Privacy Policy
The controller within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (“LOPDGDD”) is:
Paul Tenambergen
Mallorca on Bike
Crta. Artà – Pto. Alcúdia 65 B
07458 Can Picafort / Mallorca (Spain)
Tax ID (NIF): X9639997F
Phone: +34 632 48 77 21
Email: info@mallorcaonbike.com
Contact for privacy-related enquiries
For questions about data protection or to exercise your rights, please contact the controller listed above directly. Given the nature and scale of the business, the appointment of a separate Data Protection Officer under Art. 37 GDPR / Art. 34 LOPDGDD is not legally required; enquiries are handled by the controller personally.
Your rights as a data subject
Under the contact details above, you may exercise the following rights at any time, under the GDPR and, additionally, the LOPDGDD:
- Right of access to the personal data we hold about you and its processing (Art. 15 GDPR)
- Right to rectification of inaccurate personal data (Art. 16 GDPR)
- Right to erasure of your data (Art. 17 GDPR)
- Right to restriction of processing, where a legal retention obligation prevents immediate deletion (Art. 18 GDPR)
- Right to object to the processing of your data (Art. 21 GDPR)
- Right to data portability, where processing is based on consent or a contract (Art. 20 GDPR)
Where you have given us your consent, you may withdraw it at any time with effect for the future.
Right to lodge a complaint with the supervisory authority
You may lodge a complaint at any time with the supervisory authority responsible for us:
Agencia Española de Protección de Datos (AEPD)
Edificio Cuzco IV, Paseo de la Castellana, 141, planta 9
28046 Madrid, Spain
www.aepd.es
Collection of general information when visiting our website
Nature and purpose of processing: When you access our website, general information (server log files) is automatically collected, including browser type, operating system, your internet service provider’s domain name, and IP address. This serves to ensure a smooth connection, trouble-free use of the website, evaluation of system security, and website optimisation.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability and functionality of our website).
Retention period: Log file data is deleted or anonymised after 14 days at the latest, so that it can no longer be linked to the accessing client.
Provision of paid services (bicycle rental)
Nature and purpose of processing: To provide and invoice our rental services, we request additional data, including payment details.
Legal basis: Art. 6(1)(b) GDPR (necessary for the performance of a contract).
Retention period: Invoices and related records are kept for at least 4 years under Art. 66 of the Ley General Tributaria (Spanish tax limitation period), and for 6 years under Art. 30 of the Código de Comercio (Spanish commercial-law retention duty), counted from the last entry in the books. To reliably satisfy both periods, we retain the relevant records for 6 years.
Contact form
Nature and purpose of processing: The data you enter in the contact/booking enquiry form (name, email address, phone number where given, requested period, message) is stored for the purpose of processing your enquiry.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry); for enquiries about a specific offer, Art. 6(1)(b) GDPR (pre-contractual measures).
Retention period: Enquiries are deleted no later than 6 months after processing, unless a contractual relationship is established, in which case the retention periods stated above for bookings apply.
Cookies and embedded services
In addition to technically necessary cookies, this website uses the following third-party services:
Google Maps: We embed interactive maps from Google Maps, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you access the relevant page, Google receives information that you have visited that page, regardless of whether you are logged into a Google account. Further information: policies.google.com/privacy.
Legal basis (Google Maps): Embedding occurs only with your prior consent (Art. 6(1)(a) GDPR), which you can give or decline via our cookie consent tool and withdraw at any time with effect for the future, as there is no technical necessity for this service.
Google reCAPTCHA: To protect our booking and contact form against automated abuse (spam), we use the Google LLC reCAPTCHA service. This transmits information such as your IP address and other data Google requires for bot detection. Further information: policies.google.com/privacy.
Legal basis (reCAPTCHA): Art. 6(1)(f) GDPR (legitimate interest in protecting our forms against abuse). Note for implementation/legal review: depending on the reCAPTCHA version in use (particularly v3, which continuously evaluates usage data in the background), a consent requirement may apply instead of pure legitimate interest — this should be confirmed in legal review.
Neither Google Fonts nor Google Analytics are used on this website (verified in the page source, as of August 2026).
SSL encryption
To protect the security of your data during transmission, we use encryption methods (SSL/TLS) via HTTPS that reflect the current state of the art.
Changes to this privacy policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or to reflect changes to our services. The version in force at the time of your visit applies.
Last updated: August 2026