Privacy Policy

(Effective 3 October 2026)

This Privacy Policy (“Policy”) describes how LumaGuide LTD, a company incorporated and registered in Cyprus (referred to as “LumaGuide,” “we,” “us,” “our” and, where applicable, operating under the brand name “MallorcaGuide.com”), collects, uses, discloses, and protects the personal data of natural persons (“you,” “your”) who interact with our mobile applications, website, and event-management tools (collectively, the “Platform”).

For purposes of applicable data protection laws, including the EU General Data Protection Regulation (GDPR), we act as a data controller when we determine the purposes and means of processing your personal data.

If you choose not to provide the personal data we request, some Platform features may be unavailable.

1. Definitions

Term - Meaning (summary)

• Controller - Entity that decides the purposes and means of processing personal data.
• Processor - Entity that processes personal data on behalf of a controller.
• Organizer - Individual or legal entity using the Platform to publish, promote or ticket events.
• User - Individual or legal entity using the Platform to browse guides or obtain event information or tickets.

Personal Data

• Any information relating to an identified or identifiable natural person (e.g., name, email, IP address).

Processing

• Any operation performed on personal data, automated or not (collection, storage, use, disclosure, deletion, etc.).

Sensitive Data

1. What We Collect, Why, and With Whom We Share It

User (account registration, ticket purchase, inquiry, coupon use)

Name, email, phone, password (hash), language/locale, payment token (last 4 digits), marketing preferences:

• Create & secure account
• Process payments & issue tickets
• Send service or marketing messages (opt-in)
• Personalized event recommendations

Payment processors, email/SMS providers, fraud-detection tools

Organizer (brand or event page)

Business name, contact person, email, phone, public URL, bank or Stripe IDs, VAT/NIF

• Verify identity & create organizer workspace
• Remit payouts & handle invoices
• Display organiser profile to Users

Payment processors, KYC/KYB vendors, and accounting tools

Any User/Organizer (support, feedback, surveys)

Content of communication, attachments, metadata

• Respond to queries & improve services

Customer-support platform, survey tool

Visitor (no login)

IP address, browser/OS, device ID, referring URL, cookies

• Secure Platform, prevent abuse
• Analytics & performance metrics
• Tailor content and ads (consent-based)

Analytics providers, security vendors

Social-login User

Public profile ID, name, email, avatar provided by the social network

• Simplify sign-in & personalise account

Auth identity provider

* We require all processors to act under written contracts and follow the GDPR standard contractual clauses where applicable.

Weekend newsletter

If you sign up for our weekly "Mallorca this weekend" email, we collect your email address and the language you choose. We also record where you signed up: the page you were on

and, if you arrived through a link carrying campaign tags (for example from one of our adverts or social media posts), the name of that campaign. We record when you signed up,

confirmed and, if applicable, unsubscribed.

We use this information only to send you the newsletter in your chosen language and to understand which of our promotions bring in readers. The legal basis is your consent. We

send nothing until you click the confirmation link in the email we send you. If you do not confirm within 14 days, we delete your address.

Every newsletter contains a one-click unsubscribe link, and you can also withdraw your consent by writing to us at the address given in "Contact" below. When you unsubscribe,

we keep your address marked as unsubscribed so that we do not email you again. Ask us if you would rather we deleted it entirely.

Our emails are delivered by SendGrid (Twilio Inc.), which processes your address on our behalf, and we keep a copy of each email we send, including the recipient's address, for

30 days. Our newsletter emails contain no tracking pixels and we do not record whether you open them. Links back to our website carry a campaign tag so that we can count, in

aggregate, visits that come from the newsletter. The sign-up form is protected by Google reCAPTCHA, which processes information about your device and your use of the page to

tell people from automated programs; Google's privacy policy applies to that processing.

1. Legal Bases for Processing (GDPR / UK GDPR)

We process your data only when at least one lawful basis applies:

• Contract – to run and secure our business, prevent fraud, analyze usage, and market similar services, provided your rights do not override ours.
• Legitimate Interests – to run and secure our business, prevent fraud, analyze usage, and market similar services, provided your rights do not override ours.
• Consent – for email marketing, non-essential cookies or where local law requires consent. You may withdraw consent at any time.
• Legal Obligation – to comply with accounting, tax, consumer-protection, anti-money-laundering or other laws.

1. International Transfers

Our primary servers are located in the European Union (Frankfurt, Germany). When we transfer data across borders, we rely on Standard Contractual Clauses and supplementary measures (encryption, MFA, restricted role-based access). When we transfer data outside the EEA/UK/Switzerland, we rely on:

• European Commission–approved Standard Contractual Clauses; or
• An EU/US or UK/US adequacy mechanism (if available); or
• Your explicit consent, where other safeguards are not feasible, then anonymized or erased unless legal obligations require longer.

1. Retention

We retain personal data only as long as necessary for the purposes set out above:

• User accounts & organizer workspaces – while the account is active and up to 30 days after deletion, then anonymised or erased unless legal obligations require longer.
• Transaction records – 6 years (Spanish tax law).
• Marketing consents – until you opt out or 3 years after last interaction, whichever is sooner.

1. Security

We use industry-standard safeguards, including:

• TLS 1.3 encryption in transit and AES-256 at rest
• Firewall-segmented networks and 24/7 intrusion monitoring
• Role-based access controls and MFA for staff
• Regular penetration tests and ISO 27001-aligned policies

If we discover a breach that affects your data, we will notify you and the relevant supervisory authority without undue delay.

1. Your Rights

Under GDPR (and comparable laws) you may:

Obtain a copy of the personal data we hold about you.

Rectification - Correct inaccurate or incomplete data.

Deletion (“Right to be Forgotten”) - Ask us to erase your data in certain circumstances.

Restriction - Request temporary suspension of processing.

Portability - Receive your data in a structured, machine-readable format, or ask us to transmit it to another controller.

Objection - Object to processing based on legitimate interests or direct marketing.

Withdraw Consent - Opt out of processing that relies on consent (e.g., marketing e-mails).

To exercise any right, email [email protected] from the address linked to your account. We will verify your identity and respond within 30 days.

LumaGuide LTD does not sell or share personal information for monetary consideration.

Cookies & Similar Technologies

We use:

• Essential cookies – required for security, authentication, load-balancing (cannot be disabled).
• Analytics cookies – help us understand traffic and improve UX (opt-in in the EEA).
• Advertising cookies – personalise ads on third-party sites (consent required).

You can manage non-essential cookies via the banner presented on first visit or through your browser settings.

Children

The Platform is not directed to children under 16. We do not knowingly collect their data without parental consent. Parents who believe their child has provided data may contact us for deletion.

Organizers as Independent Controllers

When an Organizer collects attendee data on an event-specific form, that Organizer is the independent controller for such information. Attendees should refer to the Organizer’s privacy notice for details on that processing.

Changes to This Policy

We may update this Policy to reflect legal or operational changes. We will post the revised version with a new “Effective” date and, where material, give at least 15 days’ notice before it takes effect.

Contact: Data Protection Officer / Privacy Team

LumaGuide LTD

Griva Digeni, 78

2nd floor, Flat/Office V1

Neapoli, 3101, Limassol, Cyprus

Email: [email protected]

Supervisory authority: Agencia Española de Protección de Datos (AEPD)

If you believe your data protection rights have been violated, you may lodge a complaint with the Cyprus Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy) or your local supervisory authority.

Thank you for trusting MallorcaGuide with your data. We are committed to treating it with care and transparency.