Privacy policy

GaySteel (gaysteel.eu) is a trading name of MARROYSTOYS S.L., C/ Ludwig van Beethoven 47, 03738 Jávea (Alicante), Spain, CIF B72968142. MARROYSTOYS S.L. is the controller of your personal data and processes it in accordance with the EU General Data Protection Regulation (GDPR) and the Spanish data protection act (LOPDGDD). For every privacy question or request, mail info@gaysteel.eu or write to the address above. Discretion is the core of our business, and that applies to your data just as much as to our packaging.

What we collect, why, and on which legal basis

Order data (name, company name if given, delivery and billing address, e-mail, phone, order contents, payment status and transaction references from our payment provider): to process, ship and deliver your order, send order and tracking updates, and handle returns, refunds and guarantee claims. Legal basis: performance of the contract (Article 6(1)(b) GDPR). Invoices and accounting records are kept because Spanish tax and commercial law requires it (Article 6(1)(c) GDPR). The phone number is needed because the warehouse and carrier require one for delivery.
Account data (name, e-mail, password stored only as a secure hash, addresses, order history): to show your order history and speed up checkout. An account is optional. Legal basis: performance of the contract.
Customer service (messages via e-mail, phone, the contact form or the chat): to answer your questions and handle complaints. Legal basis: performance of the contract, or our legitimate interest in helping you when you are not (yet) a customer.
Chat assistant: the chat on this site is answered first by an AI assistant. Your chat messages are sent to our AI provider to generate the answer; we count chats per IP address to prevent abuse. Please do not share health details or other sensitive information in the chat. Legal basis: our legitimate interest in quick customer service. You can always ask for a human instead.
Newsletter (e-mail, name, language): only with your consent (Article 6(1)(a) GDPR). New subscribers receive a welcome discount code. Every mail contains an unsubscribe link and you can withdraw consent at any time.
Basket reminder: if you entered your e-mail address at checkout or are signed in and leave without finishing your order, we may send one single reminder with a link that restores your basket. Legal basis: our legitimate interest in helping you complete a purchase you started. You can object at any time by replying to that e-mail or mailing us.
Review invitation: a few days after delivery we may send one e-mail asking what you think of your order. If you write a review, it is published with your first name only. Legal basis: our legitimate interest in verified product reviews. Simply ignore the e-mail if you prefer not to.
Technical data (IP address, browser, device, pages visited): for security, fraud prevention and to keep the site working properly. Legal basis: our legitimate interest in a safe and working shop.
Statistics: we count visits with our own statistics tool, which uses no cookies and stores no IP address, only a code that changes every day, so no visitor can be identified. If we switch on Google Analytics or Microsoft Clarity, they only run after you give consent (Article 6(1)(a) GDPR).

Providing order data is necessary to conclude and deliver the contract; without it we cannot process your order. We do not use automated decision-making that has legal or similarly significant effects on you.

Sensitive by nature

We are aware that a purchase at GaySteel may say something about your sex life or sexual orientation. We never use your data to draw conclusions about that, we do not build profiles on it, and we share order contents only with the parties that need them to pack, ship and pay for your order. We protect this information with the same care as the special categories of data under the GDPR.

What we never do

We never sell your data and never share your e-mail address with third parties for their marketing. Nothing on your bank statement or parcel reveals the nature of your purchase beyond our neutral company name. Please note that if you pay with PayPal or Klarna, those providers may show the order details in their own app or e-mails.

Who receives your data

We share data only with parties needed to fulfil your order and run the shop, and only the minimum they need. They process it on our instructions under a data processing agreement, unless stated otherwise below.

Shots (Beverwijk, the Netherlands), our partner warehouse that packs and ships your order: your name, company name if given, delivery address, phone, e-mail, order reference and the products and quantities ordered.
The carrier that delivers your parcel (usually UPS, or DPD for Belgium and Germany): your name, delivery address, phone and e-mail, for delivery and tracking notifications. Carriers process this partly under their own privacy policies.
Stripe (Stripe Payments Europe Ltd., Ireland) processes all payments; your card details never reach our servers. If you choose PayPal or Klarna, that provider receives the data needed for the payment and processes it partly as an independent controller under its own privacy policy; Klarna may carry out an identity or credit check.
Mailchimp (Intuit Inc., USA), our e-mail service: e-mail address, name and language of newsletter subscribers, and of customers. Customers who did not subscribe are stored as customer contacts without marketing consent and do not receive the newsletter.
Hostinger, which hosts the website, the database and our e-mail.
Cloudflare (Cloudflare, Inc., USA), which protects the site against attacks and delivers it quickly: it processes your IP address and technical request data.
Our AI provider for the chat assistant (currently Anthropic, USA): the content of your chat messages.
Google (Google Analytics) and Microsoft (Clarity): only if we switch them on, and only after your consent.
Public authorities, only where the law requires it, such as invoice records sent to the Spanish Tax Agency (AEAT).

Some of these providers are located outside the European Economic Area, or can access data from there. Such transfers are covered by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or by the European Commission's standard contractual clauses.

Cookies

We use functional cookies and local browser storage that the shop needs to work: your basket, language, sign-in, age confirmation and cookie choice. Cloudflare can set a strictly necessary security cookie to tell visitors from bots, and Stripe uses cookies on the payment step to prevent fraud. Our own statistics use no cookies. Analytics cookies (Google Analytics, Microsoft Clarity) are only placed if we switch these tools on and only after your consent. You can withdraw consent at any time by clearing the cookies and site data for gaysteel.eu in your browser; you will then be asked again. Blocking functional cookies may stop parts of the shop from working.

Retention

Order data and invoices are kept for six years, as Spanish commercial and tax law requires. Account data is kept as long as your account exists; if you delete it, your order records are still kept for that legal period. Customer service and chat messages are kept up to two years after the last contact. Newsletter data is kept until you unsubscribe; after that we keep only your e-mail address on a block list, so that you are never mailed again. Published reviews stay online until you ask us to remove them. Basket reminder data and technical logs are deleted when they are no longer needed for their purpose.

Your rights

You have the right to access, correct and delete your personal data, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest, including at any time to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting the processing before that. Mail info@gaysteel.eu and we take care of it within one month; we may ask you to verify your identity. You can also lodge a complaint with the Spanish data protection authority (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or the data protection authority of your own country.

Age and security

Our products and services are for adults aged 18 or over; we do not knowingly collect data from minors. We use appropriate technical and organisational measures (encrypted connections, access control, secure payment) to protect your data. This policy may be updated when our services or the law change; the current version is always on this page.

Last updated: 24 September 2026.