1. Controller

Thomas Mallorca Real Estate S.L.
Carrer de Isaac Peral, 50, 07157 Port d'Andratx, Balearic Islands, Spain
NIF: B26636696 · VAT ID: ESB26636696
Telephone: +34 678 777 799 · Email: [email protected]
Managing directors: Matthias Thomas, Klaudia Wolf

If you have any questions about data protection, you can reach us at [email protected].

2. The key points in brief

This website does not set any cookies and does not create user profiles.
Fonts, icons, maps and images are hosted on our own servers. When you visit the site, no data is transmitted to Google, Meta, advertising networks or tracking services.
The servers are located in Germany. We use Cloudflare to deliver and protect the website (see section 4).
We only receive personal data if you contact us.

3. Hosting and technical operation

The website is operated on our behalf by Hanseatic Bits UG (haftungsbeschränkt) & Co. KG, Germany (data processing pursuant to Art. 28 GDPR). Hanseatic Bits uses the following sub-processors for this purpose:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers and database. The servers are located in Germany.
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: delivery and protection of the website (see section 4).
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany: email.

When you visit the website, the server processes technically necessary connection data (IP address, date and time, page accessed, referrer URL, browser and operating system) in order to deliver the page. Our application and our web server do not store any logs of page views. To protect the contact form against abuse, we keep your IP address and the email address you entered in working memory for one hour at most; they are not stored permanently. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website).

4. Cloudflare

The website is delivered via the Cloudflare network. Cloudflare protects the site against attacks and speeds up delivery. In doing so, Cloudflare processes the technical connection data mentioned above, in particular your IP address. Cloudflare may also process this data in the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; in addition, the Standard Contractual Clauses of the European Commission apply. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and fast website). Further information: https://www.cloudflare.com/privacypolicy/

5. Audience measurement with Plausible Analytics

We measure the use of the website with Plausible Analytics, which Hanseatic Bits operates for us on Hetzner servers in Germany. Plausible does not set any cookies, does not store anything on your device and does not create user profiles. Your IP address is not stored; to count unique visits, it is combined only with a randomly generated value that changes daily and converted into an identifier that cannot be reversed and can no longer be attributed after 24 hours. The data collected is aggregated information such as pages viewed, referring page, country, device type and browser, as well as clicks on contact options (e.g. telephone, email, WhatsApp) and submitted enquiries, including the property number in the case of property enquiries. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our offering).

6. Contact form, email and telephone

If you contact us via the contact form, by email or by telephone, we process your details (name, email address, optionally telephone number, your message and, where applicable, the property number) in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry aims at a contract (e.g. purchase, sale or rental of a property), and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). Form enquiries are sent to us by email via IONOS.

We store your enquiry until it has been fully dealt with. If it leads to a transaction, we retain the related correspondence in accordance with the statutory retention periods (in particular six years under Art. 30 Código de Comercio). Enquiries without any further business relationship are deleted as soon as they are no longer needed.

To protect against spam, we use ALTCHA. Your browser solves a small computational task that comes from our own server. No cookies are set and no data is transmitted to third parties; for the limitation of mass requests, see section 3. The legal basis is Art. 6(1)(f) GDPR (protection against abuse).

7. WhatsApp

You can write to us via WhatsApp. The connection is only established when you click the WhatsApp link; before that, no data is transmitted to WhatsApp. If you write to us via WhatsApp, WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, processes your telephone number, your profile name and the content of your messages in accordance with its own terms. Data may be transferred to the USA in the process; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. We only use your message to respond to your enquiry (Art. 6(1)(b) or (f) GDPR). If you do not wish this, you can also reach us by telephone, email or contact form. WhatsApp privacy information: https://www.whatsapp.com/legal/privacy-policy-eea

8. YouTube videos

On some property pages you can watch videos hosted on YouTube. Until you click, we only show a preview image that is loaded from our own server; no data is transmitted to YouTube. Only when you click play is the video loaded in enhanced privacy mode (youtube-nocookie.com) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the process, your IP address and technical data are transmitted to Google, possibly also to the USA (Google LLC is certified under the EU-US Data Privacy Framework). The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Google privacy information: https://policies.google.com/privacy

9. Maps

The maps on our website are loaded entirely from our own servers. The map data comes from OpenStreetMap (© OpenStreetMap contributors, ODbL). No data is transmitted to third parties when the map is displayed. The “Plan route” link only opens Google Maps after you click it; Google's privacy information then applies.

10. Links to social networks

Our website contains simple links to Instagram, Facebook and YouTube. No plugins are embedded; when you visit our website, no data is transmitted to these networks. Only when you click a link do the privacy policies of the respective provider apply.

11. Cookies and local storage

This website does not set any cookies. Your browser merely stores technically necessary navigation data (e.g. the scroll position when navigating back) in session storage, which is deleted when you close the tab. No consent is required for this.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You may withdraw any consent you have given at any time with effect for the future. To do so, please contact [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

13. Changes

We update this privacy policy when the website or the legal situation changes. The version published here at any given time applies.

Privacy Policy