Privacy Policy
Last updated: 16 September 2026
Data controller
Lucas Lorilleux, trading as “Mallorca Concierge”, NIE Z0163383L, based in Palma de Mallorca, Illes Balears, Spain. Contact: contact@mallorca-concierge.com. No Data Protection Officer has been appointed.
What we collect
Identification and contact information: name, email, phone/WhatsApp, language, country. Request specifics: dates, party size, budget, preferences. Verification data such as identity documents or driving-licence details, where required. Correspondence content, plus standard technical request logs processed by the hosting provider. The website sets a strictly necessary cookie to remember your cookie choice and, only if you accept, Google Analytics cookies (provider: Google Ireland Limited). Details are in the Cookie Policy.
Legal basis for processing
Processing occurs under GDPR Article 6 for contract performance, legitimate interests, consent, or legal obligations, covering purposes such as answering enquiries, arranging services, client care, commercial communications and accounting.
Data sharing
Independent providers receive the data necessary to deliver requested services. Processors include Netlify, Inc. for hosting and content delivery, and our accounting service. WhatsApp is an external service that you choose to open and applies its own privacy policy. We never sell your data and we do not use it for third-party advertising.
International transfers
Netlify and WhatsApp may process data in the United States. Where applicable, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
Retention periods
Enquiries: 12 months. Bookings: for the service duration, then archived. Invoices: 6 years. Anti-money-laundering records: 10 years. Marketing consent: until withdrawn.
Your rights
You may request access, correction, erasure, restriction, objection, portability, or withdraw consent, by contacting us. Complaints can be filed with the Spanish Data Protection Agency (AEPD).
Children
Our services are arranged for adults only; parental responsibility applies for any minor-related activities.
Security and changes
We apply reasonable technical and organisational measures to protect your data. This policy may be updated; material changes are notified to existing clients.