Privacy Policy

golfinmallorca.com ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you visit our website or use our services, in compliance with the General Data Protection Regulation (GDPR - EU 2016/679) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

1. Data Controller

2. Information We Collect

We collect the following types of personal data:

Information you provide directly:

• Contact inquiries: Name, email address, phone number, country, and message content when you use our contact forms
• Trip planning: Name, email, phone, travel dates, golf preferences, group size, budget range, and accommodation preferences when you use our Trip Planner
• Newsletter: Email address when you subscribe to our newsletter
• Payments: Name and email address for payment processing (credit card details are handled directly by Stripe and never stored on our servers)

Information collected automatically:

• Essential cookies: Session cookies for site functionality and admin authentication
• Local storage: Language preferences and cookie consent status

We do not use Google Analytics, Facebook Pixel, or any third-party tracking, advertising, or profiling cookies.

3. How We Use Your Data

We process your personal data for the following purposes:

• To respond to your inquiries (legal basis: legitimate interest, Art. 6(1)(f) GDPR)
• To process bookings and payments (legal basis: contract performance, Art. 6(1)(b) GDPR)
• To send booking confirmations and payment receipts (legal basis: contract performance)
• To create personalized trip itineraries (legal basis: consent, Art. 6(1)(a) GDPR)
• To send newsletters you have subscribed to (legal basis: consent, Art. 6(1)(a) GDPR)
• To maintain site security and functionality (legal basis: legitimate interest, Art. 6(1)(f) GDPR)

4. Data Sharing

We may share your personal data with:

• Golf courses and hotels in Mallorca to fulfil your booking (only the data necessary for the reservation)
• Stripe for secure payment processing (Stripe Privacy Policy)
• Resend for transactional email delivery (Resend Privacy Policy)

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact inquiries: Up to 24 months after last communication
• Booking records: Up to 5 years for legal and tax compliance
• Newsletter subscriptions: Until you unsubscribe
• Payment records: As required by Spanish tax law (minimum 4 years)

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interest
• Right to withdraw consent: Withdraw consent for newsletter or marketing at any time

To exercise any of these rights, contact us at contact@golfinmallorca.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

7. Cookies

Our website uses only essential cookies necessary for the site to function:

• Session cookies: For admin authentication (strictly necessary, exempt from consent under GDPR Art. 6(1)(f))
• Local storage: Language preference and cookie consent choice (stored locally on your device, no data transmitted)

We do not use advertising, analytics, or third-party tracking cookies of any kind.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS encryption for all data in transit
• Secure payment processing via Stripe (PCI DSS compliant)
• Restricted access to personal data within our team
• Regular security reviews of our platform

9. International Data Transfers

Your data may be processed by service providers located outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data in accordance with GDPR requirements.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated through our website. We encourage you to review this page periodically.

11. Contact

For any privacy-related questions or to exercise your rights: