Privacy Policy
General Information
The protection of your personal data is very important to us. With this Privacy Policy, we inform you about which personal data we collect, how we process such data, and which rights you are entitled to under the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act LOPDGDD (Ley Orgánica 3/2018).
Data Controller
Balearian Hospitality Services S.L.
operating under the brand The Balearian – Villas & Concierge
Carrer d’Alber 64
07008 Palma de Mallorca
Spain
CIF/NIF: B26863035
Email: info@thebalearian.com
Balearian Hospitality Services S.L. is the controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR).
A data protection officer is not legally required.
Purposes and Legal Bases of Processing
We process personal data exclusively in accordance with the GDPR and the Spanish LOPDGDD.
a) Enquiries and communication
Legal basis: Art. 6(1)(b) GDPR.
b) Booking enquiries and contractual processing
Legal basis: Art. 6(1)(b) GDPR.
c) Use of property management systems (e.g. vOffice)
Legal basis: Art. 6(1)(b) GDPR.
Processing is carried out under a data processing agreement pursuant to Art. 28 GDPR.
d) Legal obligations (e.g. statutory reporting requirements to authorities)
Legal basis: Art. 6(1)(c) GDPR.
When booking accommodation, personal data of guests may be transmitted to competent authorities in order to comply with legal obligations, in particular the statutory guest registration requirements applicable in Spain.
e) Marketing and legitimate interests
Legal basis: Art. 6(1)(f) GDPR.
Where required, processing is carried out only on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
Categories of Personal Data
In particular, the following categories of personal data may be processed:
Name and address
Email address and telephone number
Booking and stay related data
Identification documents (statutory reporting requirements)
Payment information
IP address as well as device and browser data
Recipients of Personal Data
Your personal data may be disclosed to:
Property owners and property managers
Service providers used by us (e.g. property management systems)
Public authorities where legally required
Data is only disclosed where this is necessary for contract performance or to comply with legal obligations.
Within the framework of the brokerage of holiday accommodations, personal data may be transmitted to the owners of the respective property or to local property managers or service providers appointed by them. This transmission takes place only insofar as it is necessary for the execution of the booking, the organisation of the stay, key handover, guest assistance during the stay or to fulfil legal obligations.
Processing is carried out on the basis of Art. 6(1)(b) GDPR (performance of a contract) and, where applicable, Art. 6(1)(c) GDPR (legal obligations).
Data Retention
Personal data is stored only for as long as necessary for the respective purposes or as required by statutory retention obligations.
Your Rights as a Data Subject
You have the right to:
Access pursuant to Art. 15 GDPR
Rectification pursuant to Art. 16 GDPR
Erasure pursuant to Art. 17 GDPR
Restriction of processing pursuant to Art. 18 GDPR
Data portability pursuant to Art. 20 GDPR
Object to processing pursuant to Art. 21 GDPR
To exercise your rights, an informal notification to the contact address listed above is sufficient.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority.
The competent authority in Spain is:
Agencia Española de Protección de Datos (AEPD)
www.aepd.es
Cookies
Our website uses technically necessary cookies.
Analytics and marketing cookies are used only with your prior consent.
Web Analytics and Online Advertising
If analytics or advertising services (e.g. Google Analytics, Google Ads) are used, this is done exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
When using such services, personal data may be transferred to third countries outside the European Union. In such cases, the transfer of data is carried out exclusively on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.
Social Media
We maintain online presences on social networks such as Instagram, Facebook and LinkedIn.
The processing of personal data is based on legitimate interests pursuant to Art. 6(1)(f) GDPR.
The privacy policies of the respective platform operators also apply.
Data Security
We implement appropriate technical and organisational security measures, in particular SSL encryption, to protect your data against loss, manipulation or unauthorised access.
Changes to this Privacy Policy
This Privacy Policy may be updated to reflect legal, technical or organisational changes.
Status: March 2026