Privacy Policy
Last updated: 14 August 2026
Privacy Policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:
menzemedia.de GmbH
Am Wunderhügel 27 58644 Iserlohn Germany
Email: datenschutz@mallorca.com
2. General Information on Data Processing
2.1 Scope of processing
We only process our users' personal data to the extent necessary to provide a functioning website along with our content and services. As a rule, this processing takes place only with the user's consent, or in cases where prior consent cannot be obtained for practical reasons and the processing is permitted by law.
2.2 Legal bases
Where we obtain consent for a processing operation, Art. 6(1)(a) GDPR serves as the legal basis. Where processing is necessary to perform a contract with you, Art. 6(1)(b) GDPR applies. We may also rely on our legitimate interests under Art. 6(1)(f) GDPR as a legal basis.
2.3 Data deletion and storage period
Your data is deleted as soon as its storage is no longer necessary for the purpose it was collected for. Data may be retained beyond that point where required by law.
3. Providing the Website and Creating Log Files
Each time you access our website, our system automatically collects the following data:
- Your IP address
- Date and time of access
- The website you arrived from
- Browser type and version
- Operating system
The legal basis is Art. 6(1)(f) GDPR. This data is used to keep our IT systems functional and secure.
4. User Account and Classifieds Services
4.1 Registration
When you register, we collect:
- Email address
- Name (optional)
- Password (stored encrypted)
4.2 Classifieds
When you create a listing, we process:
- Listing title and description
- Category and location
- Price and contact details
- Uploaded images
This data is displayed publicly on the platform.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
5. Cookies and Consent
5.1 Types of cookies
We use the following types of cookies:
- Necessary cookies: session management, language settings, cookie consent
- Statistics cookies: Google Analytics, for traffic measurement
- Marketing cookies: partner integrations
5.2 Consent management
On your first visit to our website, a cookie banner lets you give consent for each cookie category individually. As proof of your consent decision under Art. 7(1) GDPR, we log it on our servers. This log contains:
- A pseudonymized hash of your IP address (SHA-256, never stored in cleartext)
- The time consent was given
- The scope of your consent (which categories were accepted or rejected)
- The type of action (initial consent, withdrawal, change)
- The consent version
This logging is based on our legal obligation under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. You can change or withdraw your cookie settings at any time via the "Cookie Settings" link in the footer.
5.3 Legal basis
The legal basis for technically necessary cookies is Art. 6(1)(f) GDPR. For all other cookies, we rely on your consent under Art. 6(1)(a) GDPR.
6. Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
6.1 How it works
Google Analytics uses cookies that allow an analysis of your use of the website. The information generated by the cookie about your use of the website is generally transmitted to and stored on a Google server in the USA.
6.2 IP anonymization
We have enabled IP anonymization. Your IP address is shortened by Google within EU member states before being transmitted to the USA.
6.3 Opting out
You can prevent Google Analytics from collecting your data by disabling statistics cookies in our cookie settings.
Alternatively, you can install Google's browser add-on for opting out of Analytics: https://tools.google.com/dlpage/gaoptout
6.4 Legal basis
We use Google Analytics on the basis of your consent (Art. 6(1)(a) GDPR). For more information, see Google's privacy policy: https://policies.google.com/privacy
7. Affiliate Partners
7.1 Stay22
We work with Stay22 (Stay22 Inc., Canada) as an affiliate partner. When you use accommodation recommendations, data may be transmitted to Stay22, including:
- IP address
- Device information
- Click behavior on affiliate links
Stay22 sets its own cookies to attribute bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). More information: https://www.stay22.com/privacy
7.2 Travelpayouts
We use Travelpayouts (Travelpayouts Ltd.) as an affiliate network for travel and flight recommendations. When you use the corresponding links, the following data may be transmitted:
- IP address
- Browser and device information
- Click behavior
Travelpayouts uses cookies to attribute bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). More information: https://www.travelpayouts.com/privacy
8. Hosting and Technical Service Providers
8.1 Vercel
Our website is hosted by Vercel Inc. (San Francisco, USA). Vercel processes data on our behalf under Art. 28 GDPR. The transfer is based on the EU Standard Contractual Clauses.
8.2 Supabase
We use Supabase (Supabase Inc., San Francisco, USA) as our database and authentication service. Supabase processes data on our behalf under Art. 28 GDPR.
8.3 Resend
We use Resend to send emails (registration confirmations, password resets). This processing is based on Art. 6(1)(b) GDPR.
8.4 Stripe
We use Stripe (Stripe Inc., San Francisco, USA) to process payments for our paid services (directory plans, premium features). Stripe processes the following data: name, email address, payment details (card number, expiry date, CVC), billing address, and transaction data. This processing is based on Art. 6(1)(b) GDPR (performance of a contract). The transfer to the USA is based on the EU Standard Contractual Clauses. For more information, see Stripe's privacy policy at https://stripe.com/privacy.
8.5 Meilisearch
We use Meilisearch Cloud (Meili SAS, Paris, France) to power search on our business directory and classifieds platform. Meilisearch processes the search terms you enter as well as publicly available directory data (business names, categories, locations). This processing is based on Art. 6(1)(f) GDPR (our legitimate interest in an efficient search function). Data is stored on servers in the EU (Frankfurt).
9. Your Rights as a Data Subject
You have the following rights:
- Right of access (Art. 15 GDPR): to information about the data we process about you
- Right to rectification (Art. 16 GDPR): to have inaccurate data corrected
- Right to erasure (Art. 17 GDPR): to have your data deleted
- Right to restriction (Art. 18 GDPR): to restrict processing
- Right to data portability (Art. 20 GDPR): to receive your data in a machine-readable format
- Right to object (Art. 21 GDPR): to object to processing
- Right to withdraw consent (Art. 7(3) GDPR): to withdraw consent you have given
- Right to lodge a complaint: with a supervisory authority
9.1 Data export (Art. 15 & 20 GDPR)
You can download a copy of all your personal data in a structured, commonly used, machine-readable format (JSON) at any time. You'll find this feature in your dashboard under Settings → Export my data. The export includes:
- Profile data (name, email, settings)
- All listings you have created
- Messages
- Favorites and saved searches
- Your consent history
9.2 Account deletion (Art. 17 GDPR)
You can delete your user account yourself at any time under Settings → Delete account. After you request deletion, there is a 14-day grace period during which you can still cancel it. Once that period ends, your data is irreversibly deleted or anonymized:
- Profile data is anonymized
- Listings are deactivated
- Messages, favorites and saved searches are deleted
- Your authentication account is permanently deleted
Deletion requests are logged as proof (IP hash, timestamp, reason).
9.3 Exercising your rights
To exercise your rights, you can use the self-service features in your dashboard or contact us at datenschutz@mallorca.com. We will process your request within 30 days.
10. Special Provisions for Spain (LOPD)
Under Spanish data protection law (Ley Orgánica 3/2018 – LOPD):
- Minors under 14 require the consent of a parent or legal guardian.
- You may also exercise your rights before the Agencia Española de Protección de Datos.
Last updated: February 2026
Contact Form in Directory
When a contact form on a directory listing page is used, we process:
- The requesting person's name and email address
- Phone number (optional)
- Message text
- Category-specific request details, such as period, location, or preferred date
Claimed directory listings
For claimed listings, we store this data in our database, forward the request to the listing owner by email, and make it visible to the owner in their dashboard.
Unclaimed directory listings and request matching
For unclaimed listings, we store the data exclusively on the server using our administrative service role. The provider has no dashboard access to the stored request. The request is delivered to the selected provider by email. If the requesting person expressly consents to forwarding, we also send the request to up to 4 additional suitable providers selected by category and geographic proximity.
Request and matching data is retained for 12 months and then deleted automatically. Consent may be withdrawn at any time with future effect, and deletion of the data may be requested by emailing info@mallorca.com.
Enquiry and Search Alert for Property Classifieds
Enquiry about a listing
When you send an enquiry through the contact form on a property listing, we process:
- Name
- Email address
- Phone number (optional)
- Your message
This data is forwarded to the listing's provider to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure). The notice text shown on the form is stored together with a timestamp as evidence of consent.
Storage and retention
In addition to the enquiry itself, we store:
- A pseudonymized hash of your IP address (SHA-256, never stored in cleartext) — used solely to prevent abuse and to limit the number of enquiries (rate limiting), not to identify you
- Your browser's user agent
- The page the enquiry was sent from
This data is deleted once the purpose of storing it no longer applies: for an enquiry, that is once the exchange between you and the provider has concluded and no further reply is expected. You can request earlier deletion at any time by emailing datenschutz@mallorca.com.
Forwarding the reply and translation
If the provider replies to your enquiry, we forward the reply to you through a relay address — neither your email address nor the provider's is disclosed directly to the other side. If the reply is written in a language other than yours, it is machine-translated. For this purpose, a copy of the message is sent, solely for translation, to OpenAI (OpenAI, L.L.C., USA); if that service is unavailable, to Anthropic (Anthropic PBC, USA) as a fallback. Both providers process this data on our behalf in accordance with Art. 28 GDPR. The transfer takes place on the basis of the EU Standard Contractual Clauses.
Optional account
After sending your enquiry, you can create a user account to see all your enquiries in one place. The account is only created if you actively click the corresponding link and separately consent to the data processing at that step — never automatically.
Search alert for similar properties
You can set up a search alert to be emailed about new listings that match your criteria. For this we store your search criteria (e.g. region, price range, property type, number of rooms), your name, and your email address. The legal basis is your consent (Art. 6(1)(a) GDPR); here too, the notice text shown is stored with a timestamp as evidence. Alerts are always sent by mallorca.com — your data is not shared with third parties.
Unsubscribing and deletion
Every forwarded reply email and every search-alert email includes a link that lets you end that channel at any time, with effect for the future. Independently of that, you can request access to, correction of, or deletion of your data at any time by emailing datenschutz@mallorca.com.