The controller within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (“LOPDGDD”) is:
Paul Tenambergen
Mallorca on Bike
Crta. Artà – Pto. Alcúdia 65 B
07458 Can Picafort / Mallorca (Spain)
Tax ID (NIF): X9639997F
Phone: +34 632 48 77 21
Email: info@mallorcaonbike.com
Contact for Privacy-Related Enquiries
For questions about data protection or to exercise your rights, please contact the controller listed above directly. Given the nature and scale of the business, appointing a separate Data Protection Officer under Art. 37 GDPR / Art. 34 LOPDGDD is not legally required; enquiries are handled by the controller personally.
Your Rights as a Data Subject
Using the contact details above, you may exercise the following rights at any time, under the GDPR and, additionally, the LOPDGDD:
- Right of access to the personal data we hold about you and its processing (Art. 15 GDPR)
- Right to rectification of inaccurate personal data (Art. 16 GDPR)
- Right to erasure of your data (Art. 17 GDPR)
- Right to restriction of processing, where a legal retention obligation prevents immediate deletion (Art. 18 GDPR)
- Right to object to the processing of your data (Art. 21 GDPR)
- Right to data portability, where processing is based on consent or a contract (Art. 20 GDPR)
Where you have given us your consent, you may withdraw it at any time with effect for the future.
Right to Lodge a Complaint with the Supervisory Authority
You may lodge a complaint at any time with the supervisory authority responsible for us:
Agencia Española de Protección de Datos (AEPD)
Edificio Cuzco IV, Paseo de la Castellana, 141, planta 9
28046 Madrid, Spain
www.aepd.es
Collection of General Information When Visiting Our Website
Nature and purpose of processing: When you access our website, general information (server log files) is automatically collected, including browser type, operating system, your internet service provider’s domain name, and IP address. This serves to ensure a smooth connection, trouble-free use of the website, evaluation of system security, and website optimisation.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability and functionality of our website).
Retention period: Log file data is deleted or anonymised after 14 days at the latest, so that it can no longer be linked to the accessing client.
Provision of Paid Services (Bicycle Rental)
Nature and purpose of processing: To provide and invoice our rental services, we request additional data, including payment details.
Legal basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract).
Retention period: Invoices and related records are kept for at least 4 years under Art. 66 of the Ley General Tributaria (Spanish tax limitation period) and for 6 years under Art. 30 of the Código de Comercio (Spanish commercial-law retention obligation), counted from the last relevant entry. To reliably meet both deadlines, we retain the relevant documents for 6 years.
Contact Form
Nature and purpose of processing: Data you enter in the contact or booking enquiry form (name, email address, phone number if provided, rental period, message) is stored for the purpose of processing your enquiry.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry); for enquiries relating to a specific offer, Art. 6(1)(b) GDPR (pre-contractual measures).
Retention period: Enquiries are deleted no later than 6 months after processing, unless a contractual relationship is entered into, in which case the retention periods for bookings stated above apply.
Cookies and Embedded Services
In addition to strictly necessary cookies, this website uses the following third-party service:
Google Maps: We embed interactive maps from Google Maps, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you visit the relevant page, Google receives information that you have accessed that page, regardless of whether you are logged into a Google account. Further information: policies.google.com/privacy.
Legal basis (Google Maps): This service is only embedded with your prior consent (Art. 6(1)(a) GDPR), which you can give or decline via our cookie consent tool and withdraw at any time with effect for the future, as there is no technical necessity for it.
This website does not use Google Fonts, Google Analytics, or Google reCAPTCHA.
SSL Encryption
To protect the security of your data during transmission, we use encryption methods that reflect the current state of the art (SSL/TLS) via HTTPS.
Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements or to reflect changes to our services. The version in force at the time of your visit applies.
Last updated: August 2026to our services. The version in force at the time of your visit applies.
Last updated: August 2026