Privacy policy

At Explore Mallorca we take the privacy of our users very seriously. This Privacy Policy explains what personal data we collect, for what purposes, on what legal basis, with whom we share it and what your rights are.

This policy applies to all data processing activities carried out through the website www.exploremallorca.es, the Interactive Map map.exploremallorca.es and any related electronic communications.

By using our services, you confirm that you have read and understood this policy. If you have any questions, you may contact us before providing any personal data.

1. Data controller

Owner

Sebastiano Mosele

Trade name

Explore Mallorca and exploremallorca.es

NIF

Z0203746V

Address

Avinguda Méxic 23, 1-G, 07007, Palma, Illes Balears, Spain

General email

info@exploremallorca.es

Support and customer service

support@exploremallorca.es

Legal contact / GDPR

sebastiano@exploremallorca.es

Websites

www.exploremallorca.es · www.map.exploremallorca.es

2. Data we collect

We only collect personal data when it is necessary to provide you with the service. Below is a detailed description of what data we collect according to the source:

2.1 Contact form

• First and last name

• Email address

• Message subject

• Message content

2.2 Newsletter subscription

• Email address

• First name (optional)

2.3 Booking of activities and experiences

• First and last name

• Email address

• Contact phone number (where applicable)

• Date and details of the booked activity

• Payment data: processed directly by Stripe — Explore Mallorca does not store credit/debit card details

2.4 Interactive Map subscription (map.exploremallorca.es)

• Email address

• Payment data: processed directly by Stripe

• Subscription and billing history

2.5 Web browsing and analytics

• IP address (anonymised)

• Browser type and operating system

• Pages visited and time spent

• Traffic source (referral, organic search, direct, etc.)

This data is collected through Google Analytics GA4. See section 5 on international transfers.

2.6 Interactive Map — anonymised usage data

The Interactive Map uses the OpenPanel analytics tool, managed by Zoneatlas Oy (provider of the Zonemaps platform). Only anonymised usage data is collected (without personal identification of the visitor) in order to optimise map performance. No personally identifiable data of Map visitors is collected.

2.7 Affiliate cookies (Tiqets and other platforms)

When the user clicks on an affiliate link included on our website or in the Interactive Map, the destination platform (e.g. Tiqets) may install its own conversion tracking cookies. Explore Mallorca does not control the data processing carried out by said platforms. For more information, please consult the privacy and cookie policy of each platform.

3. Purpose of processing and legal basis

The following table summarises the purposes of each processing activity and the legal basis that legitimises it in accordance with article 6 of the GDPR:

We do not use your data to make automated decisions or to create user profiles with significant legal effects.

4. Recipients and data processors

Explore Mallorca does not sell, rent or transfer personal data to third parties for their own commercial purposes. However, to provide our services we work with the following data processors, with whom we maintain the data processing agreements required by the GDPR:

5. International transfers of data

Most of our providers are located in the European Union and, therefore, the processing of your data takes place within the European Economic Area (EEA). The only relevant exception is the following:

Google Analytics GA4 — transfer to the United States

Google Analytics GA4 is a service provided by Google Ireland Ltd. (Ireland). However, Google LLC, headquartered in Mountain View, California (USA), acts as a sub-processor and may have access to data on US territory.

This transfer is covered by the Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision 2021/914), and by the additional security measures implemented by Google in accordance with the recommendations of the European Data Protection Board (EDPB).

Important: Google Analytics GA4 is configured with IP anonymisation activated and data retention set to a maximum of 14 months. No data is shared with Google for its own advertising purposes if consent mode (Consent Mode v2) is correctly configured.

For more information on Google's international transfers, please visit: https://business.safety.google/gdpr/

The remaining providers (Stripe, Odoo, Zoneatlas Oy, Tiqets) operate from the European Union and do not carry out transfers of data outside the EEA in the context of the services provided to Explore Mallorca.

6. Data retention periods

Personal data will be retained for the time strictly necessary to fulfil the purpose for which it was collected and, in any case, for the minimum periods required by applicable legislation:

• Contact form data: 1 year from the last contact, unless there is an ongoing contractual relationship.

• Newsletter data: during the active subscription period and up to 1 year after unsubscribing, to prove compliance with legal obligations.

• Activity booking and Map subscription data: 5 years from the provision of the service, in accordance with the tax and commercial obligations established in Law 58/2003, General Tax Act, and the Commercial Code.

• Payment records (Stripe): retained in accordance with the periods established by PCI DSS regulations and applicable tax legislation (minimum 5 years).

• Web analytics data (Google Analytics GA4): maximum 14 months, in accordance with the configuration recommended by the AEPD.

• Affiliate cookie data: according to the periods established by each affiliate platform.

After the indicated periods, the data will be securely deleted or anonymised.

7. Your rights as a user

In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), you may at any time exercise the following rights:

Right of access

To know what personal data of yours we process and to obtain a copy of it.

Right of rectification

To request the correction of inaccurate or incomplete data.

Right of erasure ("right to be forgotten")

To request the deletion of your data when it is no longer necessary for the purpose for which it was collected, you have withdrawn consent or you object to processing, unless there is a legal obligation to retain it.

Right to restriction of processing

To request that we temporarily suspend the processing of your data in certain circumstances.

Right of portability

To receive your data in a structured, commonly used and machine-readable format, and to transmit it to another data controller, when processing is based on consent or on the performance of a contract.

Right to object

To object to the processing of your data when this is based on legitimate interest, including objection to the sending of commercial communications.

Right to withdraw consent

In processing based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

How to exercise your rights

You may exercise any of these rights by sending a written request to:

• Email: sebastiano@exploremallorca.es

• Postal address: Avinguda Méxic 23, 1-G, 07007, Palma, Illes Balears, Spain

You must identify yourself by attaching a copy of your ID, NIE, passport or other valid identity document. We will respond to your request within a maximum of one month from its receipt (extendable to three months in cases of special complexity, with prior notification).

Right to complain to the AEPD

If you consider that the processing of your data does not comply with the applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

• Website: www.aepd.es

• Electronic office: sedeagpd.gob.es

• Address: C/ Jorge Juan, 6, 28001 Madrid

8. Minors

Explore Mallorca's services are not directed at minors under 14 years of age. In accordance with Organic Law 3/2018 (LOPDGDD), the processing of data of minors under 14 years of age requires the consent of their parents or legal guardians.

If you are under 14 years of age, you must not provide us with personal data without the consent and supervision of your parents or guardians. If we detect or are notified that we have collected data from a minor under 14 years of age without the required consent, we will proceed to its immediate deletion.

9. Data security

Explore Mallorca applies appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration or disclosure, in accordance with the requirements of article 32 of the GDPR. These measures include:

• Use of HTTPS protocol with TLS encryption throughout the website.

• Payment processing exclusively through Stripe, which complies with PCI DSS level 1 standard and applies the 3D Secure protocol.

• Data storage on servers with restricted access controls.

• Access to personal data limited to staff or collaborators who need it for the provision of the service.

However, no internet data transmission system can be guaranteed as absolutely secure. If you detect any vulnerability or security incident related to our services, please inform us immediately at support@exploremallorca.es.

10. Cookies

This Privacy Policy should be read together with our Cookie Policy, available on the website, where you will find detailed information on the types of cookies used, their purposes, retention periods and how to manage or deactivate them.

11. Modifications to this policy

Explore Mallorca reserves the right to update or modify this Privacy Policy at any time, especially when required by applicable regulations or when the way in which we process personal data changes.

Any relevant modification will be communicated to users by means of a prominent notice on the website or, where possible and appropriate, by direct notification by email. The date of the last update is indicated in the header of this document.

We recommend you review this policy periodically. Continued use of our services after the publication of changes implies acceptance of the updated policy.