Privacy policy

Privacy Policy

In this policy we explain what personal data we process when you visit www.nextstepstore.com, shop in our store or talk to us, what we use it for, who we share it with and what rights you have. Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) apply.

Last updated: August 8, 2026.

Summary

Controller: Soletarget Company, SL (Next Step), with registered address in Granollers (Barcelona).
What for: to manage your orders, shipments, returns and inquiries, and Next Step Club. Advertising and analytics cookies only if you accept them.
We do not sell your data: we only share it with the providers we need for the store to work (payments, shipping, email and messaging).
Customer service: a virtual assistant, which identifies itself as such, may reply to your WhatsApp and email messages, always under the supervision of our team.
Your rights: access, rectification, erasure, objection, restriction and portability, by writing to contact@nextstepstore.com.

1. Data controller

Controller: Soletarget Company, SL (trade name: Next Step)
CIF (tax ID): B44611283
Address: Calle Navarra 49, 08401 Granollers (Barcelona), Spain
Email: contact@nextstepstore.com
WhatsApp: +34 644 197 198 (chat only)

2. What data we process

When you buy

First and last name, email address, phone number, and shipping and billing addresses.
Your order details: products, sizes, amounts, discounts, shipments, returns, exchanges and refunds.
The payment data needed to charge and refund you. We do not see or store your full card number: it is handled directly by the payment provider, which only shares with us details such as the card type and its last digits.
If you ask us for an invoice in your name or your company's name, the tax details you provide (for example, your tax identification number).

When you write to us

Via WhatsApp: your phone number, your profile name and the content of your messages, including any photos and files you send us.
Via email: your email address and the content of your messages and their attachments.

When you browse the website

Your IP address, device and browser type, the pages you visit and the information collected by cookies and similar technologies, according to your cookie preferences (section 10).
If you start an order and do not complete it, the details you entered at checkout.

Next Step Club

The data for the rewards program is explained in section 5.

We do not process special categories of data (Article 9 GDPR), such as health data or political or religious beliefs.

3. What we use your data for and on what legal basis

Managing your orders: payment, preparation, shipping, pre-orders, cancellations, exchanges, returns, refunds and warranty. Legal basis: performance of the sales contract.
Keeping you informed about your order: confirmation, updates on the progress of a pre-order, tracking number and payment reminders when you pay by bank transfer. Legal basis: performance of the contract.
Answering your inquiries via WhatsApp or email. Before giving you information about an order, we ask you for the order number and the email address used to place it, to verify that it is you. Legal basis: performance of the contract or of pre-contractual steps you request, and our legitimate interest in protecting our customers' data.
Complying with our legal, tax and accounting obligations, such as issuing and keeping invoices. Legal basis: compliance with a legal obligation.
Reminding you of an order you did not complete: if you leave an order unfinished at checkout, we may send you a single email with the products you chose. Legal basis: our legitimate interest. You can object at any time by replying to that email or writing to us.
Managing Next Step Club (section 5).
Preventing fraud in payments, discount codes and friend referrals. Legal basis: our legitimate interest.
Sending you marketing communications (new arrivals, offers and releases) by email or WhatsApp. Legal basis: your consent, which you can withdraw in each message or by writing to us, without affecting your orders or Next Step Club.
Analyzing website use and showing you personalized advertising on other platforms. Legal basis: your consent, given through the cookie banner.

4. Virtual assistant in customer service

To reply to you faster, Nexi, our AI-based virtual assistant, may answer your WhatsApp and email messages. Its replies are always identified: on WhatsApp they begin with “[Nexi]”, and in emails they include a notice at the bottom.

To reply to you, it uses your messages, the conversation history and, once it has been verified that you are the account holder, your order details.
It can also translate messages between your language and our team's language, so that we always reply to you in your language.
Our team supervises the conversations, and you can ask to be helped by a person at any time.
The assistant does not make decisions that produce legal effects for you or significantly affect you: exceptions, compensation and any decision outside our policies are always made by a person on our team.

Legal basis: performance of the contract or of pre-contractual steps you request, and our legitimate interest in assisting you quickly.

5. Next Step Club (rewards program)

When you complete your first order, you automatically become a member, free of charge, of Next Step Club, the store's rewards program, which is governed by its terms and conditions. To manage it we process:

Your order details (amounts, products, returns and refunds), to calculate your Steps and your level.
Your email address and shipping country, to send you the program's service notices in your language: available Steps, codes and their expiry, level changes, birthdays and referrals. You can turn them off without leaving the program, in its dashboard or from any of these notices; you will still receive the codes you redeem and the reminders before your Steps or codes expire.
Your date of birth, your size and your styles, only if you provide them in the program dashboard.
The discount codes you redeem and your friend referrals, including the email address of the person referred.
To prevent referral fraud, we compare the email address, addresses, phone number, IP address and last digits of the payment card of the person referred with those of the referrer. These are only used to decide whether the Steps are awarded.

Level: we assign each member a level (Club, Hype or Grail) based on what they have spent in the last 12 months. This is profiling that only determines the program benefits; it does not produce legal effects for you or significantly affect you.

Legal basis: the legitimate interest of Soletarget Company, SL in rewarding its customers with a free program with no obligations, which you can object to at any time by leaving it; performance of the program terms when you use your benefits (for example, when redeeming Steps or saving your birthday); and the legitimate interest in preventing fraud. Marketing communications are only sent with your consent.

Leaving the program: you can do so at any time and at no cost from the Next Step Club dashboard, using the link at the bottom of any program email, or by writing to contact@nextstepstore.com. When you leave, we delete your Steps, your level, any codes you have not used, your date of birth, your size and styles, your referral link and your program history, and your later orders are no longer recorded in the program. We only keep your customer number and the date you left, so that we do not automatically sign you up again, and the codes already used, as part of the accounting records of the orders they were applied to. You can rejoin whenever you like from the program dashboard: you start from zero and only later orders count.

6. Who we share your data with

We do not sell your personal data. We only disclose it to the providers we need in order to provide our service to you, who process it as processors following our instructions or, in some cases, as independent controllers under their own privacy policies:

Store platform: Shopify, which hosts the website, the checkout and your customer account.
Payments: Shopify Payments, PayPal, Klarna, Scalapay and the other providers of the method you choose at checkout; if you pay by bank transfer, our bank.
Shipping: UPS and SEUR, which receive your name, address, phone number and email address to deliver the package and notify you, and SendCloud, which we use to create shipping and return labels.
Communications: Meta (WhatsApp Business), Google (email) and SMTP2GO, which sends the store's emails (notices about your orders and from Next Step Club).
Virtual assistant and translation: Anthropic and OpenAI, which process the content of conversations to generate and translate replies (section 4).
Analytics and advertising, only if you give your consent: Google (Google Analytics, Google Ads), Meta (Facebook and Instagram, Meta Pixel) and Microsoft (Microsoft Advertising).
Public authorities, courts and tax or accounting advisors, when required by law.

Transfers outside the European Economic Area

Some of these providers (for example, Shopify, Google, Meta, Microsoft, Anthropic or OpenAI) may process data outside the European Economic Area. In those cases the transfer is covered by an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or by standard contractual clauses approved by the Commission.

7. How long we keep your data

Orders and invoicing: 6 years, as required by Article 30 of the Commercial Code, which also covers the periods set by tax legislation.
Customer account: while it is active and for up to 1 year after you delete it.
Customer service conversations: for as long as needed to handle your inquiry and, where they relate to an order, for the same period as that order's data.
Marketing communications and cookies: until you withdraw your consent.
Next Step Club: for as long as you are a member of the program; if you leave, the data is deleted as described in section 5.

Once these periods have passed, we securely delete or anonymize the data.

8. Your rights

You can exercise the following rights at any time, free of charge:

Access: to know what data about you we process.
Rectification: to correct inaccurate or incomplete data.
Erasure: to ask us to delete your data when it is no longer needed.
Objection: to object to processing based on our legitimate interest, including profiling, and in any case to advertising.
Restriction: to ask us to stop using your data while a complaint is being resolved.
Portability: to receive your data in a structured, commonly used format, or to have us send it to another company.
Withdrawing your consent at any time, without affecting anything done before.

Write to us at contact@nextstepstore.com stating the right you want to exercise. To protect your data, we may ask you to confirm your identity, for example by writing from your account email address. We will reply within a maximum of one month, which may be extended by two further months if the request is particularly complex; in that case we will let you know.

If you disagree with our reply, you can file a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

9. Security

We apply technical and organizational measures to protect your data against loss, unauthorized access or misuse. For example, we only give information about an order after verifying the order number and the email address used to place it.

We will never ask you via WhatsApp or email for your password, your account access codes or your full card number.
Our only website is www.nextstepstore.com. If you receive a suspicious message in our name, see our page on phishing and let us know.

10. Cookies

We use our own and third-party cookies. Those needed for the website and checkout to work are always set; analytics and advertising cookies are only set if you accept them in the cookie banner that appears when you visit the website. You can change your choice at any time from that banner or from your browser settings.

11. Minors

Our store is intended for people aged 18 and over. We do not knowingly process data of minors; if we find that we have received such data, we will delete it.

12. Changes to this policy

We may update this policy to reflect changes in the law or in our services. We will always publish the current version on this page, with its update date, and if the change is significant we will let you know.