10% off your first order
Sign up for training tips, early access to new gear, and 10% off your first order. Unsubscribe anytime.
Privacy policy
Last updated: 7 September 2026
1. Who we are
Xtenia ("we", "us") is an online business selling calisthenics equipment and apparel. Xtenia is a trading name; the identity of the data controller is set out in section 11.
Bideberrialde 52, B, 31810 Bakaiku, Navarra, Spain
Email: Contact@xtenia.com
If you have any questions about this policy or about how we handle your personal data, you can contact us at the email address above.
2. What personal data we collect
When you place an order: name, billing and shipping address, email address, phone number, order contents, and delivery details.
Payment data: we do not receive or store your full card number. Payments are processed through Shopify Payments and its payment processors. We receive information necessary to confirm and manage the transaction, and in some cases limited payment information such as the last four digits of a card and card type.
When you create an account: email address, password, saved addresses, and order history. Passwords are stored in hashed form and are not stored in readable form.
When you contact us: your email address and whatever information you choose to provide in your message.
When you subscribe to our newsletter or marketing: your email address and information relating to your subscription, including the date and source of your consent.
When you leave a review: your name or display name, rating, review text, and any photo you choose to upload.
When you browse the site: IP address, browser and device type, pages viewed, referring website, and information about how you use the site. This may be collected through cookies and similar technologies. See section 7.
We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it where required.
3. Why we use your data and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Process and ship your order, and handle returns | To perform the contract you entered into with us | Contract, GDPR Art. 6(1)(b) |
| Take payment and prevent fraud | To complete the sale and protect against fraudulent transactions | Contract and legitimate interests, GDPR Art. 6(1)(b) and (f) |
| Answer your emails and support requests | To respond to you and provide customer support | Contract or legitimate interests, GDPR Art. 6(1)(b) and (f) |
| Keep accounting and tax records | Because Spanish law requires us to keep certain records | Legal obligation, GDPR Art. 6(1)(c) |
| Send marketing emails, including abandoned-cart reminders | Because you have asked to receive marketing communications | Consent, GDPR Art. 6(1)(a) |
| Measure how the site is used and improve it | To understand what works and improve our website | Consent, where required, through the cookie banner, GDPR Art. 6(1)(a) |
| Measure advertising performance | To understand whether our advertising leads to visits and sales | Consent, where required, through the cookie banner, GDPR Art. 6(1)(a) |
| Invite you to review a product you bought | To collect customer feedback and help other customers make informed purchasing decisions | Legitimate interests or consent, depending on the circumstances |
Where we rely on legitimate interests, we have considered our interests against your rights and freedoms. You can object to processing based on legitimate interests at any time. See section 8.
Where we rely on consent, you can withdraw your consent at any time. Withdrawing consent does not affect processing carried out before you withdrew it.
We do not use your personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
4. Who we share your data with
We do not sell your personal data.
We share personal data with service providers that process data on our behalf, where necessary to operate our business and provide our services.
The main providers we use include:
| Provider | What they do | Where |
|---|---|---|
| Shopify International Ltd. / Shopify | Hosts our online store, processes orders and provides checkout, customer account and related ecommerce services | Ireland, with processing by Shopify affiliates and subprocessors in other countries |
| Shopify Payments / Stripe Payments Europe, Limited | Processes payments and supports payment-related services | EU and other locations depending on the processing involved |
| Judge.me | Collects and displays product reviews | Various |
| Tag management, analytics and advertising measurement | Various, including the USA | |
| GoAffPro | Operates our affiliate programme and tracks affiliate referrals and sales | Germany, USA and other locations |
| Chatway / Poptin Ltd. | Provides live chat and customer support functionality | Israel and other locations |
| Carriers and logistics partners | Deliver your orders | EU and other locations where necessary for delivery |
| Payment methods available through Shopify Payments | Process payments when you choose methods such as Klarna, Apple Pay, Google Pay, Shop Pay and other available payment methods | Various |
Shopify states that personal data of customers in the EEA is initially processed by Shopify International Limited in Ireland and that Shopify uses affiliated entities and third-party subprocessors to provide its services.
GoAffPro states that it operates data centres in Germany and the USA. Chatway is operated by Poptin Ltd., an Israeli company.
We may also disclose personal data where required by law or where necessary to establish, exercise or defend legal claims.
5. Transfers outside the EEA
Some of the service providers listed above may process personal data in countries outside the European Economic Area.
Where personal data is transferred outside the EEA, we rely on an appropriate legal safeguard permitted by the GDPR, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another legally permitted transfer mechanism where applicable.
You can contact us at Contact@xtenia.com if you would like further information about the safeguards applicable to a particular international transfer.
6. How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this policy, including where we are legally required to retain it.
| Data | Retention |
|---|---|
| Order and invoice records | 6 years from the end of the tax year, or for as long as required by applicable Spanish law |
| Account data | Until you delete your account, then removed within 30 days except where we must retain information for legal or accounting purposes |
| Marketing subscription | Until you withdraw your consent or unsubscribe, after which we retain a record of your withdrawal so that we do not send you further marketing |
| Support communications | 3 years from the last message |
| Reviews | Until you ask us to remove them, unless we have a legitimate reason to retain them |
| Analytics and advertising data | According to the applicable provider's configured retention period |
Different legal or operational requirements may require us to retain certain information for longer.
7. Cookies and similar technologies
We use cookies and similar technologies for the following purposes:
Strictly necessary cookies. These are required for functions such as keeping you logged in, remembering your basket, maintaining security and allowing the website and checkout to function. These cookies do not require your consent where they are strictly necessary for the service you have requested.
Analytics cookies. These help us understand how visitors use our website, such as which pages are visited and where visitors leave. These cookies are only set where you have given the required consent.
Advertising and measurement cookies. These help us measure advertising performance and, where applicable, provide relevant advertising. These cookies are only set where you have given the required consent.
When you first visit our website, our cookie banner allows you to manage your choices regarding non-essential cookies.
You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the website from working correctly, including the basket and checkout.
8. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectify personal data that is inaccurate or incomplete.
- Erase your personal data where there is no overriding legal reason for us to retain it.
- Restrict processing in certain circumstances, including while a dispute concerning your data is being resolved.
- Data portability, meaning you may request certain personal data in a structured, commonly used and machine-readable format.
- Object to processing based on legitimate interests and to direct marketing at any time.
- Withdraw consent at any time where consent is the legal basis for processing.
To exercise any of these rights, contact us at:
We will normally respond within one month. We may ask you to confirm your identity where reasonably necessary to protect your personal data.
Every marketing email we send includes an unsubscribe link. Unsubscribing takes effect immediately and is free of charge.
If you are not satisfied with how we handle your personal data or your request, you can lodge a complaint with the Spanish Data Protection Agency:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
www.aepd.es
You may also complain to the data protection authority in the EU country where you live or work, or where you believe an infringement has occurred.
9. Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
Our online store is hosted by Shopify. Payment processing is handled through payment providers and payment infrastructure designed to protect payment information. Traffic between your browser and our website is encrypted using TLS.
Access to customer data is limited to people and service providers who need it to operate the business.
No online service can guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will take the measures required by applicable data protection law, including notifying the AEPD where legally required.
10. Changes to this policy
We may update this Privacy Policy when our website, services, business practices or service providers change.
The date at the top of this policy shows when it was last updated.
If we make a material change to how we use your personal data, we will take appropriate steps to inform you where required by law.
11. Contact
If you have questions about this Privacy Policy, want to exercise your data protection rights, or have a complaint about how we handle your personal data, contact:
Yasser Souweiri, trading as Xtenia
NIF: Z2617626R
Adress: Bideberrialde 52, B, 31810 Bakaiku, Navarra, Spain
Email: Contact@xtenia.com