Privacy Policy

Adventure Tours Mallorca S.L. · Last updated: 24 September 2026

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter “GDPR”, in Spanish “RGPD”) is:

For questions about data protection and to exercise your rights, you can reach us at the e-mail address above using the subject line “Data protection”.

2. Applicable legislation

This policy is based on:

• Regulation (EU) 2016/679 (GDPR/RGPD)
• Ley Orgánica 3/2018 of 5 December, on the protection of personal data and the guarantee of digital rights (LOPDGDD)
• Ley 34/2002 of 11 July, on information society services and electronic commerce (LSSI-CE), in particular Art. 21 and Art. 22.2 on storage technologies on terminal equipment
• Ley Orgánica 1/1982 on the protection of the right to one’s own image (for photo and video recordings taken during our tours)

3. What data we process, for what purpose and on what legal basis

3.1 Contact form, e-mail, telephone and WhatsApp

If you contact us via the contact form, by e-mail, by telephone or via WhatsApp, we process your name, your e-mail address, your telephone number and the content of your message.

• Purpose: Responding to your enquiry, advising you about our tours, preparing a booking.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent given via the checkbox in the form).
• Retention period: Until your enquiry has been fully dealt with, and for up to 12 months thereafter for evidentiary purposes. If the enquiry leads to a booking, the periods set out under 3.2 apply.

When communicating via WhatsApp, data is additionally processed by WhatsApp Ireland Ltd. and Meta Platforms Ireland Ltd. We have no influence over this processing. If you wish to avoid it, please contact us by e-mail or telephone.

3.2 Booking and delivery of tours

For the booking we process your first and last name, e-mail address, telephone number, number and age of participants, requested date and time, pick-up address or hotel, as well as payment and invoicing data.

• Purpose: Conclusion and performance of the contract, organisation of pick-up and tour, invoicing, statutory record retention.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for tax and commercial law retention Art. 6(1)(c) GDPR.
• Retention period: Booking data for the duration of the contractual relationship; invoicing and accounting records for 6 years pursuant to Art. 30 Código de Comercio (Spanish Commercial Code) and 4 years for tax limitation purposes pursuant to Art. 66 Ley General Tributaria (Spanish General Tax Act).

Bookings are technically processed via the booking platform Regiondo GmbH, Rosenheimer Str. 145e, 81671 Munich, Germany. Regiondo processes the booking data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

3.3 Health information for diving activities

For try-out dives and other diving activities, we are required by the standards of the training organisation and for safety reasons to collect a health questionnaire before participation. In doing so we process information about your state of health — this constitutes special categories of personal data within the meaning of Art. 9 GDPR.

• Purpose: Determining fitness to dive, protecting the life and health of participants, complying with safety requirements.
• Legal basis: Art. 9(2)(a) GDPR (your explicit consent) in conjunction with Art. 6(1)(b) GDPR; additionally Art. 9(2)(c) GDPR (protection of vital interests).
• Recipients: Exclusively the diving instructor in charge and, in an emergency, medical personnel. No disclosure for any other purpose.
• Retention period: Retained for evidentiary and liability purposes for the duration of the statutory limitation periods.

3.4 Photo and video recordings during the tours

Our guides take photos and videos during the tours in which participants may be identifiable.

• Purpose a) Sharing them with you: After the tour we make the recordings from your tour available to you for download free of charge.
• Purpose b) Publication: Any use of the recordings on our website, on social networks or in advertising materials takes place exclusively with your prior, separate and explicit consent.
• Legal basis: Art. 6(1)(a) GDPR in conjunction with Art. 2 Ley Orgánica 1/1982 (right to one’s own image).
• Retention period: The download link remains available for 30 days. After that we delete the recordings, unless you have consented to further use.
• Withdrawal: You may withdraw any consent given at any time, without any formal requirements, by writing to info@adventure-tours-mallorca.com. We will then remove the relevant recordings from our own channels without undue delay.

You are under no obligation to be photographed. Simply let the guide know at the start of the tour — you will suffer no disadvantage whatsoever as a result.

3.5 Promotional e-mails to existing customers

If you have booked a tour with us, we will subsequently send you your tour photos and occasionally inform you about our own comparable activities from our range.

• Legal basis: Art. 21(2) Ley 34/2002 (LSSI-CE) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in direct marketing to our own existing customers for similar products); otherwise Art. 6(1)(a) GDPR (consent).
• Objection: You may object to receiving such messages at any time and free of charge — via the unsubscribe link in every e-mail or by sending us an informal message.
• Retention period: Until you object. Your e-mail address will then be added to a suppression list so that you receive no further messages.

We only send advertising for products or services of other companies if you have expressly agreed to this.

3.6 Reviews

After the tour we ask you to leave a review on Google or TripAdvisor. Participation is voluntary. If you follow the link, the privacy policy of the respective provider applies. On our website we display reviews published publicly on Google by means of a widget; only the data you have made public on Google yourself is processed in this context.

3.7 Participation and rental agreements on site, driving licence and deposit

For buggy tours, rentals and diving activities, participants sign a participation or rental agreement on site. We process name, address, date of birth, signature and, for drivers, driving licence details (number, category, validity), which we check in the original or in the miDGT app.

Purpose: performance of the contract, verification of driving entitlement, handling of accidents, damage and insurance claims. Legal basis: Art. 6(1)(b) GDPR; for disclosure to authorities Art. 6(1)(c) GDPR.

Traffic fines: If a driver commits a traffic offence during the tour or rental, we as the vehicle keeper are legally obliged to identify the responsible driver to the traffic authority (DGT) (Art. 11 Spanish Traffic Act) and pass on their details for this purpose.

Deposit: For full-day buggy rental, a deposit is paid in cash or by card. For card payments, the payment service provider processes the card data; we do not receive full card details.

Retention: 5 years after the end of the activity (limitation period under Art. 1964 Spanish Civil Code), or until the conclusion of any ongoing proceedings.

3.8 Bookings via partner platforms

If you book via a partner platform (e.g. GetYourGuide) or a travel agency, it transmits to us the data required to carry out the activity (name, contact details, date, number of participants). The legal basis is Art. 6(1)(b) GDPR. Processing by the platform itself is governed by its own privacy policy.

4. Website, storage technologies and analytics

4.1 Server log files

When you access our website, data is automatically transmitted to our hosting provider: IP address, date and time of access, page accessed, volume of data transferred, browser type and operating system, referrer URL.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical operation, stability and security).
• Retention period: The log files are automatically deleted after a short time.

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The provider processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany.

4.2 Consent management

We use a consent banner (consent management tool) on our website. It lets you decide for yourself which services that are not technically necessary may be loaded. Your selection is stored on your device so that we can take it into account on your next visit and demonstrate it.

• Legal basis: Art. 22.2 LSSI-CE and Art. 6(1)(c) GDPR (obligation to demonstrate consent pursuant to Art. 7(1) GDPR).

You can change or withdraw your consent at any time using the “Privacy settings” button in the page footer. The withdrawal takes effect for the future.

Technically necessary storage operations (session management, shopping cart, language selection via WPML, storage of your consent) take place without consent on the basis of Art. 22.2 sentence 2 LSSI-CE.

4.3 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics collects information about how visitors use our website — such as the pages accessed, time spent, approximate location and device used. The IP address is processed by Google in truncated form.

• Purpose: Evaluating and improving our offering.
• Legal basis: Art. 6(1)(a) GDPR — exclusively on the basis of your consent given in the consent banner.
• Retention period: no more than 14 months (Google Analytics default setting)
• Further information:policies.google.com/privacy

4.4 Google Ads and conversion tracking

We advertise via Google Ads. This involves a tag that allows us to measure whether users carry out a particular action on our website after clicking on an advertisement. In addition, Google may record users for remarketing audiences.

• Provider: Google Ireland Limited, Dublin, Ireland.
• Legal basis: Art. 6(1)(a) GDPR (consent).

4.5 Meta Pixel (Facebook/Instagram)

We use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It allows us to track the effectiveness of our advertisements on Facebook and Instagram and to deliver targeted advertising to users. The pixel may transmit data to Meta that can be linked to a user account on Facebook or Instagram.

• Legal basis: Art. 6(1)(a) GDPR (consent). Without your consent the pixel is not loaded.
• Joint controllership: We are joint controllers with Meta for the collection and transmission of the data (Art. 26 GDPR).
• Further information:facebook.com/privacy/policy

4.6 Google Maps

On our contact page we embed a map from Google Maps so that you can find our meeting point. When the map is loaded, your IP address is transmitted to Google. The map is only loaded after you have given your consent.

Legal basis: Art. 6(1)(a) GDPR (consent).

4.7 YouTube videos

We embed videos from YouTube (Google Ireland Limited). They are embedded in extended data protection mode and/or only after you have given your consent. When a video is played, data is transmitted to Google.

Legal basis: Art. 6(1)(a) GDPR (consent).

4.8 Instagram feed

On our website we display posts from our Instagram account. When the feed is loaded, data may be transmitted to Meta Platforms Ireland Limited.

Legal basis: Art. 6(1)(a) GDPR (consent).

4.9 Google Fonts

Our website loads fonts from Google servers. In doing so, your IP address is transmitted to Google.

Legal basis: Art. 6(1)(a) GDPR (consent).

5. Recipients of your data

We only pass on your data where this is necessary for the performance of the contract, on the basis of a legal obligation or on the basis of your consent. Recipients may be:

We do not sell your data and we do not pass it on to third parties for advertising purposes.

6. Transfers to third countries

Some of the providers named also process data in the United States. The transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, provided that the respective provider is certified, and otherwise on the standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Despite these safeguards, it cannot be entirely ruled out that US authorities may access the data.

7. Your rights

You have the right at any time to:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on legitimate interests, in particular to direct marketing (Art. 21 GDPR)
• Withdraw consent you have given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal message to info@adventure-tours-mallorca.com is sufficient. We will respond within one month. For security reasons we may request proof of identity.

8. Minors

Children and young people take part in some of our activities. Pursuant to Art. 7 LOPDGDD, persons who have reached the age of 14 may validly consent to the processing of their data themselves. For participants under the age of 14, the consent of a parent or legal guardian is required. We accept bookings for minors exclusively from accompanying adults; the processing of the child’s data takes place on the basis of that booking.

We never publish photographs of minors without the prior written consent of their legal guardians.

9. Obligation to provide data

The provision of your data is neither required by law nor by contract. However, without the information necessary for the booking — in particular your name, contact details and, for diving activities, the health information — we cannot perform the contract or, for safety reasons, allow you to participate.

10. Automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

11. Data security

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorised access. Our website is secured by TLS encryption, recognisable by the padlock symbol in your browser.

12. Changes to this policy

We adapt this privacy policy when our services, the services we use or the legal situation change. The version published on this page applies in each case. Last updated: 24 September 2026.