Privacy Policy
Last updated: 27 October 2026
We take the protection of your personal data seriously and process it exclusively on the basis of the General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
1. Data Controller
Balearian Hospitality Services S.L. (brand „The Balearian – Villas & Concierge")
Carrer d'Alber 64, 07008 Palma, Illes Balears, Spain
CIF/NIF: B26863035 · Email: info@thebalearian.com
Phone: +34 641 056 255
2. The Data We Process
Name, address, email address, telephone number, booking details, identification and registration data (where legally required), payment information, as well as technical data such as your IP address and device and browser information.
If you sign your rental agreement (booking form) online, we store the name and place you enter, your signature, the IP address, the browser identifier and the time of signing as evidence (Art. 6(1)(b) and (f) GDPR). We keep this information for as long as the other booking and contract data.
3. Purposes & Legal Bases
We process your data to handle enquiries, to fulfil bookings and contracts (Art. 6(1)(b) GDPR), to meet legal obligations such as the registration of guests with the Spanish authorities (Art. 6(1)(c) GDPR), as well as on the basis of legitimate interests and your consent (Art. 6(1)(a) and (f) GDPR). How we process your data for the newsletter and the welcome voucher is set out in section 3a.
3a. Newsletter and Welcome Voucher
Your right to object to marketing
You may object to the use of your data for marketing at any time without giving reasons, and withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every email or by writing to info@thebalearian.com. This costs you nothing beyond the transmission costs at basic rates. You may also object at any time to the measurement of opens and clicks in our newsletters (see “Performance measurement and reminder”), for example by replying to a newsletter or by writing to info@thebalearian.com.
a) Subscription with confirmation
When you subscribe to our newsletter, we first send you an email with a confirmation link. Only once you have confirmed your subscription with it do we add you to our mailing list. This applies to the newsletter form on our website and to the tick box in an enquiry or in the online check-in. If you subscribe through your wishlist, you confirm your subscription there with a click of your own, after opening the wishlist with the code or the link from our email. The newsletter covers holiday villas in Mallorca and Ibiza that we arrange, news from the islands and concierge offers from our partners. The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 21(1) LSSI). Subscribing is voluntary. Without an email address we can send you neither the newsletter nor a voucher.
b) Proof
To be able to prove your consent, we store the time of subscription and confirmation, the form used, the version of the consent text, the language and pseudonymised check values (hash values) of your IP address and browser identifier (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
c) Welcome voucher
If we offer a welcome voucher when you subscribe, you receive it after your confirmation under our voucher terms. For this we store the voucher code, the dates of issue and expiry, its redemption and the booking for which you redeem it. The legal basis is the fulfilment of our voucher promise (Art. 6(1)(b) GDPR). So that each person receives the voucher only once, we compare your email address on issue, and additionally your name on redemption, with vouchers issued previously; our legitimate interest is to prevent multiple use (Art. 6(1)(f) GDPR). We store the voucher tier you choose when subscribing as an indication of your travel wishes, so that we can suggest suitable villas (Art. 6(1)(f) GDPR); we delete this indication when you unsubscribe. Your voucher remains valid even if you unsubscribe from the newsletter beforehand.
d) Sending
We send the confirmation email, the voucher and the newsletter through MailerSend (see section 4.2). MailerSend tells us whether an email was delivered, whether it could not be delivered and whether you reported it as spam. If your address permanently cannot receive email, we note this and send no further newsletters to it; we treat a spam report like unsubscribing. We also keep this note as a check value (hash) of your address, even if your contact is deleted, so that we do not write to the address again; it is removed as soon as you confirm a new sign-up via the confirmation link. If MailerSend tells us that you have unsubscribed there, we also treat this like unsubscribing. The legal basis is our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR). For the newsletter we store these reports only with a check value (hash) of your email address and delete them 30 days after the last mailing of the newsletter concerned, including the reminder. To avoid sending emails to mailboxes that do not exist, and to protect our sending account, through which our booking and payment emails are also sent, we have the addresses on our newsletter mailing list checked for deliverability by MailerSend as our processor. For this we pass on only your email address; in return we receive a result, which we classify as deliverable, uncertain or undeliverable. If the check classifies your address as undeliverable, we send no further newsletters or other marketing to it until you show us that you receive our emails there, for example by confirming a subscription via the confirmation link or by opening your wishlist with the code or link from our email. If you have not confirmed your subscription with us, for example because we took it over from an earlier mailing list, you will receive the newsletter only after the check: if your address is then classified as deliverable, we send it to you; if the result is uncertain, as a rule we hold it back. The legal basis is our legitimate interest in mailings that reach their recipients and in not sending marketing to undeliverable addresses (Art. 6(1)(f) GDPR). We store the result, with its classification, the checking service and the date of the check, on your contact record until a new check replaces it, you unsubscribe or object to marketing, you confirm a new subscription via the confirmation link or we delete your contact record. MailerSend deletes its check report after 30 days.
e) Retention
Your address stays on the mailing list until you unsubscribe or object. After that we no longer use it for marketing; our suppression list holds it only as a check value (hash), so that you receive no marketing in future either. We delete unconfirmed subscriptions after 30 days unless we hold your data for another reason, such as an enquiry. We keep records of consent and objection for three years after they end (Art. 45 LSSI, Art. 72 LOPDGDD). We delete data on unredeemed vouchers six months after expiry. We keep a check value (hash) of your email address for 24 months so that each person receives the voucher only once. Redeemed vouchers form part of the booking records and are kept with them for six years.
f) Performance measurement and reminder
Our newsletters contain an invisible tracking pixel, and their links are routed through our own server. This lets us record for each recipient whether and when you opened the newsletter and which links you clicked. For each newsletter we store: the type of event (open, click or unsubscribing via that newsletter), the time of the first event and, for clicks, also of the last one, the link clicked and how many times you clicked it, and whether you responded only after the reminder. The pixel and links carry an identifier for this purpose, not your email address. We do not store your IP address or browser identifier for this; as with every visit to our website, they appear only in the server log, which we delete after 14 days (section 4.2). We use this information to measure the success of our newsletters and to send you a newsletter once more if you have not opened it after 48 hours. The legal basis is our legitimate interest in measuring the success of our marketing (Art. 6(1)(f) GDPR). We delete the data per recipient 30 days after the last mailing of the newsletter, including the reminder; after that only totals per newsletter remain, with no link to any individual. The tags added to the links (UTM parameters) identify only the newsletter, not you personally. You may object to this measurement at any time, for example by writing to info@thebalearian.com. We note your objection on your contact record; future newsletters to you will then contain no measurement, and you will receive no reminder. If you unsubscribe via the link in a newsletter, we store no further opens or clicks from you for that newsletter, and you will receive no further newsletters.
4. Recipients of the Data
We share your data only where this is necessary for your booking, a legal obligation or the operation of this website: with the owners or managers of the property you book, with local partners we engage (such as cleaning and concierge), with public authorities and with the service providers listed below. Service providers working on our behalf are contractually bound by our instructions (Art. 28 GDPR).
4.1 Payments
You choose how to pay. Depending on the method, the following parties are involved; the legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We never see your card details or login credentials.
Card, Apple Pay, Google Pay and SEPA Direct Debit: Stripe
These payments are processed by Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Dublin 2, Ireland) on its own encrypted payment page. We pass the amount, the purpose of the payment, the booking reference, the property and the travel dates, as well as your email address, to Stripe; you enter your card or account details directly with Stripe. From Stripe we receive the payment status, the amount and the payment method and, for cards, also the card brand, the card type (credit, debit or prepaid) and the issuing country; we use the issuing country to determine and verify the card fee for cards issued outside the European Economic Area, and otherwise use the card details only to review our payment costs internally. For fraud prevention and its own legal obligations, such as anti-money-laundering checks, Stripe acts as an independent controller. Stripe may transfer data to Stripe, LLC in the USA; Stripe is certified under the EU-US Data Privacy Framework and also uses Standard Contractual Clauses. For Apple Pay and Google Pay, the privacy notices of Apple and Google also apply. If you provide the security deposit as a card hold, Stripe only reserves the amount on your card. So that the deposit remains covered until after your departure, Stripe may save your card for this purpose and, if needed, automatically renew the hold for the same amount; we only receive an identifier for the card at Stripe, never the card number. We use the saved card exclusively for the deposit of this booking.
PayPal
With PayPal you pay directly into our PayPal account (info@thebalearian.com). PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg) processes the payment as an independent controller under its own privacy statement. We receive your name, your PayPal email address, the amount, the date and any message you add to the payment.
Bank transfer, including from Wise or Revolut
You transfer the amount to our business account with Banco Santander, S.A. or, where shown on the payment page, to our account with Wise (Wise Europe SA, Brussels, Belgium) or Revolut (Revolut Bank UAB, Vilnius, Lithuania). All we receive is the account holder's name, the IBAN or account number, the amount and the payment reference. Your own bank or app, such as Wise or Revolut, is itself responsible for processing your data; the same applies to the institutions that hold our accounts.
4.2 Technical service providers
Hosting and server logs: Hetzner
This website and our booking management run on a server operated by Hetzner Online GmbH (Gunzenhausen, Germany) in a data centre in the EU. Each time a page is requested, the server records the IP address, date and time, the address requested, the status code and the browser identifier. This serves security and troubleshooting (Art. 6(1)(f) GDPR); we delete this log after 14 days. Fonts and images are delivered from our own server.
Database: Supabase
Our database is provided by Supabase Pte. Ltd. (Singapore). The data is stored in a data centre in Frankfurt am Main, Germany. Any access from outside the EU, for example for support, is covered by Standard Contractual Clauses.
Email delivery: MailerSend
We send emails such as booking confirmations, payment links, the confirmation email for newsletter subscriptions, welcome vouchers and, only with your consent, our newsletter through MailerSend, Inc. (New York, USA). The data is stored in the EU; transfers to the USA are covered by Standard Contractual Clauses. You can unsubscribe from the newsletter at any time using the link in every issue. MailerSend tells us whether an email was delivered. We note this in our sending record so that we can resend an email that did not arrive, for example about your booking (Art. 6(1)(b) and (f) GDPR).
Booking platforms: Channex
If you book through a platform such as Airbnb or Booking.com, we receive the booking data the platform passes on (for example name, travel dates, price and contact details) through our channel manager Channex.io Ltd (Carmarthen, United Kingdom). Channex stores the data in the EU; the European Commission has adopted an adequacy decision for the United Kingdom. The platform's own privacy policy applies to the platform itself.
Previous booking software: vOffice
Until we have fully switched to our new booking system, we also store booking and guest data in the booking software of vOffice GmbH (Neustadt in Holstein, Germany).
AI features: Anthropic
For the AI villa search on this website and for internal reply drafts and translations, we use the Claude AI model by Anthropic (Anthropic Ireland, Limited, Dublin, Ireland, and Anthropic, PBC, USA). We transmit only the text you type into the search or, for a reply draft, the message or review we are replying to, together with the key details of the enquiry (salutation and name, country of origin, requested property, travel dates, number of guests) and the previous correspondence. We remove email addresses and phone numbers beforehand; your IP address is never transmitted. Anthropic does not use this data to train its models. Transfers to the USA are covered by Standard Contractual Clauses. We review and send every reply draft ourselves. Please do not enter sensitive data into the AI search. The legal basis is Art. 6(1)(b) and (f) GDPR.
Map on the villa pages: Google Maps
On the villa pages you can display a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map only loads once you have allowed marketing in the cookie banner or tapped “Show map”; your browser remembers this choice on this device. When the map loads, Google receives your IP address and device and browser details and may set its own cookies; data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework, standard contractual clauses). The map shows the villa’s town, not its address. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it in the cookie settings and clear the remembered choice via your browser’s site data.
WhatsApp
If you write to us on WhatsApp, your messages and phone number pass through WhatsApp Ireland Limited (Dublin, Ireland), a Meta group company. Data may be transferred to the USA in the process, and WhatsApp's privacy policy applies. If you prefer not to use WhatsApp, you can reach us by email or phone.
4.3 Guest registration with the authorities
Spanish law (Real Decreto 933/2021) requires us to report the data of all travellers for every stay to the Ministry of the Interior (SES.HOSPEDAJES platform, Ministerio del Interior). We report name, sex, identity document details, date of birth, nationality, address, contact details, travel dates and the payment method, payment date and payer; for minors, also their relationship to an accompanying adult. The legal basis is Art. 6(1)(c) GDPR. As required by law, we keep this data for three years and then delete it.
4.4 Transfers outside the EU
Some of the service providers named above are based outside the EU or may process data there. This only happens where the European Commission has recognised an adequate level of data protection (for example for the United Kingdom or for US companies certified under the EU-US Data Privacy Framework) or where Standard Contractual Clauses of the European Commission have been agreed (Art. 45 and 46 GDPR). You can request a copy of these safeguards at info@thebalearian.com.
4.5 Analytics and advertising (only with your consent)
We use the following services only if you have consented in the cookie banner, separately for “Analytics” and “Marketing”. The legal basis is your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device, Art. 22(2) LSSI-CE or § 25(1) TDDDG). You may withdraw it at any time, with effect for the future, via “Cookie settings” in the footer. We never pass names, email addresses, phone numbers or messages to these services in plain text, nor any search text. The providers may transfer data to the United States; Google and Meta are certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply (Art. 45 and 46 GDPR).
Analytics: Google Analytics 4
The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics shows us, in pseudonymised form, how our website is used: pages visited, clicks on contact, search and enquiry elements, scroll depth, time on site, villas viewed, filters and searches (without free text), return visits, and device, browser, language and approximate location. According to Google, the IP address is used only to determine location and is not stored in Google Analytics. Cookies: _ga and _ga_<ID> (lifetime 2 years). We retain analytics data for 14 months. More at policies.google.com/privacy.
Advertising: Google Ads
The provider is Google Ireland Limited (Dublin, Ireland). With Google Ads we measure whether an enquiry follows a click on one of our advertisements (conversion), and later show you relevant advertisements based on the pages you visited and the villas you viewed (remarketing, audiences). When you send an enquiry, we transmit your email address and phone number for more accurate measurement (enhanced conversions) only as a SHA-256 hash, calculated in your browser and impossible to reverse; Google matches it against its own accounts. Cookies: _gcl_au, _gcl_aw and _gcl_dc (lifetime 90 days). With every event, Google receives your IP address, browser and device information, and the address of the page you are viewing and of the page you came from (referrer); Google may also read and set its own cookies on doubleclick.net and google.com, such as IDE (lifetime up to 13 months). More at policies.google.com/technologies/ads.
Advertising: Meta Pixel (Facebook and Instagram)
The provider is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). The Meta Pixel reports to Meta the pages visited, villas viewed, searches, contact clicks, enquiries opened and sent, and the signal “strong interest”. Meta uses this to measure the success of our advertisements on Facebook and Instagram, to show you relevant advertisements and to build audiences. When you send an enquiry, we transmit your email address and phone number only as a SHA-256 hash (advanced matching). We also send the same events, enquiry sent and newsletter confirmed, from our server to Meta (Conversions API), again only with your consent, with the same hashed values, your IP address, browser details and the cookie values _fbp and _fbc; an event ID ensures that Meta counts them only once. We are jointly responsible with Meta for the collection and transmission to Meta (Art. 26 GDPR; agreement at facebook.com/legal/controller_addendum); Meta alone is responsible for any further processing. Cookies: _fbp and _fbc (lifetime 90 days). With every event, Meta receives your IP address, browser and device information, and the address of the page you are viewing and of the page you came from (referrer); Meta may also read and set its own cookies on facebook.com, such as fr (lifetime 90 days). More at facebook.com/privacy/policy.
Visit counters in your browser
With your consent to analytics or marketing, our website counts in your browser how many villas you have viewed in this session and when you visited us in the last 30 days (sessionStorage and localStorage, at most 10 points in time). The only thing derived from this is the signal “strong interest”, which goes to the services you have allowed; the counters themselves never leave your device. We delete them when you withdraw your consent.
4.6 Personal advice (browsing history, only with your consent)
If you choose “Personal advice” in the cookie banner, we record your visit to this website ourselves, without any third party provider. The controller is Balearian Hospitality Services S.L. (section 1). The data is stored on our server at Hetzner and in our database at Supabase in Frankfurt (section 4.2). The legal basis is your consent (Art. 6(1)(a) GDPR; for the identifier in your browser Art. 22(2) LSSI-CE and § 25(1) TDDDG respectively).
What we record
A random identifier in the cookie balearian-jv that only our server can read (valid as long as your consent, no more than 180 days). For each visit: pages viewed without search parameters, villas viewed, galleries opened, availability and price requests with dates and number of guests, filters chosen, searches, your wishlist, clicks on WhatsApp, phone or email, language and type of device. For the AI search we store only the recognised search criteria (such as island, number of guests, dates, features) and the villas suggested, not your search text. To know how you found us, we store the campaign details in the address (utm parameters), whether you came via an ad from Google, Microsoft or Meta (click identifiers such as gclid or fbclid, kept in their original form for no more than 90 days and afterwards only as the type) and which website you came from, for instance a search engine, ChatGPT or another AI assistant (only the name of the website). Whether you merely saw an ad is not known to us. We do not store your IP address for this purpose.
Connection with you as a person
If you send us an enquiry, we connect the history with that enquiry. We connect it with your contact in our customer database only once you have confirmed your email address for the wishlist, once your enquiry becomes a booking or once our team assigns the enquiry to your contact. This shows us which villas and wishes interest you, so that we can advise you precisely. This constitutes profiling; we do not use it for automated decisions with legal effect. This data is not shared with anyone.
Retention, withdrawal and deletion
A history that is not connected with any enquiry, booking or contact is deleted 180 days after your last visit. Individual page views and events are deleted 13 months after the visit; for an enquiry or booking only the summary of its origin then remains (channel, campaign, landing page, first and last touch), for no more than three years after your last visit (six years for a booking, like the booking records) and only while the enquiry, the booking or your contact is stored with us. You may withdraw your consent at any time via “Cookie settings” in the footer. We then immediately delete the identifier and the entire browsing history, including any history connected with an enquiry, a booking or your contact; the enquiry keeps only its origin as described in section 4.7. A history that is not connected with your name cannot be attributed to you by us (Art. 11 GDPR); you can delete it yourself at any time via “Cookie settings” on the device concerned.
4.7 Origin of your enquiry (without consent)
For every enquiry, even without your consent, we store the page of our website from which it was sent, any campaign details (such as utm parameters) in that page’s address and the channel derived from them (for instance a Google ad or our newsletter). Your browser transmits this information with the enquiry; we do not set a cookie for it and store nothing in your browser. The legal basis is our legitimate interest in knowing how well our advertising works (Art. 6(1)(f) GDPR). You may object to this at any time (Art. 21 GDPR). We keep this information for as long as the enquiry.
5. Retention Period
We keep your data only for as long as the respective purpose requires. Booking, contract, invoice and payment data are kept for six years (Art. 30 of the Spanish Commercial Code and Spanish tax law). Guest registration data is kept for three years (Real Decreto 933/2021), server logs for 14 days. For the newsletter and the welcome voucher, the periods in section 3a apply. While legal retention periods are running or claims remain possible, we block data instead of deleting it (Art. 32 LOPDGDD); after that we delete it.
The browsing history from “Personal advice” is deleted according to the periods in section 4.6.
6. Your Rights
You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (Art. 15 to 21 GDPR). Any consent you have given may be withdrawn at any time with effect for the future. Your details are required for the booking and the guest registration; without them we cannot complete your booking. We do not make solely automated decisions within the meaning of Art. 22 GDPR. To exercise any of these rights, simply contact us at info@thebalearian.com.
Objection to marketing
You may object at any time to the use of your data for direct marketing (Art. 21(2) GDPR); we will then no longer use it for this purpose. Details in section 3a.
7. Right to Lodge a Complaint
You may lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live. The authority responsible for us is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
8. Data Security
This website uses SSL encryption to protect your data against unauthorised access during transmission.
9. Cookies, Analytics and Advertising
We use technically necessary cookies and browser storage, for instance for your wishlist, your language preference, your cookie choice and notices you have dismissed (such as the voucher pop-up, for up to 365 days), without consent (Art. 6(1)(f) GDPR). Your choice in the cookie banner is stored for 180 days in the cookie balearian-consent. Cookies and similar technologies for analytics and advertising are used only with your consent; none of these services loads beforehand. Section 4.5 sets out which services these are, what they are for, how long they store data and whether data is transferred to the United States. You may change or withdraw your choice at any time via the “Cookie settings” link in the footer; withdrawal takes effect for the future and deletes the cookies concerned.
Audience measurement without cookies (Plausible Analytics)
To understand how our website is used, we use Plausible Analytics, provided by Plausible Insights OÜ (Estonia, EU). Plausible does not use cookies and stores nothing on your device. It records only aggregated information such as the pages viewed, the referring website, country, device type and browser; no profile of you is created. Your IP address is used only to compute a daily rotating hash and is not stored. The data is processed in the EU. We remove access keys and email addresses from the address beforehand, and we do not measure internal areas such as the guest account, check-in or payment. The legal basis is our legitimate interest in privacy friendly audience measurement (Art. 6(1)(f) GDPR). Further information is available in the Plausible data policy: plausible.io/data-policy
With your consent to “Personal advice” we additionally set the cookie balearian-jv (a random identifier that only our server can read, valid as long as your consent); details are set out in section 4.6.