Privacy policy
Privacy Policy
Summary in three sentences: When a booking is made, the controller shares the data with the host, who needs it as the contractual partner and, from the moment of transmission, decides independently how it is used. The controller has no access to card details; these are processed by the payment service provider. Behaviour is analysed only with the data subject's consent.
1. Controller
MenzeMedia.de GmbH, Am Wunderhügel 27, 58644 Iserlohn, Germany Email: datenschutz@mallorca.com
No data protection officer has been appointed because the legal requirements for doing so are not met.
2. Legal bases for processing
Processing relies on four legal bases: the data subject's consent (Art. 6(1)(a) GDPR), the performance of the contract with the data subject (point (b)), a legal obligation (point (c)), and the controller's legitimate interest (point (f)). Where processing relies on a legitimate interest, that interest is stated for the processing concerned.
The information required for a booking is mandatory. Without it, the contract cannot be entered into or performed; a booking is then not possible.
3. Visits to the website
Server log files. On every visit, the IP address, time and duration, page accessed, data volume, referring page, browser and operating system are collected. This is technically necessary and serves security purposes — Art. 6(1)(f) GDPR, legitimate interest in secure operation. Deletion takes place no later than after 30 days, or, where a specific attack is suspected, once it has been investigated.
Cookies. Technically necessary cookies are used for language selection, session, booking process and cookie choice (§ 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), Art. 6(1)(f) GDPR). All other cookies are used only with the data subject's consent (§ 25 (1) TDDDG, Art. 6(1)(a) GDPR). The cookie choice can be changed at any time through “Cookie Settings” in the footer. To document it, the time, scope and a pseudonymised hash of the data subject's IP address are stored (Art. 7(1) GDPR) for three years.
Audience measurement. The controller uses Google Analytics through Google Tag Manager (Google Ireland Limited, Dublin). Both services are loaded only after consent has been given in the banner; before then, nothing is transmitted to Google. The legal basis is the data subject's consent. Google may process data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and Standard Contractual Clauses also apply. Google deletes user-related data no later than after 14 months. Further information: https://policies.google.com/privacy
Maps. The controller's server retrieves the map image on property pages from Mapbox and delivers it. The data subject's browser does not connect to Mapbox and their IP address is not transmitted. Where an interactive map is used in individual places, it is loaded only after the data subject's consent.
Search. The controller uses Meilisearch Cloud (Meili SAS, Paris), with servers in the EU, processing on the controller's behalf pursuant to Art. 28 GDPR. Legitimate interest: a functioning search facility.
4. Booking accommodation
The following data is processed: name, address, email address and telephone number of the person making the booking · only the names of fellow travellers · accommodation, travel dates, number of travellers, extras, pets, comments from the person making the booking · price, payments, due dates, payment status, transaction identifiers · no ID card or passport data (the host collects this at check-in; see 4.3) · for documentation, the notice text shown to the person making the booking with a timestamp, a pseudonymised hash of their IP address and their browser identifier.
Legal basis: Art. 6(1)(b) GDPR; for documentation data, point (f) (legitimate interest in preventing misuse and preserving evidence).
4.1 Disclosure to the host
The contractual partner of the person making the booking is the host, not the controller. The host receives the data needed to perform the agreement: name, contact details, number and names of travellers, travel period, extras, comments from the person making the booking and the information needed to meet the host's registration obligations.
From the moment of transmission, the host is independently responsible (Art. 4(7) GDPR). The host processes the data under their own notices, not on the controller's behalf. The controller has contractually agreed with the host that the data is used only for the stay and the host's legal obligations, and not for advertising purposes or for third parties. The booking confirmation identifies the host. Requests for access to or deletion of data concerning the host's processing are to be addressed directly to the host. Legal basis: Art. 6(1)(b) GDPR.
The hosts are based in Spain, and therefore in the EU. Should a host or property manager exceptionally be located outside the EU and the EEA, the transfer is based on Art. 49(1)(b) GDPR; the person making the booking will be notified before booking.
4.2 Fellow travellers
Where a booking is made for others, the controller processes only their names received from the person making the booking (Art. 14 GDPR), for the same purposes, on the same legal bases and for the same period. The person making the booking is asked to inform fellow travellers about this policy. By making the booking, that person confirms that they are authorised to provide this information.
4.3 Registration obligations in Spain
Spain requires hosts to collect data on all arriving guests and report it to the security authorities. The host collects this data at check-in, not the controller. During the booking process, the controller asks only for the names of travellers so that the host is informed of who is arriving. The controller does not store ID card or passport data.
The controller has a separate reporting obligation. As an intermediary platform, the controller must report every booking to the Spanish authorities within 24 hours: the name and contact details of the person making the booking, booking reference and date, arrival and departure, address of the accommodation, and payment date and payment method. Changes and cancellations are likewise reported. Identity document data is not included.
The legal basis for the controller's report and for the host's collection of identity document data is, in each case, Art. 6(1)(c) GDPR in conjunction with Spanish provisions; the legal basis for passing the names to the host is Art. 6(1)(b) GDPR. The Balearic tourist tax is owed by the traveller as the guest; the host must remit it (Art. 6(2) Ley 2/2016). The tax is payable on site to the host and is not processed through the controller.
4.4 Payment processing
Payment is handled through Stripe (Stripe Payments Europe, Limited, Dublin; technically also Stripe, Inc., USA). The controller has no access to card details. They are entered directly in Stripe’s input form; the controller receives only payment status, payment method type, the final digits and transaction identifiers. The name, email address, billing address, amount and a booking reference are transmitted to Stripe.
Stripe acts partly on the controller's behalf (Art. 28 GDPR), but as an independent controller for fraud prevention, anti-money-laundering measures and its own risk management; Stripe’s own notices apply in that respect. Legal bases: point (b) for processing the payment, point (f) for fraud prevention, and point (c) for Stripe’s legal obligations. Transfers to the United States take place through Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. Further information: https://stripe.com/de/privacy
4.5 Emails about bookings
Confirmations, notice and confirmation of the remaining payment, arrival information and cancellation confirmations are sent through Resend (Resend, Inc., USA; processing on the controller's behalf pursuant to Art. 28 GDPR, Standard Contractual Clauses). These emails form part of the contract and are not advertising. It is therefore not possible to unsubscribe from them while the booking is ongoing.
5. Enquiries without a booking
For enquiries, the name, contact details and content of the message are processed in order to reply — Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise point (f). The data is deleted once the matter has been dealt with, no later than after two years, unless a retention period applies.
6. Newsletter
On newsletter sign-up, the email address is processed in order to send travel tips, offers and new fincas — Art. 6 (1) (a) GDPR.
The double opt-in procedure is used: a confirmation email is sent after sign-up, and the recipient is added to the mailing list only once the link in it is clicked. The sign-up, the confirmation and the time of both are logged so that consent can be evidenced.
The controller measures whether newsletter recipients open a message and which links they click, and tailors the content accordingly. The basis is the same consent as for sending the newsletter; the form provides this information before sign-up.
Sending is carried out by Brevo on the controller's behalf (Art. 28 GDPR), see section 10.
Consent can be withdrawn at any time via the unsubscribe link in every email or informally by contacting the controller. Withdrawal takes effect for the future; the lawfulness of processing up to that point is unaffected. The address is then deleted from the mailing list, and only the record of consent and its withdrawal is retained.
7. User account and cross-portal use
A booking can be made without an account. When an account is created, the email address, name, a password stored in encrypted form, and registration and use data are processed (Art. 6(1)(b) GDPR). The data subject can delete the account at any time; booking data subject to retention obligations remains unaffected.
fincas.de and mallorca.com are operated by the same company and use a shared database. The same GmbH is responsible in both cases; no data is disclosed to another company. The data subject can view their account and bookings on both portals. There is no cross-portal tracking of behaviour.
8. Offering accommodation
For hosts or agencies, the following data is processed: name or company name, address, contact person, contact details · tax identification number, VAT ID, commercial register number, and, for natural persons, date of birth · bank details · property data including address, images, prices and availability calendar · licence and registration numbers · contract and accounting data.
Legal bases: Art. 6(1)(b) GDPR for the cooperation, and point (c) for tax reporting and retention obligations. The name, address and licence numbers of commercial hosts are displayed publicly on the property page in accordance with a legal obligation.
Reporting to the tax authorities. Every year, the controller must report to the tax authorities the remuneration it has paid to hosts, including their identification details and the address of the unit (Platform Tax Transparency Act, “DAC7”). The recipient is the Federal Central Tax Office, which forwards the data to the competent foreign tax authority. Guests are not affected.
9. Availability calendars from other portals
To display only available periods, the controller retrieves the calendars made available by hosts. They often come from Airbnb or Booking.com and generally contain only periods and technical identifiers. Depending on the portal, they may also contain a name or booking reference, i.e. data of people who did not book through the controller. This data is not collected from those people, but from the host’s calendar (Art. 14(2)(f) GDPR).
Only the occupied days are evaluated. All other data is discarded when imported and is not stored. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in preventing double bookings.
Conversely, the controller provides every host with a calendar of bookings made through the controller. It contains only periods and a booking number, no guest names.
10. Service providers used
| Service | Provider | Purpose |
|---|---|---|
| Hosting | Vercel Inc., USA | Delivery of the website |
| Database, sign-in, files | Supabase Inc., USA | Booking and property data |
| Payments | Stripe Payments Europe, Ltd., Ireland | Section 4.4 |
| Email delivery | Resend, Inc., USA | Section 4.5 |
| Newsletter delivery | Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France) | Section 6 |
| Search | Meili SAS, France | Section 3 |
| Maps | Mapbox Inc., USA | Section 3, server-side |
| Background processes | Trigger.dev | Calendar synchronisation, payment reminders |
| Audience measurement | Google Ireland Limited, Ireland | Section 3, only with consent |
With the exception of Stripe (see Section 4.4), all process data on the controller's behalf pursuant to Art. 28 GDPR and are contractually bound; Google does so only on the basis of the data subject's consent. For transfers to the United States, Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, the EU-U.S. Data Privacy Framework apply.
11. Retention periods
| Data | Period |
|---|---|
| Server log files | 30 days |
| Booking data | Until the end of the stay, then in accordance with retention periods |
| Invoices and booking records | 10 years (§ 147 AO (German Fiscal Code)) |
| Commercial correspondence, e.g. booking correspondence | 6 years (§ 257 HGB (German Commercial Code)) |
| Enquiries without a booking | Until resolved, at most 2 years |
| User account | Until deletion by the data subject |
| Proof of the cookie choice | 3 years |
| Newsletter sign-up | until withdrawal; record kept 3 years after |
| Availability data from calendars | Until the period has elapsed |
The data is then deleted or anonymised. During an ongoing retention period, processing is limited to storage.
12. Recipients of the data
Recipients are the host of the accommodation (4.1), the payment service provider (4.4), the controller's service providers (10), Spanish authorities within the scope of reporting obligations (4.3 — the controller reports booking data, the host reports identity document data), the tax authorities (8), as well as tax advisers, lawyers and auditors where necessary. Further disclosure takes place only with the data subject's consent or where necessary to perform the contract, legally required, or serving to enforce legal claims.
13. Rights of the data subject
The data subject may request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20), withdraw consent at any time (Art. 7(3)), and lodge a complaint with a supervisory authority (Art. 77).
The responsible authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de. The data subject may also contact the authority where they live or, in Spain, the Agencia Española de Protección de Datos.
An email to datenschutz@mallorca.com is sufficient; the controller will reply within one month. Data subjects are asked not to send a copy of their identity document unless requested.
Data already sent to the host is processed by the host under their own responsibility. Requests concerning that processing are to be addressed to the host; at the data subject's request, the controller will forward them.
14. Right to object
Where data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), the data subject may object under Art. 21 GDPR if there are grounds relating to their particular situation.
The data subject may object to direct marketing at any time and without giving reasons. The data will then no longer be processed for that purpose.
An objection may be submitted informally to datenschutz@mallorca.com.
15. Other information
No automated decision-making. No profiling under Art. 22 GDPR that produces legal effects concerning the data subject is carried out. The order of search results is based on objective criteria, which are explained on the platform.
Security. The controller takes technical and organisational measures pursuant to Art. 32 GDPR. Transmission is encrypted throughout (TLS); access to booking data is restricted to the people who need it.
Changes. This policy will be updated if the controller's processing or the legal situation changes. The version published here from time to time applies.
As of: September 2026