privacy policy

DATA PROTECTION POLICY

GORENS NEGOCIOS, S.L. hereby informs you that we will process your data under Regulation (EU) 2016/679, on data protection (GDPR), of 27 April, and Spanish Organic Law 3/2018, of 5 December, on data protection and digital rights.

 

In this privacy policy, we will describe how and why we collect your data, what we do with it, with whom we share it, how we protect it, and your options in terms of the processing of your data.

This policy applies to the processing of your data collected by the company to provide its services, namely the sale of apparel clothing, and to send you information on our activities through our newsletter.

If you accept the terms of this policy, you are agreeing to us processing your data in the ways described hereunder.

 

CONTACT

The data controller is:

Identity: GORENS NEGOCIOS, S.L.,

C.I.F. / Tax ID Nº: B-86583473,

Address: Avenida De La Onu Nº 9 – 3ºB,

28936 M, Madrid.

E-mail: contact@saintsteven.com

Should you have any questions or queries, please contact us at contact@saintsteven.com

 

KEY PRINCIPLES

We have always been committed to the highest quality standards in our services; this includes processing your data securely and transparently. Our key principles are:

  • Legality: We will only collect your data for specific, explicit, and legitimate purposes.
  • Data minimisation: We will only collect personal data that is strictly relevant and necessary for the aforementioned purposes.
  • Purpose limitation: We will only collect your data for the declared purposes and under your wishes.
  • Accuracy: We will ensure that your data is accurate and up to date.
  • Data Security: We implement the appropriate risk-proportionate technical and organisational measures to guarantee that your data is not harmed, for example through unauthorised disclosure or access, accidental or illegal destruction, accidental loss, alteration, or any other form of illegal processing.
  • Access and rectification: You may access or rectify your data whenever you wish.
  • Storage limitation: We retain your data legally and appropriately: for as long as you are a registered user; for as long as it takes to handle the purchase of our products; until you unsubscribe from our newsletter; for the period described in the terms and conditions in the case of competition; for as long as is legally required; or until you restrict the processing of your data.
  • International transfers: Should your data be transferred outside the EU/EEA, it will be protected appropriately.
  • Third parties: Any third-party access to your data or transfer of your data to third parties will be carried out by the applicable laws and regulations and with the appropriate contractual guarantees.
  • Direct marketing and cookies: We comply with applicable laws regarding advertising and cookies.

 

COLLECTION AND PROCESSING OF PERSONAL DATA

Depending on the product, we will need to process different kinds of data. These include:

  • Identifying information (for example, your name, surname, telephone number, e-mail, etc.)
  • Financial and transactional information (card details, purchases, orders, returns, etc.)
  • Login, location, and browsing details (e.g. browsing from a mobile)
  • Commercial information (through our newsletter)
  • Your tastes and preferences

Depending on how you interact with our platform, we will process your data for the following purposes:

  1. User registration: To identify you as a user and grant you access to the platform. You may cancel your user account by contacting us through our Customer Service department.
  2. To respond to requests or complaints.
  3. Purchase of products: To complete the purchase process and receive payment for the products you purchase, regardless of the payment method used. To keep you informed of the progress of your shipment. For this purpose, we must transfer some basic contact details to the relevant shipping company.
  4. Loyalty program: To register you on our loyalty program so that you can earn points, with which you can obtain financial benefits and/or discounts on your purchases, and to send you information on new items, invitations to events, or promotions through our digital channels (SMS, website, app, and email).
  5. Advertising and marketing: To manage your subscription to our newsletter and to send you personalised information on our products through digital channels. For this purpose, we will analyse your customer profile to determine your preferences. You may unsubscribe from the newsletter at any time at no cost.
  6. When you participate in a promotional campaign, you give us permission to process the data you provide as part of the promotion and to communicate it through various media, such as social networks or the platform itself. For every promotion in which you participate, you will have access to the legal terms and conditions, which will contain more detailed information on the processing of your data.
  7. To analyse the use of our website and establish statistics.
  8. To publish photographs or images you have shared publicly on our website or our social media accounts, as long as you have given your consent.

 

We also collect data on your visit to our website automatically, as described in our Cookie Policy.

 

Whenever we request your data, we will inform you of which data we will collect and for which purpose. In general, we collect and process your data to:

  • Provide you with information on our products and services.
  • Provide our services.
  • Respond to your queries and requests.
  • Request feedback on the service at the point of sale.

LAWFUL BASIS

By the applicable data protection laws, your data may be processed in the following circumstances:

  • To fulfill contractual obligations and fulfill the purchase agreement by the terms of purchase.
  • To provide the services offered on the website under the terms that govern its use (legal notice, privacy policy, and cookies policy).
  • To attend to a legitimate interest not diminished by your privacy rights. We consider that we have a legitimate interest in dealing with your requests, queries, and/or incidents reported. We also have a legitimate interest in sending you advertisements relating to the products you have purchased.
  • To fulfill a legal obligation. This includes managing incidents relating to your order or the product/service acquired through the platform, fulfilling the purchase agreement, and exercising rights.

 

COMMUNICATION OF PERSONAL DATA

The processed personal data will only be communicated to third parties, in compliance with legal obligations.

 

During the period in which your data is processed, the company will not transfer your data unless legally required to do so.

DATA PROCESSORS

Saint Steven™ will have collaboration from third-party service providers who will have access to your data and will process said data in the name and representation of the company as a result of their service provision. Saint Steven™ follows very strict criteria when selecting its service providers to fulfill its obligations in terms of data protection, and it is committed to subscribing to the corresponding data protection agreement with them.

 

More specifically, Saint Steven™ will contract the service provision from third-party providers that are active, including but not limited to, in the following sectors: logistics services, legal guidance, provider accreditation, multi-disciplinary professional service companies, companies related to maintenance, companies providing technology services, companies providing IT services, physical security companies, instant messaging service providers, infrastructural maintenance and management companies and call centre service companies.

For the operation of the Website we currently use the following services, which may process data on our behalf: WordPress and WooCommerce (online store), WooPayments (powered by Stripe) and PayPal (payments), Omnisend (marketing emails and bag reminders, only with your consent), Google Analytics through Google Site Kit (website statistics, only with your consent), Meta Pixel (advertising measurement, only with your consent), Google advertising services (only with your consent), and an email delivery provider for order and account emails. The cookies and similar technologies these services use are listed in our Cookie Policy.

 

AI ASSISTANT (ATELIER)

Saint Steven offers an AI assistant called Atelier on its website. It helps you find products, choose a size, and get information about orders, shipping, returns and customer support. Atelier is an AI, not a person, and says so in the chat. You can always write to our team instead at contact@saintsteven.com.

Who provides it: Atelier is powered by an AI model from Anthropic PBC (United States). GORENS NEGOCIOS, S.L. is the data controller. Anthropic acts as our data processor: it processes your messages only to generate the replies, under its commercial terms and data processing terms.

What we process: The messages you type in the chat, the earlier messages of the same chat (up to the last 12) and the replies generated. To answer you, Atelier also receives information from our own store: products, prices, stock, shipping options and our policy pages. If you ask about an order and give the order number and the billing email, or if you are signed in to your account, Atelier receives limited details of that order (status, items, total, delivery and tracking) so that it can answer; information about other customers is never shared. Please do not type payment card details, passwords or sensitive information such as health data. Atelier cannot cancel, change or refund orders, and it does not take any decision that has legal or similarly significant effects on you.

Why and on what basis: (1) To provide the assistant and answer your questions about products and orders, which you request by using it, including pre-contractual and contractual queries (Article 6(1)(b) GDPR) and our legitimate interest in efficient customer support (Article 6(1)(f)). (2) To keep the service secure and prevent abuse and excessive use (Article 6(1)(f)). (3) To improve the website and the assistant using anonymous statistics (Article 6(1)(f)). We do not use the chat for advertising, profiling or marketing.

How it is handled and stored: Your chat is kept only in your browser tab (session storage) so you can continue it while you browse. It is removed from your device when you close the tab, and we do not keep a copy of the conversation on our servers. To improve the service we keep a minimal, anonymous record of each question: the date and hour, a topic (for example sizing or shipping), whether it could be answered, the number of messages in the chat, the products suggested, your optional rating (Yes or No) and, where possible, your last message after automatic removal of email addresses, links, phone and long numbers, order numbers, names and street addresses. This record contains no name, email address, IP address, account, cookie or device identifier, and messages that contain an order lookup are not kept. Raw records are deleted automatically after 30 days; only daily totals per topic and outcome, without any text, are kept for up to 13 months. Only authorised administrators of the website can see this information. To prevent abuse we briefly hold a one-way hash of your IP address (not the address itself) for 10 minutes, to limit the number of questions per visitor.

Third parties and international transfers: Your messages, and the store and order information needed to answer them, are sent over an encrypted connection to Anthropic, which may process them in the United States and other countries. Transfers outside the European Economic Area rely on appropriate safeguards, such as the standard contractual clauses approved by the European Commission contained in Anthropic's data processing terms. According to Anthropic's published terms, data sent through its API is not used to train its models by default and is retained only for the limited period needed to provide the service. That period depends on the model used and can be longer (up to two years) if Anthropic's automated safety systems flag a conversation. We do not sell your data and do not share the chat with anyone else, except service providers acting on our behalf and where the law requires it.

Security: The connection to the assistant is encrypted (HTTPS). The key that connects our website to Anthropic is stored on our server only and is never sent to your browser. Access to order information requires verification (order number and billing email, or signing in). The number of questions is limited to prevent abuse, and the anonymous records are protected behind administrator access.

Cookies: Atelier does not use cookies, advertising or tracking technologies. It uses your browser's session storage only to remember the conversation in the current tab.

Your rights: You can exercise your rights of access, rectification, erasure, restriction, portability and objection (including to processing based on our legitimate interest) as described below by writing to contact@saintsteven.com. Because the anonymous improvement records cannot be linked to a person, we may not be able to identify them; if so, we will tell you. You may also complain to the Spanish Data Protection Agency (www.aepd.es).

This AI assistant section was last updated on 7 October 2026.

YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA

  • You may contact us at any time regarding the collection and processing of your data to:
  • Find out whether we are processing your data.
  • The right to the data transfer
  • The right to access your data and any other information is indicated in Article 15.1 of the GDPR.
  • Rectify any personal data that is inaccurate or incomplete by Article 16 of the GDPR.
  • The right to have your data erased by Article 17 of the GDPR.
  • Right to restrict the processing of your data by Article 18 of the GDPR.
  • The right to request the portability of your data by Article 20 of the GDPR.
  • The right to object to the processing of your data by Article 21 of the GDPR.
  • We also inform you that you may approach the Spanish Data Protection Agency to obtain more information about your rights.
  • If you have provided consent for a specific purpose, you have the right to withdraw your consent at any time, without this affecting the legality of the processing carried out based on your consent before it was withdrawn.

o exercise these rights, you may send a justified request with proof of identity to us at contact@saintsteven.com or a letter to the Department of to Avenida De La Onu Nº 9 – 3ºB, 28936 M, Madrid.

 

Likewise, we inform you that you may submit a complaint to the competent Data Protection Supervisory Authority, the Spanish Data Protection Agency (https://www.aepd.es), especially when you are not satisfied with how your rights have been obtained.

 

LEGAL INFORMATION

The requirements established in this privacy policy complement and do not replace any other requirement established by applicable data protection law, which will prevail under all circumstances.

 

This privacy policy is subject to occasional reviews and the company may modify it at any time. In this event, we will inform you of any changes and request that you read and accept the latest version of our privacy policy. You may consult the current version of this privacy policy on this page at any time.