MallorcaFeels Privacy Policy

Version: 1.0 Effective date: XXX Last updated: 20 August 2026

This Privacy Policy explains how personal data is processed when a person visits mallorcafeels.com, uses its features, creates an account, saves preferences, subscribes to communications, or has a professional relationship with MallorcaFeels.

1. Data controller

• Controller: XXX
• Tax identification number: XXX
• Registered address: XXX
• Privacy and data-rights email: [email protected]
• Website: https://mallorcafeels.com

The information above must be replaced with the controller's real details before forms, accounts, newsletters, commercial outreach, or any other processing of personal data are activated. While the controller is shown as XXX, this policy is ready for integration but does not provide a valid identification of the controller under Article 13 GDPR.

2. Who this policy applies to

This policy applies to website visitors and users; people who create an account or use “My Mallorca”; newsletter subscribers; people who contact the team; and representatives, employees, or professionals of suppliers, restaurants, accommodation providers, tour operators, and potential partners.

It does not govern processing by booking platforms, maps, or other third-party services reached through a link. Those parties provide their own privacy information.

3. Data, sources, purposes and legal bases

3.1 Browsing, operation and security

When the website is accessed, infrastructure providers may process IP address, date and time, requested resource, browser and device type, technical headers, security identifiers, and information about errors or attempted misuse.

This data is used to deliver the website, keep it available, prevent fraud and attacks, diagnose errors, and protect systems. The legal bases are the requested service and XXX's legitimate interest in operating a secure, stable, and proportionately measurable website, Articles 6(1)(b) and 6(1)(f) GDPR.

3.2 Account, authentication, profile and favourites

If enabled, sign-in through Google and Supabase may involve email address, account identifier, display name, and authentication data. The profile may store home area, interests, preferences, consent records, and saved favourites.

The purposes are to create and maintain the account, authenticate the user, personalise “My Mallorca”, synchronise favourites, and handle service requests. The legal basis is performance of the service requested by the user, Article 6(1)(b) GDPR. Promotional communications linked to an account will only be sent with separate consent, Article 6(1)(a) GDPR.

3.3 Newsletter and requested communications

If the newsletter is enabled, the email address, consent timestamp, and information needed to evidence the subscription and manage opt-out will be processed.

The purpose is to send expressly requested communications about MallorcaFeels content, news, or services. The legal basis is consent, Article 6(1)(a) GDPR and Articles 21 and 22 of Spain's Law 34/2002. Consent can be withdrawn at any time through the unsubscribe mechanism in each message or by emailing [email protected], without affecting earlier lawful processing.

Accepting this policy does not mean consenting to advertising. Commercial consent will be requested specifically, transparently, and separately where required.

3.4 Enquiries and professional relationships

When a person contacts MallorcaFeels, the data may include their name, email, telephone number, organisation, role, message, communication history, and information needed to manage the relationship.

The purposes are to answer enquiries, assess partnerships, prepare or perform agreements, and keep evidence of communications. The legal bases are pre-contractual steps or contract, Article 6(1)(b) GDPR; legal obligations, Article 6(1)(c); and XXX's legitimate interest in maintaining professional relationships, Article 6(1)(f), provided the individual's rights do not override that interest.

3.5 Professional contact data from public sources

MallorcaFeels may collect professional contact data published on official websites, corporate directories, or accessible registers to identify the appropriate contact at a supplier or potential partner. Data will be limited to professional name, role, organisation, corporate contact channels, and source.

The purpose is to manage a specific potential professional relationship. The legal basis will be legitimate interest, Article 6(1)(f) GDPR, after assessing necessity, proportionality, and reasonable expectations. The first communication will explain the source, link to this policy, and offer the right to object, as required by Article 14 GDPR.

This basis does not authorise bulk advertising or remove the requirements of Articles 20, 21, and 22 of Spain's Law 34/2002. Unrequested advertising or promotional emails will not be sent unless a valid legal basis and statutory exception apply, and a simple, free opt-out will always be available.

3.6 Location, accommodation and nearby searches

The website requests device location only when the user selects that feature and grants browser permission. It is used to sort results by distance. For nearby-service searches, approximate coordinates and radius may be sent directly from the browser to OpenStreetMap's Overpass service. If an address or accommodation is searched, the entered text may be sent to an OpenStreetMap geocoding service.

The purpose is to provide the requested feature. The legal bases are consent and the user's express request, Articles 6(1)(a) and 6(1)(b) GDPR. MallorcaFeels currently does not need to store the device location on its servers for this feature. The selected origin or accommodation can remain in the browser's local storage until the user removes it or clears site data.

3.7 Browser storage

MallorcaFeels may use local or session storage to remember device-only favourites, a chosen accommodation or starting point, search caches, filters, interface state, and a random session identifier for commercial attribution.

Storage strictly necessary for a feature expressly requested by the user is based on delivery of that service. Any non-essential storage or access will remain disabled until valid consent has been obtained under Article 22(2) of Spain's Law 34/2002. Further details must also appear in the Cookies Policy.

3.8 Commercial-click measurement and affiliate links

When enabled with the appropriate legal basis, MallorcaFeels may record a minimised event when a user clicks a commercial or booking link: random click and session identifiers, content type and identifier, provider, link mode, destination domain, language, and timestamp.

The application event does not contain a name, email, full URL, query string, IP address, or user agent. Infrastructure providers may still create ordinary technical logs. The purposes are to measure link performance, attribute conversions, and detect errors or fraud. The legal basis will be consent where terminal-storage rules require it and, for subsequent strictly proportionate processing, XXX's legitimate interest in measuring its commercial activity, Article 6(1)(f) GDPR.

Some links may earn MallorcaFeels a commission without increasing the price paid by the user. The destination provider operates under its own policy and terms.

3.9 Third-party content and services

The website may link to or, where a legal basis exists, integrate Google Maps, Google OAuth, OpenStreetMap/Overpass, booking platforms, official websites, and other external services. When a third-party link or content is opened, that party may receive technical data such as IP address, browser data, referring page, and its own identifiers.

Embedded content or non-essential technologies that may store or read information on a device will be blocked until the required consent has been obtained. Voluntarily opening an external link starts a direct relationship between the user and that third party.

4. Required and optional data

Fields marked as required are needed to provide the feature or answer the request. Without them, it may not be possible to create an account, complete a subscription, or handle an enquiry. Optional fields and consent to commercial communications can be left blank without preventing access to basic features.

5. Recipients and processors

Depending on the feature used, personal data may be processed by providers working for XXX under the relevant agreement, including:

• OVHcloud for hosting and email;
• Cloudflare for DNS, content delivery, and security;
• Supabase for database and authentication, when enabled;
• Google for authentication and maps, when used;
• OpenStreetMap and Nominatim/Overpass operators for maps, geocoding, and nearby searches;
• strictly necessary technical support, legal, tax, or security advisers.

Data may also be disclosed to public authorities, courts, or law-enforcement bodies when legally required. Booking, affiliate, or external-content providers receive data supplied directly by the user or technical data arising from access to their services and operate under their own terms.

Personal data is not sold.

6. International transfers

Some technology providers may process data outside the European Economic Area. Where an international transfer occurs, XXX will require a valid mechanism under Chapter V GDPR, such as a European Commission adequacy decision, Standard Contractual Clauses and, where appropriate, supplementary measures.

Information about the applicable safeguard may be requested at [email protected]. Before enabling a service, XXX must verify the processing location, data-processing agreement, and current transfer mechanism.

7. Retention

Data will be retained only for as long as each purpose requires and subsequently restricted where necessary for legal liability:

• Account and profile: while the account is active; after a deletion request, removal from active systems and ordinary backups within 90 days, unless a legal obligation or pending incident applies.
• Synced favourites: while the account exists or until deleted by the user.
• Newsletter: until unsubscribe or withdrawal of consent. Minimal opt-out and consent evidence may be kept for up to three years to prove compliance and prevent unwanted resubscription.
• General enquiries: up to two years after closure, unless a contract or claim requires longer retention.
• Professional relationships and contacts: while a relationship or reasonable prospect of collaboration exists and, ordinarily, no longer than three years from the last relevant interaction or source review, unless an earlier objection or legal duty applies.
• Contracts, invoices, commercial and tax records: for statutory periods.
• Minimised commercial-click events: up to 13 months. Browser session identifiers expire at the end of the session.
• Technical and security logs: for the minimum necessary period and ordinarily no longer than 12 months, unless an incident investigation or legal duty applies.
• Device-local data: until replaced by the feature, removed by the user, or cleared with browser site data.

Before this policy is published, systems and supplier agreements must be configured to match these periods.

8. Individual rights

Any individual may exercise, free of charge, the rights of access, rectification, erasure, objection, restriction, and portability, and may withdraw consent at any time.

Requests should be emailed to [email protected], stating the right requested and enough information to locate the data. Additional identity evidence will only be requested where reasonable doubts exist, and unnecessary information should be obscured.

XXX will normally respond within one month, subject to the extensions allowed by the GDPR. A complaint may also be lodged with the Spanish Data Protection Agency: https://www.aepd.es.

Where processing relies on legitimate interests, the individual may object on grounds relating to their situation. Objections to direct marketing will always be honoured immediately.

9. Children

Accounts, newsletters, and data-collection features are not directed at children under 14. A child under 14 must not submit data or register without valid authorisation from a parent or guardian. Data found to have been collected without a valid basis will be deleted promptly.

10. Automated decisions

MallorcaFeels does not make automated decisions that produce legal or similarly significant effects. Interests and preferences may be used to order or recommend content without legal or contractual consequences.

11. Security

XXX will apply technical and organisational measures proportionate to risk, including access controls, encryption in transit, system updates, backups, data minimisation, environment separation, and permission reviews. No system is completely invulnerable; personal-data breaches will be handled under Articles 33 and 34 GDPR where applicable.

12. Changes

This policy may be updated to reflect legal, technical, or service changes. The current version and update date will be published on this page. Where a material change affects consent-based processing, fresh consent will be obtained if required.

13. Legal framework

This policy has been prepared under Regulation (EU) 2016/679, Spain's Organic Law 3/2018, and Spain's Law 34/2002. It does not replace the Legal Notice required by Article 10 of Law 34/2002 or the specific information required for cookies and similar technologies.