Privacy
Privacy Policy
Last updated: 7 October 2026
1. Controller
Mallorca Travel Guide SL, represented by Laura Herrig, Plaça d’Espanya 11, 1, 07002 Palma de Mallorca, Spain; email: info@mymallorcaguide.com; telephone: +34 644 153 963.
2. Server and access data
The website is delivered by Vercel Inc. Technically necessary access data such as the IP address, time, requested resource, browser and operating system is processed to deliver the website securely and reliably and to prevent misuse. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. Vercel acts as a processor and operates a global delivery network. Where data is processed outside the European Economic Area, transfers rely on the applicable adequacy decision or Standard Contractual Clauses.
3. Contact and proposal enquiries
When you submit an enquiry, we process the details you provide, in particular your name, email address, optional phone number, event date, guest count, venue, occasion and message. We use this information to respond, prepare a proposal and take pre-contractual steps under Article 6(1)(b) GDPR. Secure handling, documentation and the prevention of duplicate or abusive requests are also based on our legitimate interest under Article 6(1)(f) GDPR. We cannot process the enquiry without the fields marked as required. We do not use enquiry data for advertising unless you give separate consent.
4. Storage in Supabase
Website enquiries are stored in our Supabase project with its primary database region in North EU (Stockholm). Supabase processes contact and event details as our processor. Technical safeguards limit anonymous website access to validated submissions; public reading, updating and deletion are not permitted. Processing by Supabase or its subprocessors outside the European Economic Area is subject to the transfer mechanisms in the data processing agreement, in particular Standard Contractual Clauses or an applicable adequacy decision.
5. Email delivery through Resend
After storage, the transactional email service Resend (Plus Five Five, Inc., USA) sends the enquiry to us and an acknowledgement to the requester. Resend processes contact details and message content as our processor. Transfers to the USA use the safeguards stated in its data processing agreement, including the EU-US Data Privacy Framework where applicable and Standard Contractual Clauses.
6. Analytics and consent
Vercel Web Analytics processes technical and aggregated usage information to measure reach on the basis of our legitimate interest in improving the website under Article 6(1)(f) GDPR. Google Analytics loads only after your consent under Article 6(1)(a) GDPR. Recipients are Google Ireland Limited and, where applicable, Google LLC in the USA; transfers use the EU-US Data Privacy Framework where applicable or Standard Contractual Clauses. Google Analytics measures page views, interactions and successfully submitted enquiries. You can change or withdraw consent for the future at any time through “Cookies” in the footer. Your selection remains in local browser storage until you change it or clear that storage. Fonts are served locally.
7. Retention
We generally retain enquiry data for two years from the date the enquiry is received. We delete it earlier if the data subject requests deletion, makes an effective objection or withdraws any relevant consent. We may retain data where statutory retention duties apply or where it is needed to establish, exercise or defend legal claims. If an enquiry results in a contract, the statutory retention periods for the resulting business and tax records apply. Data is deleted or anonymised when the applicable period expires.
8. Your rights
Where the legal requirements are met, you may request access, correction, deletion, restriction, data portability or object to processing. You may withdraw consent at any time for the future. To exercise these rights, email info@mymallorcaguide.com. You may also complain to a competent supervisory authority, in particular the Spanish Agencia Española de Protección de Datos (AEPD). We do not use automated decision-making, including profiling.