Privacy Policy

1. Data Controller

The data controller within the meaning of the GDPR and Spanish data protection law (LOPDGDD) is:

Proyectos Maximilian SL
handelnd als MaxMallorca Immobilien
Carrer de Isaac Peral, 67
07157 Port d'Andratx, Illes Balears, Spanien

Telefon: +34 610 27 16 70
E-Mail: info@maxmallorca.com
Website: www.maxmallorca.com

2. Collection and Use of Personal Data

Wir erheben personenbezogene Daten nur, soweit dies zur Bereitstellung unserer Dienstleistungen erforderlich ist oder Sie uns diese freiwillig mitteilen.

2.1 Contact and Valuation Requests

When you use our contact forms or the valuation form, we collect the following data: first name, last name, email address, phone number (optional), property type and your message. This data is used exclusively to process your enquiry and is not passed on to third parties.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The provision of this data is voluntary, but necessary to process your enquiry; without this information we are unable to process your request.

2.2 Viewing Requests

For viewing requests regarding specific properties, we collect name, contact details and preferred date. The data is used internally to coordinate the viewing appointment.

2.3 Newsletter

With your consent, we send you our newsletter with information on exclusive properties, market reports and off-market listings. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time via the unsubscribe link in the email or by emailing info@maxmallorca.com.

2.4 Server Log Files

When you access our website, technical information is automatically stored in server log files: IP address (anonymised), browser type, operating system, date and time of access, page accessed. This data cannot be attributed to specific persons and is used solely to ensure technical operation. Deleted after 7 days. Legal basis: Art. 6(1)(f) GDPR.

3. Cookies and Local Storage

Our website uses cookies and browser storage (localStorage) exclusively for technically necessary functions:

Analytics tools are only activated after your explicit consent via the cookie banner. You can withdraw your consent at any time via the cookie banner (accessible via "Cookie Settings" in the footer).

Fonts

This website uses the Montserrat font for a consistent display of typography. This font is embedded locally on our server, not via Google Fonts or any other external provider. No connection to external font servers is established when you visit our website, and no transfer of your IP address to third parties takes place for this purpose. The use of the locally embedded font is based on Art. 6(1)(f) GDPR (legitimate interest in a consistent, data-sparing presentation of our online offering).

4. Sharing with Third Parties and Processors

We do not share your data with third parties unless this is necessary for contract performance or you have consented. The following service providers process data on our behalf (data processing agreements pursuant to Art. 28 GDPR):

Cloudflare, Inc. – Hosting

101 Townsend St., San Francisco, CA 94107, USA. This website is hosted via the Cloudflare Pages service. Cloudflare operates a global content delivery network (CDN); requests are generally processed via nearby European server locations, though processing via servers in the USA cannot be fully excluded for technical and redundancy reasons. Transfer to the USA is based on Standard Contractual Clauses (Art. 46 GDPR). This service is used on the basis of Art. 6(1)(f) GDPR (legitimate interest in a reliable and secure provision of the website). Privacy Policy: cloudflare.com/privacypolicy

Supabase Inc. – Database & Image Hosting

San Francisco, CA, USA. Contact enquiries, customer data, as well as images and media files of this website are stored and delivered via Supabase (server location: Frankfurt am Main, EU-Central-1). Your IP address may be technically processed when images are retrieved. Data transfer based on standard contractual clauses. Privacy Policy: supabase.com/privacy

Technical Administration and Maintenance

The technical administration, maintenance and security management of the website are carried out on our behalf by:

The Growth Partners FZCO
Building A1, Dubai Digital Park
Dubai Silicon Oasis, Dubai
United Arab Emirates

Website: https://www.thegrowthpartners.de/

The Growth Partners FZCO has access to our systems and any log data that may arise in the course of technical support and maintenance. To ensure data protection-compliant processing, we have entered into a data processing agreement (DPA) with The Growth Partners FZCO pursuant to Art. 28 GDPR (including the EU Standard Contractual Clauses for third-country transfers).

As this technical service provider is based in a third country (UAE), the data transfer is based on the EU Standard Contractual Clauses (SCCs) of the European Commission to contractually guarantee the European level of data protection.

Cloudflare Inc. – Sicherheit & Bot-Schutz

101 Townsend St., San Francisco, CA 94107, USA. Wir nutzen Cloudflare Turnstile zum Schutz unserer Kontaktformulare vor automatisierten Missbrauchsversuchen (Bots). Cloudflare verarbeitet dabei technische Daten wie IP-Adresse und Browser-Informationen zur Bot-Erkennung. Es findet kein Tracking oder Profiling zu Werbezwecken statt. Datentransfer in die USA auf Basis von Standardvertragsklauseln (Art. 46 DSGVO). Datenschutzerklärung: cloudflare.com/privacypolicy

Google Analytics (Google Ireland Ltd.)

Gordon House, Barrow Street, Dublin 4, Ireland. Only with granted consent. Google Analytics analyses user behaviour on our website anonymously. IP anonymisation is activated. Privacy Policy: policies.google.com/privacy. Opt-out: Google Analytics Opt-out.

Google Maps

Our website may embed the Google Maps mapping service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to clearly display our location and make it easier to find us. The map is only loaded once you have given your consent via our cookie banner; otherwise, only a notice with a link to the cookie settings is shown in its place. Processing is based on your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time with future effect via the cookie settings (accessible via the cookie button). Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF); nevertheless, transfer of data to the USA cannot be fully excluded. Further information: policies.google.com/privacy

YouTube

Our website may embed videos from the provider YouTube (YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), e.g. as a background video on the homepage or as a video tour on individual property pages. Just like Google Maps, these videos are only loaded once you have given your consent via our cookie banner; otherwise a notice or a static image is shown instead of the video. Where technically possible, the more privacy-friendly youtube-nocookie.com domain is used; however, this does not fully exclude the transfer of your IP address to Google when loading. Processing is based on your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time with future effect via the cookie settings. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF); nevertheless, transfer of data to the USA cannot be fully excluded. Further information: policies.google.com/privacy

5. Your Rights

You have the following rights regarding your personal data:

• Access – Right to access stored data (Art. 15 GDPR)
• Rectification – Right to correction of inaccurate data (Art. 16 GDPR)
• Erasure – Right to deletion of your data (Art. 17 GDPR)
• Restriction – Right to restriction of processing (Art. 18 GDPR)
• Data Portability – Right to receive your data in machine-readable format (Art. 20 GDPR)
• Objection – Right to object to processing (Art. 21 GDPR)
• Withdrawal – Right to withdraw consent at any time without giving reasons (Art. 7(3) GDPR)

To exercise your rights, please contact: info@maxmallorca.com

You also have the right to lodge a complaint with the competent data protection supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid.

6. Data Security

We use technical and organisational security measures to protect your data against manipulation, loss and unauthorised access. Our website is delivered exclusively via HTTPS. Access to customer data is restricted to authorised employees and secured by password protection and two-factor authentication.

7. Retention Periods

Contact and viewing requests are deleted after full processing, at the latest after 3 years, unless statutory retention obligations (e.g. tax obligations under Spanish tax law) apply. Newsletter subscriptions are deleted immediately upon unsubscription. Server log files are automatically deleted after 7 days.

8. No Automated Decision-Making

We do not carry out automated decision-making or profiling pursuant to Art. 22 GDPR. All advisory and sales decisions are made personally by our staff.

9. Links to Other Websites

Our website contains links to external third-party websites. We have no influence over their content and data protection practices and accept no responsibility for them. The respective providers are themselves responsible for the content of their pages.

10. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time in compliance with applicable data protection regulations. The current version is always available at www.maxmallorca.com/datenschutz.html. As of: October 2026.