BigStep
Privacy policy
1. Controller and contact
This notice describes the processing of personal data when visiting BigStep. Controller: Emilio Loscher. Postal address: Rheingoldallee 54, 15834 Rangsdorf, Germany. Email for privacy enquiries: Contact@bigsteptravel.com.
2. Website delivery and hosting
To deliver the website, the server processes connection data, including your IP address, requested address, time of access and technical browser information. The purpose is to provide the website reliably and securely. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The website and our self-hosted Mailcow email service run on our server in Falkenstein, Germany. Hetzner provides the infrastructure as a processor. A data processing agreement under Article 28 GDPR was concluded with Hetzner on 18 October 2026.
The Apache access log records connection addresses, request time, requested path, HTTP status, referrer and browser identification. The error log records technical errors. Apache logs are rotated daily and retain up to 14 archived log files in addition to the current file. These logs serve operation and security (Article 6(1)(f) GDPR). Technical container logs of the mail service are rotated by size: up to three files of approximately 10 MB per container are retained; when the limit is reached, the oldest file is removed. Rotated files are compressed. This is a volume-based limit, not a fixed number of days. No automatic website or mailbox backups, Hetzner backups or snapshots are currently enabled. Therefore there are no separately retained backup copies of contact enquiries in this setup.
3. Cookies, analytics and local content
The current website does not use its own analytics tools, advertising pixels or tracking cookies. Language selection is determined by the URL and is not saved in cookies or browser storage. Images, fonts, Instagram previews and the interactive map are served locally. Optional Instagram embeds are described separately below.
3a. Optional Instagram reels
We offer selected public Instagram reels using an optional embed. Provider for the European region: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The purpose is to display our travel videos directly on this website. Before you select “Agree & load Instagram reel”, there is no Instagram iframe, embed script or connection to Meta for the preview; its image is served locally. You can use the rest of the website without loading Instagram.
Loading a reel transmits your IP address, browser and device information and interactions with the embedded content to Meta. Meta may store or read cookies and similar identifiers and associate your activity with an Instagram account, especially if you are logged in. Meta can use these data for its own purposes, including personalisation, measurement and advertising, as described in its privacy policy. We do not receive access to Meta’s individual visitor profiles.
The legal basis for the optional loading and related transfer is your consent under Article 6(1)(a) GDPR and, for access to or storage on your device, Section 25(1) TDDDG. Consent is separate for each reel and is not stored in cookies or browser storage. You can withdraw it at any time using “Withdraw consent & close reel” above the embed. The iframe is then removed and no further content is loaded through it. Withdrawal does not affect the lawfulness of processing before withdrawal and cannot retrieve data already transmitted or delete cookies set by Meta. Manage those cookies using your browser or Meta settings.
Meta may also process data in the USA or other countries outside the EEA. The applicable countries, retention periods and transfer safeguards depend on Meta’s processing and are described in its current privacy policy. We do not control Meta’s retention or onward transfers. Please review that policy before consenting; it explains Meta’s legal bases, international transfers and how to exercise your rights directly with Meta. Opening an ordinary Instagram link instead takes you away from our website to Instagram.
3b. Contact form and email
When you submit the contact form, we process your name, email address, enquiry type, subject and message to answer your request. The form sends these details over HTTPS to our server, which forwards them through a TLS-protected SMTP connection to Contact@bigsteptravel.com. This is a shared alias that delivers the message to Silvia and Emilio. Email is hosted through our Mailcow service at Hetzner in Falkenstein. The website does not save messages in a separate database or send automatic copies to visitors.
The legal basis is Article 6(1)(b) GDPR for enquiries related to a potential contract and Article 6(1)(f) GDPR for other correspondence, based on our legitimate interest in answering enquiries. Required fields are marked in the form; without them we cannot reply through it. Providing the information is voluntary. You can also contact us directly by email.
For spam protection, we use a hidden form field and a rate limit. A randomly salted, keyed hash derived from your connection address and an attempt count are kept only in server memory for up to one hour. We do not store the raw address in this rate-limit record, and there is no third-party CAPTCHA. The basis is our legitimate interest in protecting the form against abuse (Article 6(1)(f) GDPR). Technical web and mail-server logs are described separately under hosting.
General contact enquiries are deleted from the relevant mailboxes no later than six months after the enquiry is concluded, unless statutory retention duties or the establishment, exercise or defence of legal claims require longer retention. Contractual and accounting records are retained for the applicable statutory periods. This is managed by the mailbox holders; the website does not automatically delete emails.
4. External links and social media
Our website links to external services, including Instagram, TikTok, YouTube, MTP, Heymondo and GetYourGuide. Opening one of these links takes you to the respective provider, which processes data under its own privacy policy. Some links include affiliate identifiers. BigStep does not operate tracking software for these links on this website.
If you contact us by email or through a social platform, we process the information you provide to answer your enquiry. The legal basis is Article 6(1)(b) GDPR for enquiries about a potential contract and Article 6(1)(f) GDPR for other correspondence. The platform also processes data under its own responsibility, potentially outside the EEA. We delete general correspondence within six months after the enquiry is concluded, subject to statutory retention duties and the protection of legal claims. For correspondence within a social platform, deletion of our copy does not control the provider’s own copies, security logs or retention duties. Instagram, TikTok, YouTube and MTP process data according to their own privacy notices, including any international transfers; the applicable details are provided by the service you use. You can use email instead of a social platform.
5. Your rights
Where the legal requirements are met, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
To exercise your rights, contact Contact@bigsteptravel.com. You may also complain to a data protection supervisory authority, particularly in the EU country where you live, work or believe an infringement has occurred. Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg: https://www.lda.brandenburg.de/
6. Required data and automated decisions
Connection data is technically necessary to load this website. You are not required to contact us or open external links. BigStep does not use your visit for automated decision-making with legal effects or for profiling.
7. Changes to this notice
This notice must be updated when the website or its data processing changes. Last updated: 18 October 2026.