimate interest lies in the technically error-free and secure provision of the website. The log files are deleted after 190 days, unless they are needed longer to investigate a specific security incident.

8.3 SSL or TLS Encryption

For security reasons, this website uses SSL or TLS encryption. You can recognize an encrypted connection by "https://" in the address line and by the lock symbol in your browser. When encryption is activated, the data you transmit to us cannot be easily read by third parties.

9. Cookies and Consent Management

9.1 What are cookies?

Cookies are small text files that your browser stores on your end device. They can contain information that enables recognition of your end device. Session cookies are deleted when you close your browser; permanent cookies remain stored for the specified duration. In addition to cookies, we sometimes use comparable technologies, such as tracking pixels or local storage; the following notes apply accordingly to these.

We distinguish between:

Technically necessary cookies, without which the website or functions expressly requested by you (for example shopping cart, login, storage of your cookie settings) do not work,
Statistics cookies, with which we evaluate how the website is used,
Marketing cookies, with which advertising is measured or tailored to your interests, and
External media cookies, which are set when loading third-party content (for example videos or maps).

9.2 Legal Basis

We set technically necessary cookies on the basis of § 25 Para. 2 No. 2 TDDDG; the subsequent data processing is based on Art. 6 Para. 1 lit. f GDPR or, insofar as it serves the performance of a contract, on Art. 6 Para. 1 lit. b GDPR. We set all other cookies and comparable technologies only with your consent according to § 25 Para. 1 TDDDG and Art. 6 Para. 1 lit. a GDPR, which you grant via our cookie banner. You can adjust or withdraw your consent at any time via the "Cookie Settings" in the footer of the website.

9.3 Consent Management with Borlabs Cookie

To manage your consents, we use the WordPress plugin Borlabs Cookie. It stores your selection in a cookie in your browser so that we can take it into account on your next visit and prove your consent. The legal basis is Art. 6 Para. 1 lit. c GDPR in conjunction with Art. 7 Para. 1 GDPR as well as § 25 Para. 2 No. 2 TDDDG.

9.4 Overview of Cookies Used

Cookie	Service	Category	Purpose	Duration
borlabs-cookie	Borlabs Cookie	necessary	Stores your cookie settings	1 year
PHPSESSID	Website	necessary	Identifies your session	Session
wordpress_test_cookie	WordPress	necessary	Checks if your browser accepts cookies	Session
wordpress_logged_in_, wordpress_sec_	WordPress	necessary	Enables login and use of the customer account	14 days
wp-settings-[ID], wp-settings-time-[ID]	WordPress	necessary	Stores settings of logged-in users	1 year
_ga, _ga_[ID]	Google Tag Manager	Statistics	Distinguishes users and sessions for reach measurement	up to 2 years
_ga, _ga_[ID]	Google Analytics 4	Statistics	Distinguishes users and sessions for reach measurement	up to 2 months
Google-Ads	Google Ads	Marketing	Conversion measurement and remarketing	up to 2 years
YSC	YouTube	external media	Playback of embedded videos	Session up to 6 months
NID	Google Maps	external media	Display of embedded maps	6 months
ausgezeichnet.org	ausgezeichnet.org	external media	Display of the rating seal	Session

10. Contacting Us

If you contact us by email, telephone, or via our contact form, we process the data you provide (for example name, company, email address, telephone number, and your message) in order to process your request and possible follow-up questions. We do not pass on this data without your consent.

The legal basis is Art. 6 Para. 1 lit. b GDPR if your request is related to a contract or serves the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of requests (Art. 6 Para. 1 lit. f GDPR).

We delete the data as soon as the request has been finally processed, but at the latest after one year if no contractual relationship arises from it. If a contract is concluded, the legal retention periods apply (Section 7).

Please note that unencrypted emails can be viewed by third parties during transmission. Therefore, please do not send us confidential information by unencrypted email.

11. Free solea® Software and User Account

To use the free solea® software, registration with a user account is required. We process the following data: name, email address, telephone number, address, and information about your business.

We use this data to set up and manage your account, to provide you with the software and updates, to manage your usage authorization, to support you in using the software, and to inform you about security-relevant updates and significant changes. The legal basis is Art. 6 Para. 1 lit. b GDPR (contract on the use of the software).

We will only send you information and offers about the solea® system, such as the machine or the shoeing material, by email if you have separately consented to this (Art. 6 Para. 1 lit. a GDPR). You can withdraw this consent at any time.

During registration, you can also voluntarily consent to the software transmitting pseudonymized usage data to us (see Section 12).

Storage duration. We store your account data as long as your user account exists. You can have your account deleted at any time.

After deleting the account, we delete your data with the following exceptions:

We keep business correspondence and documents relevant to accounting for the legal periods of 6 or 10 years (Art. 6 Para. 1 lit. c GDPR, see Section 7).
We keep name, company, address, and information on which software versions we provided to you and when for up to 10 years after the provision of the last version. This data is blocked and used exclusively to inform you about security defects that become known later and to be able to defend against legal claims, in particular from product liability (Art. 6 Para. 1 lit. f GDPR).

12. Data Processing by the solea® Software

Data you record in the software. Information on horse owners and horses as well as photos of the hooves that you record in the software are stored exclusively locally on your computer and are not transmitted to us. You are responsible for this data yourself, in particular for informing the horse owners. If we gain access to such data in individual cases, for example as part of support or remote maintenance, we process it only according to your instructions on the basis of a data processing agreement according to Art. 28 GDPR.

Technically necessary data. When starting and during use, the software transmits data required for its operation: software version, license or account ID, time of the query, and technical error reports without the content of your projects. We use this data to check your usage authorization, provide updates, fix errors, and detect security defects. The legal basis is Art. 6 Para. 1 lit. b GDPR, insofar as this is necessary for the fulfillment of the usage contract, otherwise our legitimate interest in the secure and error-free operation of the software (Art. 6 Para. 1 lit. f GDPR); access to your device is permissible in this respect according to § 25 Para. 2 No. 2 TDDDG. We store this data for 12 months.

Usage data. To improve the software, it records how it is used, for example which functions are used, how long individual work steps take, how often milling is performed, which shoeing types are selected, and how frequently the software is used. Depending on your decision, this happens in one of two forms:

Pseudonymized – only with your consent. If you consented during registration or when starting the software for the first time, the usage data is assigned to a pseudonymous ID, which we store separately from your account data. This allows us to evaluate usage over a longer period of time. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG). Consent is voluntary; the software can be used without restriction without it. You can withdraw it at any time with effect for the future in the software settings. After that, the software only transmits anonymous usage data.
Anonymous – without consent. If you have not consented, the software transmits exclusively anonymous usage data. These are only assigned to a random ID that is newly generated for each session and then discarded. Neither license keys nor account or device IDs are transmitted, and the IP address is not stored. A reference to your person is therefore not possible for us. You can also switch off this transmission in the software settings.

In both cases, the usage data does not contain any information on horse owners or horses, no hoof images, and no file or project names. We use them exclusively to improve and further develop the software and to understand its use as part of product monitoring. We generally evaluate them in summarized form. We do not use them for advertising and not to evaluate the way of working or performance of individual users or their employees. Only persons involved in the development of the software have access. The data is stored on Microsoft servers in the EU, with whom a data processing agreement exists.

We store pseudonymized usage data as long as your consent exists and your user account is active. If you withdraw your consent or your account is deleted, we delete the pseudonymized usage data or permanently remove the assignment to your ID so that only anonymous evaluations remain.

Your rights according to Section 5 also apply to the pseudonymized usage data. Since we store these separately from your account data, we may need information from your account for access or erasure in order to be able to assign your data (Art. 11 Para. 2 GDPR).

13. Online Shop, Customer Account, and Contract Fulfillment

Our offer is directed exclusively at entrepreneurs. When you order from us, request a quote, or create a customer account, we process the data required for this. This includes in particular name, company, address, email address, telephone number, if applicable VAT identification number, order and contract data, as well as payment data. We use this data to process the contract, including delivery, installation, instruction, support, warranty, and billing. The legal basis is Art. 6 Para. 1 lit. b GDPR; insofar as we are subject to legal retention obligations, Art. 6 Para. 1 lit. c GDPR.

The provision of the data marked as mandatory fields in the ordering process is required for the conclusion of the contract. Without this data, we cannot conclude the contract.

For delivery, we pass on the necessary data to the commissioned shipping or freight forwarding company, and for payment processing to the commissioned credit institution or the selected payment service provider.

We store the data of your customer account until you delete the account. We keep contract and invoice data for the legal periods (Section 7).

14. Payment Service Providers

14.1 PayPal

We offer payment via PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose this payment method, we transmit the data required for payment processing to PayPal, in particular first name, last name, address, email address, telephone number, as well as order amount and order number. The legal basis is Art. 6 Para. 1 lit. b GDPR; furthermore, we have a legitimate interest in secure and efficient payment processing (Art. 6 Para. 1 lit. f GDPR). You can alternatively choose other payment methods.

For certain payment methods, PayPal carries out a credit check on its own responsibility and transmits data to credit agencies for this purpose. We have no influence on this and only learn whether the payment is being carried out, rejected, or checked. Further information can be found in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

We store the payment data until the completion of the payment processing including any refunds and claims processing; after that, the legal retention periods apply.

14.2 Mollie

For further payment methods, we use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. If you choose one of these payment methods, we transmit the data required for payment processing to Mollie, in particular name, address, email address, order amount, currency, and order number. You enter your payment data, such as credit card or account data, during the ordering process; we do not receive these. Mollie forwards the data, as far as necessary, to the involved payment providers, card organizations, and banks.

The legal basis is Art. 6 Para. 1 lit. b GDPR; furthermore, we have a legitimate interest in secure and efficient payment processing (Art. 6 Para. 1 lit. f GDPR). Mollie processes the data, among other things, to fulfill its own legal obligations, such as fraud and money laundering prevention. Further information can be found in Mollie's privacy policy: https://www.mollie.com/de/privacy

We store the payment data until the completion of the payment processing including any refunds and claims processing; after that, the legal retention periods apply.

15. Google Services: Common Information

The services described in Sections 16 to 21 are offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This may involve a transfer of data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer takes place on the basis of the adequacy decision of the EU Commission (Art. 45 GDPR). You can view the current certification at https://www.dataprivacyframework.gov/list. Further information can be found in Google's privacy policy: https://policies.google.com/privacy

16. Google Tag Manager

We use the Google Tag Manager. With it, we manage the integration of other services (tags) on our website. The Tag Manager itself does not set cookies and does not evaluate usage data; however, when loading, your IP address is transmitted to Google. The services integrated via the Tag Manager are only triggered if you have consented to them. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG).

17. Google Analytics

With your consent, we use Google Analytics to statistically evaluate the use of our website and to improve our offer. Google Analytics sets cookies (see Section 9.4) and processes in particular information on the pages accessed, the duration of the visit, interactions, the device and browser used, and your approximate location. This data is assigned to a pseudonymous ID. IP addresses are not logged or stored in Google Analytics; however, they are processed for transmission and for approximate location determination.

The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG), which you can withdraw at any time via the cookie settings. The data is deleted after 2 months. A data processing agreement exists with Google. Further information: https://support.google.com/analytics/answer/6004245

18. Google Ads and Conversion Tracking

With your consent, we use Google Ads to draw attention to our offers and to measure the success of our advertisements (conversion tracking). If you reach our website via a Google ad, a cookie is set with which we and Google can recognize that you clicked on the ad and performed a specific action on our website. We only receive statistical evaluations and no information with which you can be personally identified.

As part of remarketing, Google can show you advertising for our offers on other websites. For this purpose, your usage data is assigned to pseudonymous user profiles.

The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG). Information on data use for advertising purposes by Google can be found at https://policies.google.com/technologies/ads

19. YouTube

We embed videos from the YouTube platform. The provider is Google (see Section 15). The videos are integrated via a two-click solution: Before activation, only a preview image is loaded from our server, and no data is transmitted to YouTube. Only when you activate a video or generally allow YouTube in the cookie banner is a connection to YouTube's servers established. In particular, your IP address, the page accessed, and device information are transmitted and cookies are set. If you are logged in to Google, YouTube can assign the data to your account.

The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG), which you can withdraw at any time via the cookie settings.

20. Google Maps

We use Google Maps to display maps, such as our directions. The provider is Google (see Section 15). The map is only loaded if you agree to this in the cookie banner or directly on the map. In particular, your IP address and information about the use of the map are transmitted to Google. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG).

21. Google Fonts

The fonts are only loaded from Google servers after your consent; in the process, your IP address is transmitted to Google. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG). Without consent, a standard font of your system is used.

22. Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). We use it to measure the effectiveness of our advertisements on Facebook and Instagram, to form target groups for advertisements, and to show visitors to our website advertising on these platforms (remarketing).

In particular, IP address, date and time, pages accessed and referrer URL, browser and device information, cookie and pixel ID, and your actions on the website (for example page views, requests, or orders) are processed. An extended data comparison, in which we transmit customer data such as email address or telephone number in encrypted (hashed) form to Meta, does not take place.

The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG), which you can withdraw at any time via the cookie settings. Without consent, the pixel is not loaded.

For the collection of data on our website and its transmission to Meta, we and Meta are joint controllers according to Art. 26 GDPR. We have concluded an agreement with Meta for this purpose (https://www.facebook.com/legal/controller_addendum). According to this, we are responsible for the lawful collection, in particular the obtaining of your consent; Meta is responsible for the further processing after the transmission and for the fulfillment of your data subject rights in this respect. However, you can also assert your rights against us.

Meta can transfer data to Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework; the transfer takes place on the basis of the adequacy decision of the EU Commission (Art. 45 GDPR). Meta stores the cookies for up to 90 days. Further information can be found in Meta's privacy policy (https://www.facebook.com/privacy/policy) and in your advertising settings at Meta.

23. Rating Seal from ausgezeichnet.org

With your consent, we integrate the rating seal from ausgezeichnet.org, which summarizes our customers' ratings. The provider is AUBII GmbH, Große Bleichen 21, 20354 Hamburg. When loading the seal, your IP address is transmitted to the provider. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG).

24. Newsletter

If you subscribe to our newsletter, we use your email address and any other voluntary information to regularly send you information about solea® and our offers. We use the double opt-in procedure: after registering, you will receive an email asking you to confirm your registration. We store the time of registration and confirmation as well as your IP address in order to be able to prove the registration.

By registering, you also consent to us measuring whether and when you open the newsletter and which links you click in order to improve our newsletter.

For distribution, we use Klick-Tipp from Klick-Tipp Limited, 15 Cambridge Court, 210 Shepherd’s Bush Road, London W6 7NJ, United Kingdom [check address]. The transfer to the United Kingdom is based on the adequacy decision of the EU Commission (Art. 45 GDPR) [check validity]. A data processing agreement exists with Klick-Tipp. Further information: https://www.klicktipp.com/de/datenschutzerklarung/

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). You can unsubscribe from the newsletter at any time, for example via the unsubscribe link in every email. We delete your data within 3 months of unsubscription. We retain proof of consent for up to 3 years in order to be able to defend ourselves against any claims (Art. 6 para. 1 lit. f GDPR).

25. Call Tracking

With your consent, we use a call tracking service. In this process, an individual phone number is displayed to you on our website and a cookie is set (see Section 9.4). If you call us at this number, we can assign the call to your website visit and see which pages you previously accessed. This allows us to process your request more quickly and measure the effectiveness of our advertising. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR, Section 25 para. 1 TDDDG). Without consent, our regular phone number will be displayed.

26. Objection to Promotional Emails

The use of contact data published within the scope of the legal notice obligation for the purpose of sending unsolicited advertising and information materials is hereby prohibited. We expressly reserve the right to take legal action in the event of unsolicited promotional information, such as spam emails.

27. Validity and Amendment of this Privacy Policy

We adapt this privacy policy when our website, our services, or legal requirements change. The version published on this page at the time applies.

As of: 10/14/2026