Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

MenzeMedia.de GmbH

Am Wunderhügel 27
58644 Iserlohn
Deutschland

E-mail: datenschutz@mallorca.com

---

2. General Information on Data Processing

2.1 Scope of Processing of Personal Data

As a rule, we process your personal data only to the extent necessary to provide a functional website as well as our content and services. Processing is generally carried out only with your consent or in cases where, for factual reasons, we cannot obtain your consent in advance and the processing of data is permitted by legal provisions.

2.2 Legal Bases

Where we obtain consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. Legitimate interests pursuant to Art. 6(1)(f) GDPR may also serve as the legal basis.

2.3 Data Deletion and Storage Period

Your data will be deleted as soon as the purpose of storage no longer applies. Data may also be stored beyond this period where this is provided for by legal provisions.

---

3. Provision of the Website and Creation of Log Files

Each time our website is accessed, our system automatically collects data:

• Your IP address
• Date and time of access
• Websites from which your system reaches our website
• Browser type and version
• Operating system

The legal basis is Art. 6(1)(f) GDPR. Storage serves to ensure the functionality and security of our IT systems.

---

4. User Account and Classified Ads Services

4.1 Registration

When you register, we collect the following data:

• E-mail address
• Name (optional)
• Password (stored encrypted)

4.2 Classified Ads

When you create an advertisement, we process:

• Advertisement title and description
• Category and location
• Price and contact details
• Uploaded images

This data is displayed publicly on the platform.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

---

5. Cookies and Consent

5.1 Types of Cookies

We use the following types of cookies:

• Necessary cookies: Session management, language settings, cookie consent
• Statistics cookies: Google Analytics for reach measurement, loaded via Google Tag Manager (Section 5.4)
• Marketing cookies: Partner integrations

5.2 Consent Management

When you first visit our website, we display a cookie banner through which you can give your consent for the individual cookie categories. Your consent decision is logged on the server as evidence pursuant to Art. 7(1) GDPR. In doing so, we store the following data:

• Pseudonymised hash of your IP address (SHA-256, no plain-text storage)
• Time of consent
• Scope of consent (which cookie categories were accepted/rejected)
• Type of action (initial consent, withdrawal, change)
• Consent version

Logging is carried out on the basis of our legal obligation pursuant to Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can adjust or withdraw your cookie settings at any time via the “Cookie Settings” link in the footer of the website.

5.3 Legal Basis

The legal basis for technically necessary cookies is Art. 6(1)(f) GDPR. Your consent pursuant to Art. 6(1)(a) GDPR is required for other cookies.

5.4 Google Tag Manager and Consent Signals

We use Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to integrate and control our analytics tools. Tag Manager itself does not collect data for analytics purposes; it is the hub through which other services are loaded.

In doing so, we use Google Consent Mode. All signals requiring consent are set to “denied” by default when the page is accessed — this concerns analytics storage, advertising storage, advertising user data, personalised advertising and personalised content. Only the signals for functionality and security that are necessary for operating the website are enabled from the outset. Only when you give your consent in the cookie banner are the relevant signals changed to “granted”; if you withdraw your consent, “denied” applies again.

Tag Manager itself is loaded every time the page is accessed. Without your consent, it sends only cookieless signals from which Google derives statistical modelling — no cookies are set and no identifiers are stored that could make you recognisable again. The legal basis for this is Art. 6(1)(f) GDPR; for anything loaded only after your consent, it is Art. 6(1)(a) GDPR. Further information can be found in Google’s privacy policy: https://policies.google.com/privacy

---

6. Google Analytics

We use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is loaded exclusively via the Google Tag Manager described in Section 5.4; the Google tag ID stored there is GT-M34V82JW. Statistics cookies are set only after you have given your consent.

6.1 How It Works

Google Analytics uses cookies that enable an analysis of your use of the website. The information generated by the cookie about your use is generally transmitted to a Google server in the USA and stored there.

6.2 IP Anonymisation

We use the “IP anonymisation” function. As a result, Google truncates your IP address within EU Member States before it is transmitted to the USA.

6.3 Opt-Out

You can prevent collection by Google Analytics by disabling statistics cookies in our cookie settings.

Alternatively, you can install the browser add-on for deactivating Google Analytics: https://tools.google.com/dlpage/gaoptout

6.4 Legal Basis

Google Analytics is used on the basis of your consent (Art. 6(1)(a) GDPR). Further information can be found in Google’s privacy policy: https://policies.google.com/privacy

---

7. Reach Measurement with Plausible

In addition, we use Plausible, a reach measurement service that deliberately operates without cookies. Plausible is loaded via Google Tag Manager; the measurement script is retrieved from plausible.io.

What is processed. Plausible records the page accessed, the page from which you arrived, as well as general information about browser, operating system and device type. Your IP address is evaluated solely to determine the country of origin and is not stored.

What is counted automatically. In addition to page views, Plausible automatically counts three activities: downloading a file, submitting a form and clicking a link that leads away from our website. Only the fact that the activity took place and the relevant file or link destination are recorded — not what you entered in a form.

What expressly does not take place. No cookies are set and no identifiers are stored in your browser. No cross-device recognition takes place, and no personal usage profiles are created. The analysis is purely aggregated.

Events that we additionally count. Beyond mere page-view measurement, we record individual, clearly defined events in order to understand at which point our forms are abandoned:

• Beginning a booking process for an experience, together with the identifier of the booked offer
• Opening the enquiry dialogue on a directory page, together with category, concern and language
• Individual steps in the reservation form for food service establishments (form visible, dialogue opened, input started, enquiry accepted or rejected)

These events contain no content entered by you, no names, no e-mail addresses and no amounts.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest lies in reach measurement that does not require cookies or personal data and is therefore particularly data-efficient. For the same reason, this measurement is not linked to your cookie consent.

---

8. Map Display with Mapbox

We display maps on beach pages, in travel and guide content, on directory pages and in real estate classified ads. We obtain these maps from Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA.

What is processed. Map sections, map tiles and map images are retrieved directly from Mapbox by your browser — they do not pass through our servers. In doing so, Mapbox necessarily receives your IP address as well as information about your browser and device, and learns which map section you are viewing.

When they are loaded. Static map images are loaded together with the page. We load interactive maps, which you can zoom and move, only when you request them — by clicking on them or by scrolling them into the visible area.

Address entry. When you enter an address in one of our forms and use the suggestion list, your entry is transmitted to Mapbox to determine suggestions.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest lies in a comprehensible display of locations and error-free address entry. Data is transferred to the USA on the basis of EU Standard Contractual Clauses. Further information: https://www.mapbox.com/legal/privacy

---

9. Affiliate Partners

9.1 Stay22

We work with Stay22 (Stay22 Inc., Kanada) as an affiliate partner. When you use accommodation recommendations, data may be transmitted to Stay22, including:

• IP address
• Device information
• Clicking behaviour on affiliate links

Stay22 sets its own cookies to attribute bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). Further information: https://www.stay22.com/privacy

9.2 Travelpayouts

We use Travelpayouts (Travelpayouts Ltd.) as an affiliate network for travel and flight recommendations. When you use the relevant links, the following data may be transmitted:

• IP address
• Browser and device information
• Clicking behaviour

Travelpayouts uses cookies to attribute bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). Further information: https://www.travelpayouts.com/privacy

9.3 CHECK24

We participate in the CHECK24.net partner programme and integrate CHECK24 iFrame booking forms (CHECK24 Vergleichsportal GmbH, München) on individual pages, through which comparison and booking take place directly on our website. This content is loaded only after you have consented to marketing cookies. Data may be transmitted to CHECK24, including:

• IP address
• Browser and device information
• Clicking and booking behaviour in the comparison calculator

CHECK24 sets its own cookies to attribute bookings; we receive advertising cost reimbursement for bookings. The legal basis is your consent (Art. 6(1)(a) GDPR). Further information: https://www.check24.net

---

10. Hosting and Technical Service Providers

10.1 Vercel

Our website is hosted by Vercel Inc. (San Francisco, USA). Vercel processes data on our behalf pursuant to Art. 28 GDPR. Data is transferred on the basis of EU Standard Contractual Clauses.

10.2 Supabase

We use Supabase (Supabase Inc., San Francisco, USA) as a database and authentication service. Supabase processes data on our behalf pursuant to Art. 28 GDPR.

10.3 Resend

We use Resend to send e-mails. This includes registration confirmations and password resets, as well as the delivery and forwarding of enquiries from the business directory and real estate listings. Data processing is carried out on the basis of Art. 6(1)(b) GDPR.

10.4 Stripe

For payment processing of paid services (directory plans, premium features), we use Stripe (Stripe Inc., San Francisco, USA). Stripe processes the following data: name, e-mail address, payment data (credit card number, expiry date, CVC), billing address and transaction data. Data processing is carried out on the basis of Art. 6(1)(b) GDPR (performance of a contract). Data is transferred to the USA on the basis of EU Standard Contractual Clauses. Further information can be found in Stripe’s privacy policy at https://stripe.com/de/privacy.

10.5 Meilisearch

For the search function in the business directory and on the classified ads platform, we use Meilisearch Cloud (Meili SAS, Paris, Frankreich). Meilisearch processes the entered search terms as well as publicly accessible directory data (company names, categories, locations). Data processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest in an efficient search function). The data is stored on servers in the EU (Frankfurt).

10.6 Brevo

For sending our newsletter, delivering requested documents and managing the related contact lists, we use Brevo (Brevo SAS, 106 boulevard Haussmann, 75008 Paris, Frankreich). Brevo processes this data on our behalf pursuant to Art. 28 GDPR; the servers are located in the European Union. The specific data involved is set out in Sections 11 and 12.

Brevo reports back to us whether a message was delivered, opened or unsubscribed from, and whether it was returned as undeliverable. We store this feedback in order to keep distribution lists clean and reliably implement unsubscribes. If a message cannot be sent immediately due to an exhausted sending quota, we temporarily place it in a queue with the necessary details and deliver it automatically afterwards.

---

11. Newsletter

You can subscribe to our newsletter on our homepage.

What we collect. Your e-mail address, your first name if requested, as well as your language setting and information on where on the website you signed up.

Confirmation procedure. We use a two-step procedure: after you sign up, we send you an e-mail with a confirmation link. We add you to the distribution list only once you click it. The link is valid for 24 hours and can be used only once; for this purpose, we store a one-time identifier together with your e-mail address. If you do not confirm, you will not receive a newsletter.

Legal basis. Your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future — via the unsubscribe link in every newsletter e-mail or informally at datenschutz@mallorca.com. Processing remains lawful until withdrawal. We store the time of registration and the time of confirmation as evidence of consent pursuant to Art. 7(1) GDPR.

---

12. Requesting a Market Report

You can request the document free of charge on the real estate market report page.

What we collect. First name, last name and e-mail address are required. Your country, information on whether you wish to buy or sell, and the region in which you are interested are voluntary. You can also subscribe to the newsletter; if you do so, Section 11 applies.

Confirmation procedure. Here too, you first confirm via a link in an e-mail. Only afterwards do we send you the market report. The link is valid for 24 hours and can be used once.

Legal basis. Your consent pursuant to Art. 6(1)(a) GDPR, which may be withdrawn at any time with effect for the future via the unsubscribe link or at datenschutz@mallorca.com. We store the time of the request and the time of confirmation as evidence pursuant to Art. 7(1) GDPR.

---

13. Personal Enquiry via Our Enquiry Form

You can describe your concern directly to us via our enquiry form.

What we collect. Your name and e-mail address are required. Your telephone number, country, the subject of your enquiry, the region in which you are interested, your budget range and your message to us are voluntary.

What happens to it. We create your enquiry in our customer management system and notify our team by e-mail via Brevo (Section 10.6) so that someone can take care of it. No data is passed on to third parties.

Legal basis. For processing your enquiry, Art. 6(1)(b) GDPR (pre-contractual measure). For voluntary additional information that enables us to provide a more suitable response, Art. 6(1)(f) GDPR; you may object to this pursuant to Art. 21 GDPR. You may request deletion at any time at datenschutz@mallorca.com.

---

13a. Contact via WhatsApp

On individual pages of our food and drink section, we offer you the option of sending us a booking enquiry via WhatsApp. The button merely opens a link to WhatsApp (wa.me) with a pre-filled message text; the message is only sent once you send it yourself in WhatsApp. No data is transferred to WhatsApp or Meta when the button is displayed; we do not embed any scripts or pixels from Meta. The provider of the service is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (a company of the Meta group). The processing of your data within WhatsApp (including your telephone number, your profile name and the content of your message) is governed by WhatsApp's privacy policy (https://www.whatsapp.com/legal/privacy-policy-eea) and its terms of service; this may involve a transfer to the USA, for which Meta relies on the EU-US Data Privacy Framework. We receive your message on a WhatsApp Business account used for business purposes, reply to it and pass on the details required for the booking (preferred date, number of people, your first name and the response) to the establishment concerned. The legal basis is Art. 6(1)(b) GDPR (steps towards a contract at your request) and Art. 6(1)(f) GDPR (our legitimate interest in straightforward communication via the channel you have chosen). We delete the chat histories no later than twelve months after the last message, provided no statutory retention obligations prevent this. We do not use WhatsApp to contact you unsolicited, and we do not transfer any address book data to WhatsApp. If you do not wish to use WhatsApp, the enquiry form is available to you on the same page.

We count how often the button is clicked exclusively via our cookie-free reach measurement with Plausible (Section 7); no content of your message is recorded in the process.

---

14. Your Rights as a Data Subject

You have the following rights:

• Right of access (Art. 15 GDPR): Information about your processed data
• Right to rectification (Art. 16 GDPR): Rectification of inaccurate data
• Right to erasure (Art. 17 GDPR): Deletion of your data
• Right to restriction (Art. 18 GDPR): Restriction of processing
• Data portability (Art. 20 GDPR): Receipt of your data in a machine-readable format
• Right to object (Art. 21 GDPR): Objection to processing
• Right to withdraw consent (Art. 7(3) GDPR): Withdrawal of consent given
• Right to lodge a complaint (Art. 77 GDPR): Complaint to a supervisory authority

14.1 Data Export (Art. 15 & 20 GDPR)

You can download a copy of all your personal data at any time in a structured, commonly used and machine-readable format (JSON). You can find this function in your dashboard under Settings → Export my data. The export includes:

• Profile data (name, e-mail, settings)
• All advertisements created
• Messages
• Favourites and saved searches
• Consent history

14.2 Account Deletion (Art. 17 GDPR)

You can independently delete your user account at any time via Settings → Delete account. After the deletion request, a 14-day grace period applies during which you can withdraw the deletion. After this period has expired, your data will be irrevocably deleted or anonymised:

• Profile data is anonymised
• Advertisements are deactivated
• Messages, favourites and saved searches are deleted
• Your authentication account is permanently deleted

The deletion request is logged as evidence (IP hash, timestamp, reason).

14.3 Exercising Your Rights

To exercise your rights, you can use the self-service functions in your dashboard or contact us at datenschutz@mallorca.com. We will process your request within 30 days.

14.4 Competent Supervisory Authority

The data protection supervisory authority of the state of North Rhine-Westphalia, where our registered office is located, is responsible for us:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Postfach 20 04 44
40102 Düsseldorf
Deutschland

Telephone: +49 211 38424-0
Complaint form: https://www.ldi.nrw.de/beschwerde

Regardless of this, pursuant to Art. 77 GDPR, you may also contact the supervisory authority of your place of residence or workplace.

---

15. Special Provisions for Spain (LOPD)

Pursuant to Spanish data protection law (Ley Orgánica 3/2018 - LOPD):

• Minors under 14 years of age require the consent of a legal guardian.
• You may also assert your rights before the Agencia Española de Protección de Datos.

---

Contact Form in Directory

When you use a contact form on a directory listing page, we process:

• Your name and e-mail address
• Your telephone number (optional)
• Your message text
• Category-related information about the enquiry, for example period, location or preferred date

Claimed Directory Listings

For claimed listings, we store this data in our database, forward your enquiry by e-mail to the owner of the listing and display it in their dashboard.

Unclaimed Directory Listings and Enquiry Mediation

For unclaimed listings, we store the data exclusively on the server using our administrative service role. The provider has no dashboard access to the stored enquiry. The enquiry is delivered by e-mail to the selected provider. If you expressly consent to forwarding, we additionally send your enquiry to up to 4 other suitable providers, which we select based on category and geographical proximity.

The enquiry and mediation data is stored for 12 months and then automatically deleted. You can withdraw any consent given at any time with effect for the future and request deletion of the data by e-mail at info@mallorca.com.

---

Contact Enquiry and Search Request for Real Estate Classified Ads

Enquiry About a Listing

When you submit an enquiry via the contact form of a real estate listing, we process:

• Your name
• Your e-mail address
• Your telephone number (optional)
• Your message

We forward this data to the provider of the listing in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure). We store the notice text displayed on the form together with a timestamp as evidence of consent.

Storage and Retention Period

In addition to the enquiry itself, we store:

• A pseudonymised hash of your IP address (SHA-256, no plain-text storage) — this serves exclusively to prevent misuse and limit the number of enquiries (rate limiting), not to identify you
• The user agent of your browser
• The page from which you submitted the enquiry

This data is deleted as soon as the purpose for which it is stored no longer applies: in the case of an enquiry, this is when the mediation between you and the provider has been completed and no further response is expected. You can request early deletion at any time at datenschutz@mallorca.com.

Forwarding of the Response and Translation

If the provider responds to your enquiry, we forward the response to you via a relay address — neither your e-mail address nor that of the provider is disclosed directly to the other party. If the response is written in a language other than your own, it is machine-translated. For this purpose, a copy of the message is transmitted to OpenAI (OpenAI, L.L.C., USA) exclusively for this purpose; if this service is unavailable, it is transmitted alternatively to Anthropic (Anthropic PBC, USA).

Both providers process this data on our behalf pursuant to Art. 28 GDPR. Data is transferred on the basis of EU Standard Contractual Clauses.

Optional Account

After your enquiry, you can create a user account in order to view your enquiries centrally. The account is created only if you actively click the relevant link and separately consent to data processing — never automatically.

Search Request for Similar Properties

You can set up a search request to be notified by e-mail about newly posted listings that match your criteria. For this purpose, we store your search criteria (e.g. region, price range, property type, number of rooms), your name and your e-mail address. The legal basis is your consent (Art. 6(1)(a) GDPR); here too, we store the displayed notice text with a timestamp as evidence. Messages are sent exclusively by mallorca.com — your data is not passed on to third parties.

Unsubscribe and Deletion

Every forwarded response e-mail and every search request e-mail contains a link through which you can stop the respective channel at any time with effect for the future. Regardless of this, you can request information, rectification or deletion of your data at any time at datenschutz@mallorca.com.

---

Status: 2026-08-29