Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

MenzeMedia.de GmbH

Am Wunderhügel 27
58644 Iserlohn
Deutschland

E-mail: datenschutz@mallorca.com

---

2. General Information on Data Processing

2.1 Scope of Processing of Personal Data

As a rule, we process your personal data only to the extent necessary to provide a functional website as well as our content and services. Processing is generally carried out only with your consent or in cases where, for factual reasons, we cannot obtain your consent in advance and the processing of data is permitted by legal provisions.

2.2 Legal Bases

Where we obtain consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. Legitimate interests pursuant to Art. 6(1)(f) GDPR may also serve as the legal basis.

2.3 Data Deletion and Storage Period

Your data will be deleted as soon as the purpose of storage no longer applies. Data may also be stored beyond this period where this is provided for by legal provisions.

---

3. Provision of the Website and Creation of Log Files

Each time our website is accessed, our system automatically collects data:

• Your IP address
• Date and time of access
• Websites from which your system reaches our website
• Browser type and version
• Operating system

The legal basis is Art. 6(1)(f) GDPR. Storage serves to ensure the functionality and security of our IT systems.

---

4. User Account and Classified Ads Services

4.1 Registration

When you register, we collect the following data:

• E-mail address
• Name (optional)
• Password (stored encrypted)

4.2 Classified Ads

When you create an advertisement, we process:

• Advertisement title and description
• Category and location
• Price and contact details
• Uploaded images

This data is displayed publicly on the platform.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

---

5. Cookies and Consent

5.1 Types of Cookies

We use the following types of cookies:

• Necessary cookies: Session management, language settings, cookie consent
• Statistics cookies: Google Analytics for reach measurement, loaded via Google Tag Manager (Section 5.4)
• Marketing cookies: Partner integrations

5.2 Consent Management

When you first visit our website, we display a cookie banner through which you can give your consent for the individual cookie categories. Your consent decision is logged on the server as evidence pursuant to Art. 7(1) GDPR. In doing so, we store the following data:

• Pseudonymised hash of your IP address (SHA-256, no plain-text storage)
• Time of consent
• Scope of consent (which cookie categories were accepted/rejected)
• Type of action (initial consent, withdrawal, change)
• Consent version

Logging is carried out on the basis of our legal obligation pursuant to Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can adjust or withdraw your cookie settings at any time via the “Cookie Settings” link in the footer of the website.

5.3 Legal Basis

The legal basis for technically necessary cookies is Art. 6(1)(f) GDPR. Your consent pursuant to Art. 6(1)(a) GDPR is required for other cookies.

5.4 Google Tag Manager and Consent Signals

We use Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to integrate and control our analytics tools. Tag Manager itself does not collect data for analytics purposes; it is the hub through which other services are loaded.

In doing so, we use Google Consent Mode. All signals requiring consent are set to “denied” by default when the page is accessed — this concerns analytics storage, advertising storage, advertising user data, personalised advertising and personalised content. Only the signals for functionality and security that are necessary for operating the website are enabled from the outset. Only when you give your consent in the cookie banner are the relevant signals changed to “granted”; if you withdraw your consent, “denied” applies again.

Tag Manager itself is loaded every time the page is accessed. Without your consent, it sends only cookieless signals from which Google derives statistical modelling — no cookies are set and no identifiers are stored that could make you recognisable again. The legal basis for this is Art. 6(1)(f) GDPR; for anything loaded only after your consent, it is Art. 6(1)(a) GDPR. Further information can be found in Google’s privacy policy: https://policies.google.com/privacy

---

6. Google Analytics

We use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is loaded exclusively via the Google Tag Manager described in Section 5.4; the Google tag ID stored there is GT-M34V82JW. Statistics cookies are set only after you have given your consent.

6.1 How It Works

Google Analytics uses cookies that enable an analysis of your use of the website. The information generated by the cookie about your use is generally transmitted to a Google server in the USA and stored there.

6.2 IP Anonymisation

We use the “IP anonymisation” function. As a result, Google truncates your IP address within EU Member States before it is transmitted to the USA.

6.3 Opt-Out

You can prevent collection by Google Analytics by disabling statistics cookies in our cookie settings.

Alternatively, you can install the browser add-on for deactivating Google Analytics: https://tools.google.com/dlpage/gaoptout

6.4 Legal Basis

Google Analytics is used on the basis of your consent (Art. 6(1)(a) GDPR). Further information can be found in Google’s privacy policy: https://policies.google.com/privacy

---

7. Reach Measurement with Plausible

In addition, we use Plausible, a reach measurement service that deliberately operates without cookies. Plausible is loaded via Google Tag Manager; the measurement script is retrieved from plausible.io.

What is processed. Plausible records the page accessed, the page from which you arrived, as well as general information about browser, operating system and device type. Your IP address is evaluated solely to determine the country of origin and is not stored.

What is counted automatically. In addition to page views, Plausible automatically counts three activities: downloading a file, submitting a form and clicking a link that leads away from our website. Only the fact that the activity took place and the relevant file or link destination are recorded — not what you entered in a form.

What expressly does not take place. No cookies are set and no identifiers are stored in your browser. No cross-device recognition takes place, and no personal usage profiles are created. The analysis is purely aggregated.

Events that we additionally count. Beyond mere page-view measurement, we record individual, clearly defined events in order to understand at which point our forms are abandoned:

• Beginning a booking process for an experience, together with the identifier of the booked offer
• Opening the enquiry dialogue on a directory page, together with category, concern and language
• Individual steps in the reservation form for food service establishments (form visible, dialogue opened, input started, enquiry accepted or rejected)

These events contain no content entered by you, no names, no e-mail addresses and no amounts.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest lies in reach measurement that does not require cookies or personal data and is therefore particularly data-efficient. For the same reason, this measurement is not linked to your cookie consent.

---

8. Map Display with Mapbox

We display maps on beach pages, in travel and guide content, on directory pages and in real estate classified ads. We obtain these maps from Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA.

What is processed. Map sections, map tiles and map images are retrieved directly from Mapbox by your browser — they do not pass through our servers. In doing so, Mapbox necessarily receives your IP address as well as information about your browser and device, and learns which map section you are viewing.

When they are loaded. Static map images are loaded together with the page. We load interactive maps, which you can zoom and move, only when you request them — by clicking on them or by scrolling them into the visible area.

Address entry. When you enter an address in one of our forms and use the suggestion list, your entry is transmitted to Mapbox to determine suggestions.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest lies in a comprehensible display of locations and error-free address entry. Data is transferred to the USA on the basis of EU Standard Contractual Clauses. Further information: https://www.mapbox.com/legal/privacy

---

9. Affiliate Partners

9.1 Stay22

We work with Stay22 (Stay22 Inc., Kanada) as an affiliate partner. When you use accommodation recommendations, data may be transmitted to Stay22, including:

• IP address
• Device information
• Clicking behaviour on affiliate links

Stay22 sets its own cookies to attribute bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). Further information: https://www.stay22.com/privacy

9.2 Travelpayouts

We use Travelpayouts (Travelpayouts Ltd.) as an affiliate network for travel and flight recommendations. When you use the relevant links, the following data may be transmitted:

• IP address
• Browser and device information
• Clicking behaviour

Travelpayouts uses cookies to attribute bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). Further information: https://www.travelpayouts.com/privacy

9.3 CHECK24

We participate in the CHECK24.net partner programme and integrate CHECK24 iFrame booking forms (CHECK24 Vergleichsportal GmbH, München) on individual pages, through which comparison and booking take place directly on our website. This content is loaded only after you have consented to marketing cookies. Data may be transmitted to CHECK24, including:

• IP address
• Browser and device information
• Clicking and booking behaviour in the comparison calculator

CHECK24 sets its own cookies to attribute bookings; we receive advertising cost reimbursement for bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). Further information: https://www.check24.net

---

10. Hosting and Technical Service Providers

10.1 Vercel

Our website is hosted by Vercel Inc. (San Francisco, USA). Vercel processes data on our behalf pursuant to Art. 28 GDPR. Data is transferred on the basis of EU Standard Contractual Clauses.

10.2 Supabase

We use Supabase (Supabase Inc., San Francisco, USA) as a database and authentication service. Supabase processes data on our behalf pursuant to Art. 28 GDPR.

10.3 Resend

We use Resend (a provider based in the USA) to send e-mails. This includes registration confirmations and password resets, the delivery and forwarding of enquiries from the business directory and real estate listings, and e-mails about the Mallorca.com-Pass and the offers from participating businesses. Resend processes the data on our behalf under Art. 28 GDPR; transfers to the USA are based on the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR.

10.4 Stripe

For payment processing of paid services (directory plans, premium features, Mallorca.com-Pass), we use Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe processes the payment data you enter directly with Stripe (for example, card number, expiry date, security code or Apple Pay or Google Pay data), your name and billing address if you provide them, and transaction data. For the Mallorca.com-Pass, we create a customer account with Stripe without a name or e-mail address, linked only to your Mallorca.com account identifier; we store the Stripe identifiers for the customer, subscription, payment and invoice, the amount, the time of payment, and refunds and chargebacks. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Stripe may transfer data to Stripe, Inc. in the USA on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Stripe acts as a controller for its own purposes, such as fraud prevention and compliance with legal obligations. Further information: https://stripe.com/de/privacy.

10.5 Meilisearch

For the search function in the business directory and on the classified ads platform, we use Meilisearch Cloud (Meili SAS, Paris, Frankreich). Meilisearch processes the entered search terms as well as publicly accessible directory data (company names, categories, locations). Data processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest in an efficient search function). The data is stored on servers in the EU (Frankfurt).

10.6 Brevo

For sending our newsletter, delivering requested documents and managing the related contact lists, we use Brevo (Brevo SAS, 106 boulevard Haussmann, 75008 Paris, Frankreich). Brevo processes this data on our behalf pursuant to Art. 28 GDPR; the servers are located in the European Union. The specific data involved is set out in Sections 11 and 12.

Brevo reports back to us whether a message was delivered, opened or unsubscribed from, and whether it was returned as undeliverable. We store this feedback in order to keep distribution lists clean and reliably implement unsubscribes. If a message cannot be sent immediately due to an exhausted sending quota, we temporarily place it in a queue with the necessary details and deliver it automatically afterwards.

10.7 AI Search in the App

If you ask the AI search a question in the app, we transmit your question to providers of AI language models so that they can answer it. These are currently OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, and OpenAI, L.L.C., San Francisco, USA) and Anthropic (Anthropic Ireland Ltd., Dublin, Ireland, and Anthropic PBC, San Francisco, USA). If you have shared your location or information about your trip with the app, this information may be added to the question to make the answer relevant. Your name and e-mail address are not transmitted. The providers process the data on our behalf and do not use it to train their models. Before your first question, we obtain your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the app settings; AI search will then only be available again once you consent again. Transfers to the USA take place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. We review answers you report via “Report answer” together with the question.

10.8 Voice Input

If you use voice input in the app, your device’s speech recognition (Apple or Google) converts your speech into text. The app receives only the recognised text, not an audio recording. Processing by Apple or Google is governed by their respective privacy policies. Voice input only starts when you tap it and have allowed access to the microphone and speech recognition (Art. 6(1)(a) GDPR).

10.9 Signing In with Apple or Google

You can sign in to the app with your Apple or Google account. We receive an identifier, your e-mail address (a relay address from Apple if you choose) and, if you share it, your name from the respective provider. We do not receive passwords. The processing serves to provide your account (Art. 6(1)(b) GDPR). If you delete your account, we also revoke the connection to your Apple account.

10.10 Automated Checking of Uploaded Images

When you upload an image, we may check it automatically before we display it. The content is then checked by OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, and OpenAI, L.L.C., San Francisco, USA) on our behalf through its moderation interface; the data is not used to train the models. In addition, the Canadian Centre for Child Protection (Winnipeg, Canada) may compare the image against a database of known depictions of child sexual abuse through its Arachnid Shield service. If there is a match, we block the upload and review the case; we may pass it on to law enforcement authorities. The legal basis is Art. 6(1)(f) GDPR (protection of the platform and of third parties) and, where we are legally obliged to carry out the check, Art. 6(1)(c) GDPR. Transfers to the USA take place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses; for Canada, an adequacy decision of the EU Commission is in place.

---

11. Newsletter

You can subscribe to our newsletter on our homepage.

What we collect. Your e-mail address, your first name if requested, as well as your language setting and information on where on the website you signed up.

Confirmation procedure. We use a two-step procedure: after you sign up, we send you an e-mail with a confirmation link. We add you to the distribution list only once you click it. The link is valid for 24 hours and can be used only once; for this purpose, we store a one-time identifier together with your e-mail address. If you do not confirm, you will not receive a newsletter.

Legal basis. Your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future — via the unsubscribe link in every newsletter e-mail or informally at datenschutz@mallorca.com. Processing remains lawful until withdrawal. We store the time of registration and the time of confirmation as evidence of consent pursuant to Art. 7(1) GDPR.

---

12. Requesting a Market Report

You can request the document free of charge on the real estate market report page.

What we collect. First name, last name and e-mail address are required. Your country, information on whether you wish to buy or sell, and the region in which you are interested are voluntary. You can also subscribe to the newsletter; if you do so, Section 11 applies.

Confirmation procedure. Here too, you first confirm via a link in an e-mail. Only afterwards do we send you the market report. The link is valid for 24 hours and can be used once.

Legal basis. Your consent pursuant to Art. 6(1)(a) GDPR, which may be withdrawn at any time with effect for the future via the unsubscribe link or at datenschutz@mallorca.com. We store the time of the request and the time of confirmation as evidence pursuant to Art. 7(1) GDPR.

---

13. Personal Enquiry via Our Enquiry Form

You can describe your concern directly to us via our enquiry form.

What we collect. Your name and e-mail address are required. Your telephone number, country, the subject of your enquiry, the region in which you are interested, your budget range and your message to us are voluntary.

What happens to it. We create your enquiry in our customer management system and notify our team by e-mail via Brevo (Section 10.6) so that someone can take care of it. No data is passed on to third parties.

Legal basis. For processing your enquiry, Art. 6(1)(b) GDPR (pre-contractual measure). For voluntary additional information that enables us to provide a more suitable response, Art. 6(1)(f) GDPR; you may object to this pursuant to Art. 21 GDPR. You may request deletion at any time at datenschutz@mallorca.com.

---

13a. Contact via WhatsApp

On individual pages of our food and drink section, we offer you the option of sending us a booking enquiry via WhatsApp. The button merely opens a link to WhatsApp (wa.me) with a pre-filled message text; the message is only sent once you send it yourself in WhatsApp. No data is transferred to WhatsApp or Meta when the button is displayed; we do not embed any scripts or pixels from Meta. The provider of the service is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (a company of the Meta group). The processing of your data within WhatsApp (including your telephone number, your profile name and the content of your message) is governed by WhatsApp's privacy policy (https://www.whatsapp.com/legal/privacy-policy-eea) and its terms of service; this may involve a transfer to the USA, for which Meta relies on the EU-US Data Privacy Framework. We receive your message on a WhatsApp Business account used for business purposes, reply to it and pass on the details required for the booking (preferred date, number of people, your first name and the response) to the establishment concerned. The legal basis is Art. 6(1)(b) GDPR (steps towards a contract at your request) and Art. 6(1)(f) GDPR (our legitimate interest in straightforward communication via the channel you have chosen). We delete the chat histories no later than twelve months after the last message, provided no statutory retention obligations prevent this. We do not use WhatsApp to contact you unsolicited, and we do not transfer any address book data to WhatsApp. If you do not wish to use WhatsApp, the enquiry form is available to you on the same page.

We count how often the button is clicked exclusively via our cookie-free reach measurement with Plausible (Section 7); no content of your message is recorded in the process.

---

14. Your Rights as a Data Subject

You have the following rights:

• Right of access (Art. 15 GDPR): Information about your processed data
• Right to rectification (Art. 16 GDPR): Rectification of inaccurate data
• Right to erasure (Art. 17 GDPR): Deletion of your data
• Right to restriction (Art. 18 GDPR): Restriction of processing
• Data portability (Art. 20 GDPR): Receipt of your data in a machine-readable format
• Right to object (Art. 21 GDPR): Objection to processing
• Right to withdraw consent (Art. 7(3) GDPR): Withdrawal of consent given
• Right to lodge a complaint (Art. 77 GDPR): Complaint to a supervisory authority

14.1 Data Export (Art. 15 & 20 GDPR)

You can download a copy of all your personal data at any time in a structured, commonly used and machine-readable format (JSON). You can find this function in your dashboard under Settings → Export my data. The export includes:

• Profile data (name, e-mail, settings)
• All advertisements created
• Messages
• Favourites and saved searches
• Consent history

14.2 Account Deletion (Art. 17 GDPR)

You can independently delete your user account at any time via Settings → Delete account. After the deletion request, a 14-day grace period applies during which you can withdraw the deletion. After this period has expired, your data will be irrevocably deleted or anonymised:

• Profile data is anonymised
• Advertisements are deactivated
• Messages, favourites and saved searches are deleted
• Your authentication account is permanently deleted

The deletion request is logged as evidence (IP hash, timestamp, reason).

An active subscription ends when you delete your account; no pro rata refund is made.

14.3 Exercising Your Rights

To exercise your rights, you can use the self-service functions in your dashboard or contact us at datenschutz@mallorca.com. We will process your request within 30 days.

14.4 Competent Supervisory Authority

The data protection supervisory authority of the state of North Rhine-Westphalia, where our registered office is located, is responsible for us:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Postfach 20 04 44
40102 Düsseldorf
Deutschland

Telephone: +49 211 38424-0
Complaint form: https://www.ldi.nrw.de/beschwerde

Regardless of this, pursuant to Art. 77 GDPR, you may also contact the supervisory authority of your place of residence or workplace.

---

15. Special Provisions for Spain (LOPD)

Pursuant to Spanish data protection law (Ley Orgánica 3/2018 - LOPD):

• Minors under 14 years of age require the consent of a legal guardian.
• You may also assert your rights before the Agencia Española de Protección de Datos.

---

Contact Form in Directory

When you use a contact form on a directory listing page, we process:

• Your name and e-mail address
• Your telephone number (optional)
• Your message text
• Category-related information about the enquiry, for example period, location or preferred date

Claimed Directory Listings

For claimed listings, we store this data in our database, forward your enquiry by e-mail to the owner of the listing and display it in their dashboard.

Unclaimed Directory Listings and Enquiry Mediation

For unclaimed listings, we store the data exclusively on the server using our administrative service role. The provider has no dashboard access to the stored enquiry. The enquiry is delivered by e-mail to the selected provider. If you expressly consent to forwarding, we additionally send your enquiry to up to 4 other suitable providers, which we select based on category and geographical proximity.

The enquiry and mediation data is stored for 12 months and then automatically deleted. You can withdraw any consent given at any time with effect for the future and request deletion of the data by e-mail at info@mallorca.com.

---

Contact Enquiry and Search Request for Real Estate Classified Ads

Enquiry About a Listing

When you submit an enquiry via the contact form of a real estate listing, we process:

• Your name
• Your e-mail address
• Your telephone number (optional)
• Your message

We forward this data to the provider of the listing in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure). We store the notice text displayed on the form together with a timestamp as evidence of consent.

Storage and Retention Period

In addition to the enquiry itself, we store:

• A pseudonymised hash of your IP address (SHA-256, no plain-text storage) — this serves exclusively to prevent misuse and limit the number of enquiries (rate limiting), not to identify you
• The user agent of your browser
• The page from which you submitted the enquiry

This data is deleted as soon as the purpose for which it is stored no longer applies: in the case of an enquiry, this is when the mediation between you and the provider has been completed and no further response is expected. You can request early deletion at any time at datenschutz@mallorca.com.

Forwarding of the Response and Translation

If the provider responds to your enquiry, we forward the response to you via a relay address — neither your e-mail address nor that of the provider is disclosed directly to the other party. If the response is written in a language other than your own, it is machine-translated. For this purpose, a copy of the message is transmitted to OpenAI (OpenAI, L.L.C., USA) exclusively for this purpose; if this service is unavailable, it is transmitted alternatively to Anthropic (Anthropic PBC, USA).

Both providers process this data on our behalf pursuant to Art. 28 GDPR. Data is transferred on the basis of EU Standard Contractual Clauses.

Optional Account

After your enquiry, you can create a user account in order to view your enquiries centrally. The account is created only if you actively click the relevant link and separately consent to data processing — never automatically.

Search Request for Similar Properties

You can set up a search request to be notified by e-mail about newly posted listings that match your criteria. For this purpose, we store your search criteria (e.g. region, price range, property type, number of rooms), your name and your e-mail address. The legal basis is your consent (Art. 6(1)(a) GDPR); here too, we store the displayed notice text with a timestamp as evidence. Messages are sent exclusively by mallorca.com — your data is not passed on to third parties.

Unsubscribe and Deletion

Every forwarded response e-mail and every search request e-mail contains a link through which you can stop the respective channel at any time with effect for the future. Regardless of this, you can request information, rectification or deletion of your data at any time at datenschutz@mallorca.com.

---

Social Features of the Mallorca.com App

This section supplements the other sections for the social features of the Mallorca.com app: posts, profile, following, likes, blocking and reporting. We are releasing individual features step by step — in particular videos, comments, direct messages, features for meeting people and the date-of-birth prompt. What is said about them below applies as soon as the respective feature is available in the app.

Where this section provides otherwise than the other sections, it takes precedence for the social features. This applies in particular to age: the age stated in Section 15 (14 years) does not apply to the social features; a minimum age of 16 applies to them, and a parent's or guardian's consent does not replace it.

Posts and Profile

When you create or publish a post, we process:

• the images and the text of your post, its language and the time of publication; we store images and text as soon as you upload them as a draft — drafts are not public
• your statement as to whether the post was created or altered with artificial intelligence
• where the app offers it: a place chosen by you, hashtags and a link
• a technical note for each upload (identifier of the version of the rules it was based on, time and file)

Your profile in the social features uses the username, the display name and the profile picture of your Mallorca.com account. We also store who you follow, which posts you like, who you block and the time up to which you have read your activity overview.

What is public. Your published posts, together with username, display name and profile picture, are publicly accessible — also for people without an account and, where we display posts there, on the website. Who you follow and who follows you can be seen by other logged-in users. If you like a post, the person who published it can see that; the number of likes may be displayed publicly.

Legal basis. Art. 6(1)(b) GDPR (provision of the social features under the Terms of Service). Where posts contain information about other people, we process it on the basis of Art. 6(1)(f) GDPR (our legitimate interest in making the content published by users available); the people concerned can report the post or contact datenschutz@mallorca.com.

Storage period. Until your account is deleted or we delete the post or the respective item at your request. You can withdraw a published post in the app; it is then no longer displayed but remains stored. The periods in the subsection on reports apply to the saved copy of a post.

Camera, Photos and Image Information

The app accesses the camera and photos only if you allow it and take or select an image. Before storing them, we process post photos so that the additional information embedded in the image file (EXIF, XMP and IPTC — for example where and when the photo was taken, and the device) is removed. We cannot guarantee this for profile pictures and for videos: they may be stored as you upload them. If necessary, remove location information from such files before uploading.

We store post images and profile pictures with Supabase (Section 10.2).

Date of Birth and Age Tier

As soon as the app asks for your date of birth, we store it in order to check and enforce the minimum age for the social features (16 years) and to reserve features for meeting people for people aged 18 or over. The date of birth is not displayed publicly and is returned neither to other users nor to the app; only the age tier calculated from it is used (under 16, 16 to 17, 18 or over). Once you have entered the date of birth, you cannot change it yourself; if it is wrong, we correct it when you write to support@mallorca.com. As soon as the app asks for your agreement to the Terms of Service for the social features, we record when you agreed to which version. Once the date-of-birth prompt has been introduced, we cannot enable the social features without the date of birth; the other services are not affected.

Legal basis. Art. 6(1)(b) GDPR (performance of the user contract with its minimum age) and Art. 6(1)(f) GDPR (our legitimate interest in protecting minors). To check the minimum age of 16 we process neither an identity document nor biometric data. How we check age for features for meeting people, and which data we process for that, will be set out here before those features launch.

Storage period. For as long as your account exists.

Reports, Decisions and Complaints

When you report a post or a profile, we process the reported content, the reason you selected, your explanation, your declaration that the report is correct to the best of your knowledge, the language and time of the report and — depending on how you report — your account, the identifier of your app installation or your e-mail address. To limit abusive requests we process your IP address briefly in the server's working memory; if you report on the web without an account, we additionally store hash values of your IP address and of your e-mail address for seven days.

When a post is reported, we save the text and image of the post in the state in which it was reported. If a logged-in user reports a post, it may be hidden provisionally and automatically until a person has reviewed the report; we do not currently use automated detection of reported content. We store decisions together with their reasons, and any complaint against the decision, with the case. We send notices about this by e-mail (Section 10.3). We do not tell the person who published the post who made the report, unless we are legally obliged to.

Legal basis. Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065 (notice and action mechanism, statement of reasons for decisions) and Art. 6(1)(f) GDPR (our legitimate interest in preventing misuse and defending ourselves against claims).

Storage period. We delete a case concerning a post — report, saved content, decisions and complaints — six months after the last decision that was communicated; if there was no decision, twelve months after the case was opened. We do not delete while a report or complaint is still open or a decision that has been taken has not yet been communicated. We delete reports about profiles 180 days after receipt, provided a decision has been made on them.

Videos

Where the app shows videos, we deliver them via Mux, Inc. (San Francisco, USA). When a video is played, Mux necessarily receives your IP address as well as information about the device and the playback.

As soon as you can publish your own videos in the app, the following also applies: your video is transmitted to Mux for conversion into playable formats and for delivery. We additionally store the original file with Hetzner Online GmbH (Gunzenhausen, Germany) on servers in Germany. If you delete your account or the video is deleted, we arrange for deletion at Mux and at Hetzner. We will name here any further technical service providers involved in the processing before the feature launches.

Mux and Hetzner process this data on our behalf pursuant to Art. 28 GDPR. Data is transferred to Mux in the USA on the basis of the EU-US Data Privacy Framework or, failing that, the EU Standard Contractual Clauses; you can obtain further information on this at datenschutz@mallorca.com.

Legal basis. Art. 6(1)(b) GDPR; for playback without an account Art. 6(1)(f) GDPR (our legitimate interest in stable delivery).

Direct Messages

As soon as direct messages are available in the social features of the app, the following applies; it does not concern messages about classified ads or directory, property or booking enquiries. We store your messages, the participants and the times in order to deliver and display the messages. Messages are not end-to-end encrypted. We do not read messages and do not search them without cause. We look only at a message that has been reported to us, and only as far as is necessary to review the report, or if we are obliged to by law or by an authority.

Legal basis. Art. 6(1)(b) GDPR; for the review of reported messages Art. 6(1)(c) GDPR in conjunction with the respective statutory obligation, otherwise Art. 6(1)(f) GDPR (our legitimate interest in preventing misuse).

Storage period. Messages remain stored for as long as at least one of the accounts involved exists. By way of exception to Section 14.2, the following applies to these direct messages: if you delete your account, messages you sent remain readable for the recipients, but without attribution to your profile. We keep reported messages separately only for as long as the handling of the report and a possible complaint require.

Deletion and Data Export

If you delete your account, we delete — once the grace period has expired (Section 14.2) — your posts including images and videos, your likes, and your follow and block relationships; your profile is anonymised. Reports that you made yourself are detached from your account. If a case (report, decision or complaint) still exists for one of your posts, we keep the content saved for that case without reference to your account, and only for that case, until the periods stated above have expired; we keep no copy of your other posts.

The data export (Section 14.1) also contains your post data together with information about the images (not the image files themselves), your likes, the accounts and businesses you follow, the accounts you have blocked and your own reports. You can request copies of your images at datenschutz@mallorca.com.

---

Mallorca.com-Pass

This section supplements the other sections for the Mallorca.com-Pass and the offers from participating businesses.

When You Buy a Pass

What we process. Your Mallorca.com account identifier, price and term, the language, the version of the terms you accepted, your cancellation, your consent to the immediate start of the pass (timestamp, wording version, language), the country set as the region on your device, and the payment data described in Section 10.4. We use this information to provide, bill, cancel and refund the pass. We use the country of your device's region only for statistics.

Legal basis. Art. 6(1)(b) GDPR; for retaining payment records, Art. 6(1)(c) GDPR in conjunction with § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code).

When You Redeem an Offer

What we process. For each redemption, we store the business, the time and calendar day, the group size, the redeemed offer, an estimated value, your first name and the first letter of your surname, and a random identifier for your app installation. We do not store location data in this process. We need this information to display the live voucher, enforce the businesses' limits (for example, how often you may use an offer there), detect abuse and show you your savings. To limit abusive requests, we briefly process your IP address in the server's working memory.

What the business sees. We do not provide the business with any data about you. It only sees what you show it on your screen: the live voucher with the business's name, your first name and the first letter of your surname, the group size and the offer. We and the business each act as independent controllers; there is no joint controllership.

Legal basis. Art. 6(1)(b) GDPR; for detecting abuse, Art. 6(1)(f) GDPR (our legitimate interest in enforcing the offer's rules in relation to guests and businesses).

Push Notifications

If you allow notifications, we store your device's push identifier. For delivery, we use the Expo service provided by 650 Industries, Inc. (USA), which forwards the notification to Apple's service (Apple Push Notification Service) or Google's service (Firebase Cloud Messaging). Expo processes the data on our behalf under Art. 28 GDPR; transfers to the USA are based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your device's settings.

For Participating Businesses

What we process. The name, e-mail address and telephone number of the contact person we write to for activation, and the identifier of the account managing the offer. We also process evidence of acceptance of the participation terms (account, time, version, wording, language and a checksum of the text). In addition, we process the offer data: offer type, days of the week, blocked dates, exclusions, limits per guest, the business's own notes and photos. For the activation link, we store only checksums (hashes) of the entered e-mail address and the IP address to protect against abuse; we delete lookup records after 48 hours.

Automated review. Before publication, we automatically review the business's own notes and photos using OpenAI's moderation service (OpenAI Ireland Ltd., Dublin, Ireland, and OpenAI, L.L.C., San Francisco, USA); only the note text or photo is transmitted. OpenAI processes the data on our behalf under Art. 28 GDPR; transfers to the USA are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Section 10.10 additionally applies to photos. If we reject a note or photo, we state the reason; you can request a review by a person. We store photos without embedded additional information (for example, the location where the photo was taken and the device) at Supabase (Section 10.2) and display them publicly with the offer.

Legal basis. For the data of the business and its contact person, Art. 6(1)(b) GDPR where the business itself is a party to the contract; otherwise, Art. 6(1)(f) GDPR (our legitimate interest in working with the business). For evidence of acceptance, Art. 6(1)(f) GDPR (evidence of contract formation) in conjunction with Art. 3 of Regulation (EU) 2019/1150 applies. Identifiable people in photos may only be shown with their consent; the business is responsible for ensuring this.

Retention Period

• Pass, payments and refunds: while the pass is active and afterwards until the commercial and tax law retention periods of up to ten years for payment records expire.
• Redemptions: for as long as your account exists. If you delete your account, we remove the link to you, your name and the device identifier from the redemptions; only anonymous figures remain.
• Businesses' evidence of acceptance: for the duration of participation and afterwards until five years have elapsed (limitation period under Art. 1964 of the Spanish Código Civil).
• Offer data and photos: until the business deletes them or participation ends; we delete photos within 30 days afterwards at the latest.

Your Rights

The rights in Section 14 apply. Data export (Section 14.1) and account deletion (Section 14.2) also cover your pass data and redemptions; even after deletion, we retain payment records for as long as the law requires.

---

Online Withdrawal

Withdrawal Declaration

When you withdraw from a contract using the “Withdraw from contract” function, we process:

• Your name
• The contract type and your details about the contract (for example, order number, ad, listing or the e-mail address of your account)
• The e-mail address to which we send the acknowledgment of receipt
• The date and time of receipt, a receipt number and the language in which you submitted the declaration
• If you withdraw using an order's withdrawal link: the association with that order
• If you are signed in: your account identifier as evidence that the declaration came from your account
• The sending status of the acknowledgment of receipt and the processing status, including a processing note and the identifier of the person handling it

We use this data to receive your withdrawal, acknowledge its receipt, associate the withdrawal with the contract and carry it out. If you provide an e-mail address when withdrawing from an experience voucher purchase, we compare it with the e-mail addresses of open orders so that we can resend your order's withdrawal link to the e-mail address of the order. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a BGB (obligation to provide an electronic withdrawal function and acknowledge receipt), as well as Art. 6(1)(b) GDPR (reversal of the contract).

Acknowledgment of Receipt and Receipt Page

We send the acknowledgment of receipt by e-mail through our sending service provider (see Section 10.3). It contains the details from your declaration and the date and time of receipt. We show you the same details on a receipt page. This page is accessible only via the receipt number contained in the page's address and in the acknowledgment of receipt; it remains accessible for as long as we store the declaration. Do not share the link if you do not want others to see the details.

Protection Against Abuse

We also store a hash of your IP address (SHA-256, no storage in plain text) and count how many acknowledgments of receipt have been triggered in the last hour to an e-mail address and from an internet connection. This serves solely to limit mass abuse of the function. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting third parties from unwanted e-mails and protecting the function. We delete the hash after 30 days.

Retention Period

We retain the withdrawal declaration and the evidence of its handling until three years have elapsed after the end of the year in which the case was completed. Claims arising from the withdrawn contract can be asserted during this period (regular limitation period, §§ 195, 199 BGB); we must be able to prove receipt and handling during this time (Art. 6(1)(f) GDPR, Art. 17(3)(e) GDPR). As long as a case has not been completed, the declaration remains stored. Any retention obligations under tax or commercial law that apply to payment records remain unaffected.

Your Rights

The rights stated in Section 14 apply. You can request early deletion at datenschutz@mallorca.com to the extent that we no longer need the data as evidence.

---

Online Cancellation

Cancellation Declaration

When you cancel a contract via “Cancel contracts here”, we process:

• Your name
• The e-mail address you provide and to which we send the acknowledgment of receipt
• The contract being cancelled, the type of cancellation (ordinary or extraordinary), your reasons for an extraordinary cancellation, and the time at which the contract is to end
• The date and time of receipt, a receipt number and the language in which you submitted the declaration
• The association with your account and your contract, if we can associate the e-mail address you provide with an account, and the processing status

We use this data to receive your cancellation, acknowledge its receipt, associate the cancellation with your contract and carry it out. To do so, we compare the e-mail address you provide with the e-mail addresses of user accounts. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 312k BGB and, to the extent that we terminate the contract, Art. 6(1)(b) GDPR.

Acknowledgment of Receipt, Protection Against Abuse and Retention Period

The provisions in the “Online Withdrawal” section apply accordingly to the acknowledgment of receipt and the receipt page, protection against abuse, the retention period and your rights; the cancellation declaration takes the place of the withdrawal declaration.

---

Status: 2026-11-11