Privacy Policy

This privacy policy explains which personal data is processed when you visit this website or get in touch with us, for what purposes, on which legal basis, and which rights you have. It is provided in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 of 5 December on the protection of personal data and the guarantee of digital rights (LOPDGDD).

1. Who is responsible for your data

The controller responsible for the processing of personal data on this website is:

XCLUSIVE BESPOKE MALLORCA SL
NIF: B16563728
Carrer de Sant Miquel, 36, 5º
07002 Palma de Mallorca, Spain
Phone: +34 664 131 904
Email for data protection requests: contact@xclusivemallorca.com

2. Data processed when you visit this website

This website consists of static pages that are served by Cloudflare (Workers static assets), a hosting service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

As with any website, the hosting provider's servers process technical data each time a page is requested so that the page can be delivered and the service kept secure. This data is recorded in server logs and includes:

• the IP address of the requesting device,
• the date and time of the request,
• the address (URL) of the page or file requested,
• the browser and operating system in use (user agent),
• the page from which the request came (referrer), where your browser transmits it.

We do not combine this data with other information about you and we do not use it to create profiles. The website is delivered over an encrypted connection (HTTPS).

This website does not use analytics tools, advertising or tracking scripts, embedded maps or videos, or social media plug-ins. The fonts are served from our own website and are not loaded from a third party. The website has no user accounts, no shop and no online payment function.

3. Contact form

On our contact page you can send us a message using a form. The form asks for your name, email address, telephone number, a subject and your message. Name, email address and subject are required so that we can identify and answer your inquiry; the telephone number and the message text are optional. Before sending, you confirm by ticking a checkbox that you have taken note of this privacy policy.

When you submit the form, your browser sends the information you entered to Formspree, a form-processing service of Formspree, Inc., USA. Formspree receives the submission, together with the technical data of the request such as your IP address, and forwards its content to us by email. We use the information to handle your inquiry and to contact you about it.

Please do not send sensitive information through the form. This applies in particular to health details, for example when you would like us to arrange a doctor's visit. Please make such requests by phone at +34 664 131 904 instead.

4. Contact by email, phone and WhatsApp

If you contact us by email, by phone or via WhatsApp, we process the information you give us (for example your name, contact details and the content of your request) in order to handle your inquiry and any follow-up questions.

The email, phone and WhatsApp buttons on this website are plain links. No data is transferred by them until you click. If you choose to write to us on WhatsApp, the service is provided by WhatsApp Ireland Limited, which processes your data, including your phone number and the content of the communication, under its own privacy policy. If you prefer not to use WhatsApp, you can reach us by phone or email at any time.

Arranging a doctor's visit

We do not need medical details to arrange a doctor's house call; the doctor discusses them with the patient directly. If you nevertheless tell us something about your health or the health of the patient, we process this information only to arrange the visit and only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which we ask you for expressly before we pass any such information on. We pass it on only to the independent doctor who carries out the visit, and we delete it as soon as the visit has been arranged, unless statutory retention obligations apply. You can withdraw your consent at any time with effect for the future.

5. Newsletter

You can subscribe to our newsletter on the newsletter page. The sign-up form and the sending of the newsletter are provided by Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France).

The Brevo form is not loaded automatically. It is only loaded when you click the "Load sign-up form" button on the newsletter page. Until then, no data is sent to Brevo. Once the form is loaded, your browser connects to Brevo's servers, and Brevo processes the technical data of that request and may set its own cookies within the form.

The sign-up form is protected against automated misuse by Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is loaded together with the form, that is, only after you have clicked the button. It checks whether an entry is made by a person and for this purpose processes, among other things, your IP address and information about your browser and your use of the form, and it may set cookies. By loading the form you consent to this processing (Art. 6(1)(a) GDPR). Further information is available in Google's privacy policy.

To subscribe, you enter your email address and any further details requested in the form. We use a double opt-in procedure: after signing up you receive an email with a confirmation link, and your subscription becomes active only once you have clicked that link. We use your data solely to send you the newsletter.

You can unsubscribe at any time with effect for the future. Every newsletter contains an unsubscribe link; alternatively you can send us an email at contact@xclusivemallorca.com.

6. Links to third-party services

This website contains links to external services: our profiles on Facebook and Instagram (Meta Platforms Ireland Limited), LinkedIn (LinkedIn Ireland Unlimited Company) and YouTube (Google Ireland Limited), our location on Google Maps (Google Ireland Limited) and WhatsApp (WhatsApp Ireland Limited). These are ordinary links, not embedded content. No data is transferred to these providers while you browse our website.

Only when you click one of these links do you leave our website. From that moment the respective provider processes your data under its own responsibility and in accordance with its own privacy policy, over which we have no influence.

7. Cookies

This website itself does not set any cookies and does not use the local storage of your browser. Cookies can only be set by a third party after an action on your part, namely by Brevo and by Google reCAPTCHA if you choose to load the newsletter sign-up form. Details are set out in our Cookie Policy.

8. Purposes and legal bases

You are not obliged to provide personal data. Without the details marked as required in the contact form, however, we cannot answer your inquiry, and without an email address we cannot send you the newsletter.

9. Recipients and processors

We do not sell personal data. Data is passed on to third parties only where this is necessary to provide a service you have asked us for, where you have agreed to it, or where we are legally obliged to do so. The following service providers process personal data on our behalf in connection with this website:

Where it is necessary to arrange a service you have requested, we pass the details required for that service on to the partner who provides it.

10. International transfers

Cloudflare and Formspree are based in the United States of America. When you visit this website or submit the contact form, personal data may therefore be transferred to and processed in the USA, a country outside the European Economic Area. The same applies to Google reCAPTCHA if you load the newsletter sign-up form, because Google may process data on servers of Google LLC in the USA.

Such transfers rely on the safeguards provided for in Chapter V of the GDPR, for example an adequacy decision of the European Commission such as the EU–US Data Privacy Framework where the provider is certified under it, or the standard contractual clauses adopted by the European Commission. You can ask us for information about the safeguard that applies to a particular transfer using the contact details in section 1.

Brevo is based in France, within the European Union.

11. How long we keep your data

• Inquiries (contact form, email, phone, WhatsApp): we keep the data for as long as it is needed to handle your request and any business relationship that results from it, and afterwards only for as long as statutory retention and limitation periods require.
• Newsletter: we keep your data until you withdraw your consent by unsubscribing.
• Server logs: these are processed by Cloudflare only for as long as necessary to deliver the website and protect it against attacks, and are then deleted. We do not keep copies of these logs ourselves.

12. Your rights

Under the GDPR you have the following rights with regard to your personal data:

• Access: to know whether we process data about you and to receive a copy of it.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted, for example when it is no longer needed for the purposes for which it was collected.
• Restriction: to have the processing of your data restricted in the cases provided for by law.
• Data portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
• Objection: to object, on grounds relating to your particular situation, to processing that is based on our legitimate interests.
• Withdrawal of consent: to withdraw a consent you have given at any time. The withdrawal does not affect the lawfulness of processing carried out before it.

To exercise these rights, send an email to contact@xclusivemallorca.com or write to XCLUSIVE BESPOKE MALLORCA SL, Carrer de Sant Miquel, 36, 5º, 07002 Palma de Mallorca, Spain. Please tell us which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for the information needed to confirm it.

13. Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. You may also contact the supervisory authority of the EU member state in which you live or work.

14. No automated decision-making

We do not use your personal data for automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

15. Changes to this policy

We update this privacy policy when the website, the services we use or the legal requirements change. The version published on this page applies.

Last updated: September 2026