Privacy policy

Draft – to be reviewed by a lawyer. This text is a non-binding draft and not legal advice. Details in [square brackets] are placeholders. They must be completed and reviewed by a qualified professional before publication – in particular service providers, server locations and retention periods.

We take the protection of your data seriously. This policy explains which personal data we process, why, on what legal basis, and what rights you have. It is based on the General Data Protection Regulation (GDPR, Spanish RGPD) and the Spanish Data Protection Act LOPDGDD (Ley Orgánica 3/2018).

1. Controller

Friedrich Recovery Mallorca is a service of OUTDOORIA LIVING S.L.

• Controller: OUTDOORIA LIVING S.L. (Sociedad Limitada), trading under the brand “Friedrich Recovery Mallorca”
• Represented by: Michael Peter Hack, director (Administrador único)
• CIF/NIF (tax ID): B56912942
• Address: Polígono 25, Parcela 1523, 07500 Manacor, Illes Balears, Spain
• Email: mallorca@outdooria-living.com
• Phone: +34 629 13 22 83

No data protection officer has been appointed, as there is no legal obligation to do so. [to be checked]

2. Summary

• By default we use no cookies and no tracking.
• Fonts and images are served from our own server. Visiting the website does not send any data to Google or other font providers.
• We do not use embedded maps, videos or social media plugins.
• We use form data only to handle your enquiry, carry out your booking and – if you arrive via a partner link – attribute the referral to that partner.
• We do not sell your data and do not use it for third-party advertising.

3. Visiting the website and server log files

When you visit the website, our hosting provider (ALL-INKL, see section 9) automatically processes technical data sent by your browser:

• IP address
• date and time of access
• page or file requested and amount of data transferred
• referrer URL (previous page), if sent
• browser type and version, operating system
• HTTP status code

Purpose: delivering the website, stability, security and preventing misuse.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).

Logging: Logging for our account is switched off in the ALL-INKL customer menu. We therefore receive no access log files and do not analyse any. This data is not combined with other data.

4. Cookies, browser storage and partner code

By default we use no cookies and no tracking technologies.

For editors only: anyone who logs in to the web editor at /admin/ receives a technically necessary session cookie for the duration of the login. The editor loads program code from unpkg.com. Visitors to the website are not affected. [To be checked]

If you arrive via a partner link (e.g. an address containing ?code=CODE or a short link /p/CODE) or enter a partner or voucher code, we store the partner code in your browser’s localStorage for up to 30 days – solely to grant you the guest discount. We do not use cookies for this. The code is only sent to us with an enquiry and contains no information about you. You can remove it at any time in the enquiry form or delete it in your browser settings.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correctly attributing and settling partner referrals). [To be checked: whether consent under Art. 22.2 LSSI-CE is required for storage in the browser or an exemption applies.]

5. Website statistics (optional, cookieless)

We currently do not use any website analytics. [Keep the following text only if statistics are enabled; then delete this first sentence.] If we enable statistics, we use Plausible Analytics (Plausible Insights OÜ, Estonia) with servers in the EU. Plausible sets no cookies, stores no IP addresses and creates no user profiles. It only records aggregated data such as pages visited, referrer, device type and country.

Purpose: improving the website based on anonymous statistics.

Legal basis: Art. 6(1)(f) GDPR. [To be checked: consent requirement under Art. 22.2 LSSI-CE; conclude a data processing agreement with Plausible.]

6. Enquiry form and booking

When you request an ice bath, a sauna or the Contrast package via the enquiry form, we process:

• Contact details: name, email address, phone/WhatsApp number
• Rental details: chosen package, arrival and departure date, villa or address and town, number of people, set-up location, socket information, preferred language, your message
• optional: name of the host or agency
• Partner code, if you arrived via a partner link
• confirmation that you have read the rental terms, safety information and privacy policy, and the time of the enquiry

Required fields are marked. Without them we cannot handle your enquiry. A hidden field serves as spam protection (honeypot), so we do not use a third-party captcha. We also limit how often a form can be sent (see section 9).

Storage: We send your enquiry by email to our mailbox and also store it as a record on our web server (see section 9). The records are kept in a directory that cannot be accessed via the internet. This way no enquiry is lost, even if an email does not arrive, and partner codes can be attributed. Your IP address is not stored in this record.

Purposes:

• answering your enquiry, checking availability and sending an offer
• sending you a confirmation email
• performing the rental contract: delivery, set-up, instructions, support, cleaning, collection, payment via payment link
• if provided: coordinating with the host or agency, e.g. for access to the villa [to be checked]
• if a partner code is present: attributing the booking to the partner and settling the commission
• complying with legal obligations, e.g. invoicing and record keeping

Legal bases:

• Art. 6(1)(b) GDPR – pre-contractual steps and performance of the contract
• Art. 6(1)(c) GDPR – legal obligations, in particular tax and commercial record keeping
• Art. 6(1)(f) GDPR – legitimate interests: partner attribution and settlement, spam protection, coordination with the accommodation, establishing or defending legal claims

Partner attribution: We only share with the partner (host or agency) the details needed for settlement. [Define scope, e.g. period, package, property – to be checked]

7. Partner form

If you would like to become a partner as a host or agency, we process: name of the agency or company, contact person, email address, phone number, number of properties, towns, your message and the confirmation that you have read the privacy policy.

Purposes: handling your enquiry, introduction and demonstration, concluding and running the partnership, including partner link, materials and monthly settlement.

Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (settlement, record keeping); Art. 6(1)(f) GDPR for contact persons of companies (business communication; see also Art. 19 LOPDGDD).

Section 6 applies accordingly to sending emails, storage and misuse protection.

8. Contact by email, phone or WhatsApp

If you contact us by email or phone, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR).

WhatsApp: The WhatsApp button is a simple link. Merely visiting the website sends no data to WhatsApp. Only when you tap the button does WhatsApp or the WhatsApp website open, and you decide whether to send a message. A pre-filled text may contain your form details on package, dates and town; you can change it before sending.

WhatsApp is provided by WhatsApp Ireland Limited, a Meta group company. Data, in particular metadata, may be transferred to Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework. [to be checked] WhatsApp’s own privacy policy applies to its processing. We use [WhatsApp Business – to be checked]. If you prefer not to use WhatsApp, please email us.

Legal basis: Art. 6(1)(b) GDPR (enquiry, contract) or Art. 6(1)(f) GDPR (communication via the channel you chose).

9. Recipients and processors

We only share your data where necessary for the purposes above or where required by law. We conclude agreements under Art. 28 GDPR with service providers who process data on our behalf.

• Hosting, form processing and sending emails: ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The website and form processing run on ALL-INKL servers in Germany. We also store the form records there, in a directory that cannot be accessed via the internet (see section 6). We send the emails about your enquiry – the message to our mailbox and your confirmation – through our own mailbox at ALL-INKL. To prevent misuse, we also briefly count how often a form is sent from the same IP address or to the same email address. For this we store on the server only a salted, non-reversible hash value, not the IP address or email address itself (Art. 6(1)(f) GDPR). We have a data processing agreement with ALL-INKL under Art. 28 GDPR.
• Receiving mailbox: Enquiries are delivered to our mailbox marius@friedrichrecovery.com, also at ALL-INKL (servers in Germany). The data processing agreement with ALL-INKL also covers it.
• Website maintenance (editors only): GitHub, Inc. (Microsoft), USA. We manage the texts and program code of the website in a private repository on GitHub. From there the website is built automatically and transferred to our server. Data of website visitors and form data are not transferred to GitHub. GitHub only processes data of the people who edit the website content (GitHub account).
• Payment: [Payment provider] for the payment link. [To be checked: independent controller or processor]
• Statistics (only if enabled): Plausible Insights OÜ, Estonia (see section 5)
• WhatsApp (only if you choose this channel): WhatsApp Ireland Limited / Meta (see section 8)
• Partners: the host or agency whose partner link you used for your enquiry (see section 6)
• Tax adviser / gestoría: [Name], for accounting and tax
• Authorities and courts, where we are legally obliged

10. Transfers to third countries

The website, form processing and stored enquiries are hosted by our hosting provider in the EU. Some service providers are based in the USA: Meta (WhatsApp, only if you choose this channel) and GitHub (only for people who edit the website content; no visitor data). Transfers only take place on the basis of an adequacy decision of the European Commission (EU-US Data Privacy Framework, where the provider is certified) or EU standard contractual clauses (Art. 46 GDPR). [Check certification or safeguards for each provider] The receiving mailbox is also hosted by ALL-INKL in Germany.

11. Retention

We keep data only as long as necessary for the purpose or required by law:

• Enquiries without a booking: [Periods – e.g. 12 months after the last communication]
• Booking and invoice data: for the term of the contract and then in line with statutory retention periods. [Check periods – e.g. 6 years under Art. 30 Spanish Commercial Code, 4 years under Spanish tax law]
• Partner data: for the term of the partnership and then in line with statutory retention periods. [Periods]
• Form records on our web server: [Deletion period – e.g. deletion once the booking or partner settlement is complete]
• Hash values for misuse protection: They are only valid for the counting period (1 hour for IP addresses, 24 hours for email addresses) and are then deleted automatically the next time a form is sent.
• Server log files: none – logging is switched off for our account at ALL-INKL (see section 3).
• Technical error log of the forms: contains no form contents; e-mail addresses in it are masked. From about 1 MB it is replaced by a new one, and the older file is deleted. [Check period]
• Partner code in localStorage: at most 30 days (or until you remove it or clear the website data in your browser)

We then delete or block the data (Art. 32 LOPDGDD).

12. No automated decision-making

We do not make decisions based solely on automated processing and do not carry out profiling within the meaning of Art. 22 GDPR.

13. Your rights

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw any consent given, with effect for the future (Art. 7(3) GDPR)

Simply write to mallorca@outdooria-living.com or by post to the address above. We usually reply within one month. If we have doubts about your identity, we may ask for proof.

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also contact the supervisory authority where you live.

14. Data security

The website is transmitted exclusively in encrypted form via HTTPS (TLS). Stored form data is kept on the server in a directory that cannot be accessed via the internet. Only people who need enquiry and booking data for their work have access to it. We take appropriate technical and organisational measures under Art. 32 GDPR and keep them up to date.

15. Minors

Our offer is aimed at adults. Persons under 14 must not send us personal data (Art. 7 LOPDGDD). [to be checked]

16. Changes

We update this privacy policy when the website, our service providers or the law change. The version published here applies.