Privacy Policy

4.1 Payments

You choose how to pay. Depending on the method, the following parties are involved; the legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We never see your card details or login credentials.

Card, Apple Pay, Google Pay and SEPA Direct Debit: Stripe
These payments are processed by Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Dublin 2, Ireland) on its own encrypted payment page. We pass the amount, the purpose of the payment, the booking reference, the property and the travel dates, as well as your email address, to Stripe; you enter your card or account details directly with Stripe. From Stripe we receive the payment status, the amount and the payment method and, for cards, also the card brand, the card type (credit, debit or prepaid) and the issuing country; we use the issuing country to determine and verify the card fee for cards issued outside the European Economic Area, and otherwise use the card details only to review our payment costs internally. For fraud prevention and its own legal obligations, such as anti-money-laundering checks, Stripe acts as an independent controller. Stripe may transfer data to Stripe, LLC in the USA; Stripe is certified under the EU-US Data Privacy Framework and also uses Standard Contractual Clauses. For Apple Pay and Google Pay, the privacy notices of Apple and Google also apply. If you provide the security deposit as a card hold, Stripe only reserves the amount on your card. So that the deposit remains covered until after your departure, Stripe may save your card for this purpose and, if needed, automatically renew the hold for the same amount; we only receive an identifier for the card at Stripe, never the card number. We use the saved card exclusively for the deposit of this booking.

PayPal
With PayPal you pay directly into our PayPal account (info@thebalearian.com). PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg) processes the payment as an independent controller under its own privacy statement. We receive your name, your PayPal email address, the amount, the date and any message you add to the payment.

Bank transfer, including from Wise or Revolut
You transfer the amount to our business account with Banco Santander, S.A. or, where shown on the payment page, to our account with Wise (Wise Europe SA, Brussels, Belgium) or Revolut (Revolut Bank UAB, Vilnius, Lithuania). All we receive is the account holder's name, the IBAN or account number, the amount and the payment reference. Your own bank or app, such as Wise or Revolut, is itself responsible for processing your data; the same applies to the institutions that hold our accounts.

4.2 Technical service providers

Hosting and server logs: Hetzner
This website and our booking management run on a server operated by Hetzner Online GmbH (Gunzenhausen, Germany) in a data centre in the EU. Each time a page is requested, the server records the IP address, date and time, the address requested, the status code and the browser identifier. This serves security and troubleshooting (Art. 6(1)(f) GDPR); we delete this log after 14 days. Fonts and images are delivered from our own server.

Database: Supabase
Our database is provided by Supabase Pte. Ltd. (Singapore). The data is stored in a data centre in Frankfurt am Main, Germany. Any access from outside the EU, for example for support, is covered by Standard Contractual Clauses.

Email delivery: MailerSend
We send emails such as booking confirmations, payment links, the confirmation email for newsletter subscriptions, welcome vouchers and, only with your consent, our newsletter through MailerSend, Inc. (New York, USA). The data is stored in the EU; transfers to the USA are covered by Standard Contractual Clauses. You can unsubscribe from the newsletter at any time using the link in every issue.

Booking platforms: Channex
If you book through a platform such as Airbnb or Booking.com, we receive the booking data the platform passes on (for example name, travel dates, price and contact details) through our channel manager Channex.io Ltd (Carmarthen, United Kingdom). Channex stores the data in the EU; the European Commission has adopted an adequacy decision for the United Kingdom. The platform's own privacy policy applies to the platform itself.

Previous booking software: vOffice
Until we have fully switched to our new booking system, we also store booking and guest data in the booking software of vOffice GmbH (Neustadt in Holstein, Germany).

AI features: Anthropic
For the AI villa search on this website and for internal reply drafts and translations, we use the Claude AI model by Anthropic (Anthropic Ireland, Limited, Dublin, Ireland, and Anthropic, PBC, USA). We transmit only the text you type into the search or, for a reply draft, the message or review we are replying to, together with the key details of the enquiry (salutation and name, country of origin, requested property, travel dates, number of guests) and the previous correspondence. We remove email addresses and phone numbers beforehand; your IP address is never transmitted. Anthropic does not use this data to train its models. Transfers to the USA are covered by Standard Contractual Clauses. We review and send every reply draft ourselves. Please do not enter sensitive data into the AI search. The legal basis is Art. 6(1)(b) and (f) GDPR.

Map on the villa pages: Google Maps
On the villa pages you can display a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map only loads once you have allowed marketing in the cookie banner or tapped “Show map”; your browser remembers this choice on this device. When the map loads, Google receives your IP address and device and browser details and may set its own cookies; data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework, standard contractual clauses). The map shows the villa’s town, not its address. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it in the cookie settings and clear the remembered choice via your browser’s site data.

WhatsApp
If you write to us on WhatsApp, your messages and phone number pass through WhatsApp Ireland Limited (Dublin, Ireland), a Meta group company. Data may be transferred to the USA in the process, and WhatsApp's privacy policy applies. If you prefer not to use WhatsApp, you can reach us by email or phone.

4.3 Guest registration with the authorities

Spanish law (Real Decreto 933/2021) requires us to report the data of all travellers for every stay to the Ministry of the Interior (SES.HOSPEDAJES platform, Ministerio del Interior). We report name, sex, identity document details, date of birth, nationality, address, contact details, travel dates and the payment method, payment date and payer; for minors, also their relationship to an accompanying adult. The legal basis is Art. 6(1)(c) GDPR. As required by law, we keep this data for three years and then delete it.

4.4 Transfers outside the EU

Some of the service providers named above are based outside the EU or may process data there. This only happens where the European Commission has recognised an adequate level of data protection (for example for the United Kingdom or for US companies certified under the EU-US Data Privacy Framework) or where Standard Contractual Clauses of the European Commission have been agreed (Art. 45 and 46 GDPR). You can request a copy of these safeguards at info@thebalearian.com.

4.5 Analytics and advertising (only with your consent)

We use the following services only if you have consented in the cookie banner, separately for “Analytics” and “Marketing”. The legal basis is your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device, Art. 22(2) LSSI-CE or § 25(1) TDDDG). You may withdraw it at any time, with effect for the future, via “Cookie settings” in the footer. We never pass names, email addresses, phone numbers or messages to these services in plain text, nor any search text. The providers may transfer data to the United States; Google and Meta are certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply (Art. 45 and 46 GDPR).

Analytics: Google Analytics 4
The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics shows us, in pseudonymised form, how our website is used: pages visited, clicks on contact, search and enquiry elements, scroll depth, time on site, villas viewed, filters and searches (without free text), return visits, and device, browser, language and approximate location. According to Google, the IP address is used only to determine location and is not stored in Google Analytics. Cookies: _ga and _ga_<ID> (lifetime 2 years). We retain analytics data for 14 months. More at policies.google.com/privacy.

Advertising: Google Ads
The provider is Google Ireland Limited (Dublin, Ireland). With Google Ads we measure whether an enquiry follows a click on one of our advertisements (conversion), and later show you relevant advertisements based on the pages you visited and the villas you viewed (remarketing, audiences). When you send an enquiry, we transmit your email address and phone number for more accurate measurement (enhanced conversions) only as a SHA-256 hash, calculated in your browser and impossible to reverse; Google matches it against its own accounts. Cookies: _gcl_au, _gcl_aw and _gcl_dc (lifetime 90 days). With every event, Google receives your IP address, browser and device information, and the address of the page you are viewing and of the page you came from (referrer); Google may also read and set its own cookies on doubleclick.net and google.com, such as IDE (lifetime up to 13 months). More at policies.google.com/technologies/ads.

Advertising: Meta Pixel (Facebook and Instagram)
The provider is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). The Meta Pixel reports to Meta the pages visited, villas viewed, searches, contact clicks, enquiries opened and sent, and the signal “strong interest”. Meta uses this to measure the success of our advertisements on Facebook and Instagram, to show you relevant advertisements and to build audiences. When you send an enquiry, we transmit your email address and phone number only as a SHA-256 hash (advanced matching). We also send the same events, enquiry sent and newsletter confirmed, from our server to Meta (Conversions API), again only with your consent, with the same hashed values, your IP address, browser details and the cookie values _fbp and _fbc; an event ID ensures that Meta counts them only once. We are jointly responsible with Meta for the collection and transmission to Meta (Art. 26 GDPR; agreement at facebook.com/legal/controller_addendum); Meta alone is responsible for any further processing. Cookies: _fbp and _fbc (lifetime 90 days). With every event, Meta receives your IP address, browser and device information, and the address of the page you are viewing and of the page you came from (referrer); Meta may also read and set its own cookies on facebook.com, such as fr (lifetime 90 days). More at facebook.com/privacy/policy.

Visit counters in your browser
With your consent to analytics or marketing, our website counts in your browser how many villas you have viewed in this session and when you visited us in the last 30 days (sessionStorage and localStorage, at most 10 points in time). The only thing derived from this is the signal “strong interest”, which goes to the services you have allowed; the counters themselves never leave your device. We delete them when you withdraw your consent.

4.6 Personal advice (browsing history, only with your consent)

If you choose “Personal advice” in the cookie banner, we record your visit to this website ourselves, without any third party provider. The controller is Balearian Hospitality Services S.L. (section 1). The data is stored on our server at Hetzner and in our database at Supabase in Frankfurt (section 4.2). The legal basis is your consent (Art. 6(1)(a) GDPR; for the identifier in your browser Art. 22(2) LSSI-CE and § 25(1) TDDDG respectively).

What we record
A random identifier in the cookie balearian-jv that only our server can read (valid as long as your consent, no more than 180 days). For each visit: pages viewed without search parameters, villas viewed, galleries opened, availability and price requests with dates and number of guests, filters chosen, searches, your wishlist, clicks on WhatsApp, phone or email, language and type of device. For the AI search we store only the recognised search criteria (such as island, number of guests, dates, features) and the villas suggested, not your search text. To know how you found us, we store the campaign details in the address (utm parameters), whether you came via an ad from Google, Microsoft or Meta (click identifiers such as gclid or fbclid, kept in their original form for no more than 90 days and afterwards only as the type) and which website you came from, for instance a search engine, ChatGPT or another AI assistant (only the name of the website). Whether you merely saw an ad is not known to us. We do not store your IP address for this purpose.

Connection with you as a person
If you send us an enquiry, we connect the history with that enquiry. We connect it with your contact in our customer database only once you have confirmed your email address for the wishlist, once your enquiry becomes a booking or once our team assigns the enquiry to your contact. This shows us which villas and wishes interest you, so that we can advise you precisely. This constitutes profiling; we do not use it for automated decisions with legal effect. This data is not shared with anyone.

Retention, withdrawal and deletion
A history that is not connected with any enquiry, booking or contact is deleted 180 days after your last visit. Individual page views and events are deleted 13 months after the visit; for an enquiry or booking only the summary of its origin then remains (channel, campaign, landing page, first and last touch), for no more than three years after your last visit (six years for a booking, like the booking records) and only while the enquiry, the booking or your contact is stored with us. You may withdraw your consent at any time via “Cookie settings” in the footer. We then immediately delete the identifier and the entire browsing history, including any history connected with an enquiry, a booking or your contact; the enquiry keeps only its origin as described in section 4.7. A history that is not connected with your name cannot be attributed to you by us (Art. 11 GDPR); you can delete it yourself at any time via “Cookie settings” on the device concerned.

4.7 Origin of your enquiry (without consent)

For every enquiry, even without your consent, we store the page of our website from which it was sent, any campaign details (such as utm parameters) in that page’s address and the channel derived from them (for instance a Google ad or our newsletter). Your browser transmits this information with the enquiry; we do not set a cookie for it and store nothing in your browser. The legal basis is our legitimate interest in knowing how well our advertising works (Art. 6(1)(f) GDPR). You may object to this at any time (Art. 21 GDPR). We keep this information for as long as the enquiry.