Privacy policy
Last updated: 3 September 2026
This is a translation provided for convenience. In the event of any discrepancy, the Spanish version shall prevail: Política de privacidad.
This policy explains how we process the personal data you provide when requesting or booking a transfer, when writing to us, or when browsing mallorcatransfers.eu. It has been drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
1. Data controller
Controller: Carlos Fernández Calonge
NIF (Spanish tax ID): 43199143Z
Trade name: Mallorca Transfers
Registered address: Carrer Joan Massanet i Moragues 11, portal dcha, 2ª — 07010 Palma de Mallorca, Illes Balears (Spain)
Email: charliebrawnstudio@hotmail.com
Telephone: +34 664 236 990
2. Data we process
Depending on the type of relationship, we may process:
- Identification and contact details: first name and surname, telephone number, email address and, where applicable, language of communication.
- Service details: pick-up location, destination, date and time, number of passengers, flight or vessel number, special luggage and the need for child seats.
- Billing details: NIF or passport number and country, address and details of the transaction, where an invoice must be issued.
- Payment data: the transaction is carried out through an external payment gateway. We do not store and have no access to full card numbers. We retain only the transaction identifier and its status.
- Browsing data: as described in the Cookie policy.
We do not request or process special categories of data. If you need to tell us about reduced mobility or any other circumstance relevant to the service, we will use that information exclusively to organise the transfer and will delete it once the transfer has been completed.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling enquiries and preparing quotes | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) | 12 months from the last contact if no booking is made |
| Managing, confirming and coordinating the booking | Performance of the contract (Art. 6(1)(b) GDPR) | Duration of the service and applicable complaint periods |
| Disclosing the necessary data to the transport company | Performance of the contract (Art. 6(1)(b) GDPR) | Until completion of the transfer |
| Collecting the deposit and the intermediation fees | Performance of the contract (Art. 6(1)(b) GDPR) | In line with tax retention periods |
| Issuing invoices and complying with accounting and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) | 4 years (Spanish tax legislation) and 6 years (Spanish Commercial Code) |
| Handling complaints and bringing or defending legal claims | Legitimate interest (Art. 6(1)(f) GDPR) | Until the limitation period for such claims expires |
| Sending commercial communications or offers | Consent (Art. 6(1)(a) GDPR) | Until you withdraw your consent |
4. Disclosure of data to transport companies
Mallorca Transfers acts as an intermediary. So that your transfer can be carried out, we disclose to the assigned partner transport company only the data strictly necessary: name, contact telephone number, pick-up point, destination, date and time, number of passengers and, where applicable, flight number.
These companies hold a VTC licence, an authorisation for non-scheduled passenger transport or a taxi licence, and act as independent controllers in respect of the provision of the transport, not as processors acting on our behalf.
With each partner company we enter into an agreement requiring them to:
- Use the data solely to carry out the specific transfer assigned to them.
- Not use it for their own commercial purposes or add it to their marketing databases.
- Not retain it for longer than necessary, unless required by law.
- Notify us within a maximum of 24 hours of any security incident affecting this data.
We do not disclose your payment data, your email address or your billing details to the transport companies.
Other recipients
- Public authorities (the Spanish Tax Agency, Social Security, the courts) where there is a legal obligation.
- The owner's bank, for the management of payments.
- Our tax and accounting advisers, acting as processors and under a contract compliant with Article 28 GDPR.
5. Technology providers and international transfers
We use the following providers, which act as processors:
| Provider | Function | Location and safeguards |
|---|---|---|
| Netlify | Website hosting | USA — European Commission Standard Contractual Clauses |
| Stripe | Payment gateway | EU / USA — Standard Contractual Clauses |
| Meta (WhatsApp Business) | Communication with the customer | EU / USA — Standard Contractual Clauses |
| Google Ireland Ltd. (Tag Manager / Analytics) | Audience measurement, only with your consent | EU / USA — Standard Contractual Clauses |
Where there is an international transfer of data, it is covered by the Standard Contractual Clauses approved by the European Commission or by an adequacy decision in force. You may request information about the safeguards applied by writing to charliebrawnstudio@hotmail.com.
6. Your rights
You may exercise the following rights at any time:
- Access: to find out what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request its deletion when it is no longer necessary.
- Restriction: to ask us to suspend the processing in certain circumstances.
- Objection: to object to processing based on legitimate interest.
- Portability: to receive your data in a structured, commonly used format.
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to charliebrawnstudio@hotmail.com stating the right you wish to exercise and enclosing a copy of a document proving your identity. We will reply within a maximum of one month.
If you consider that we have not dealt with your request properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
7. Security
We apply appropriate technical and organisational measures to protect the data against loss, unauthorised access or alteration: encryption of communications via HTTPS, restricted access to the information, use of providers with recognised security certifications, and disclosure to the carrier limited to the essential data.
8. Minors
The services are intended for persons over 18 years of age. We do not knowingly collect data relating to minors without the authorisation of the holder of parental responsibility or guardianship. Where minors travel on a transfer, their data will be provided by the contracting adult, who warrants that they are entitled to do so.
9. Automated decision-making
We do not take automated decisions or carry out profiling that produces legal effects concerning you.
10. Changes to this policy
We may update this policy to reflect legislative developments or changes to our services. The version in force will always be the one published on this page, together with its update date.