Privacy / política de privacidad

1. Responsable del tratamiento

Identidad

Marco Lohmann

NIF

Y8537566A

Dirección

Carrer Punta Balena 18, 07181 Torrenova, Illes Balears

Correo electrónico

info@marco-mallorca.com

Teléfono

+34 871 242 710

Data protection officer

None appointed. I answer questions about data protection myself.

2. Finalidad del tratamiento

The data you send me is processed for the following purposes:

• Handling your enquiry sent through the contact form
• Informing you about properties that match your search request, including those not offered publicly
• Answering your questions in the digital adviser
• Preparing and carrying out a brokerage mandate for a purchase or sale
• Meeting legal obligations under tax law and anti-money-laundering rules, though only once a brokerage mandate is in place, not at the enquiry stage

There is no newsletter. You will receive marketing messages only if you have expressly and separately consented to them beforehand.

3. Legitimación

The legal basis for the processing is:

• the preparation and performance of a brokerage contract, which includes answering your enquiry sent through the contact form (Art. 6(1)(b) GDPR)
• your consent to the search request, to the use of the digital adviser and, if you give it separately, to marketing messages (Art. 6(1)(a) GDPR)
• a legal obligation, for instance under tax law and under Ley 10/2010 on the prevention of money laundering (Art. 6(1)(c) GDPR)
• my legitimate interest in fending off automated and abusive submissions, in limiting the number of requests to the digital adviser and in keeping the website running without disruption (Art. 6(1)(f) GDPR)

4. Contact form

When you submit the form, the following is transmitted: the nature of your enquiry, your name, your e-mail address, your telephone number if you wish to give it, the language you chose, what you tell me about location or area, type of property, time frame and price range, and your message. Your name, your e-mail address and the tick box are required, and for the enquiry type ‘Something else’ your message as well; all other fields are optional and only help me give you a more precise reply.

If you come to this website via an advertisement, the page address contains an identifier of that advertisement (for example “von=ads-verkauf”). When you send an enquiry, this identifier is transmitted as the item “Herkunft” (origin). It appears only in the message to me, not in the confirmation sent to you. Its sole purpose is to show which advertisement leads to enquiries; the legal basis is my legitimate interest in evaluating my own advertising (Art. 6(1)(f) GDPR). The website stores nothing in your browser for this and processes no click identifier of an advertising network. If you open WhatsApp or e-mail on an advertisement page with a prepared sentence, the same identifier is appended to that sentence in square brackets; you can delete it before sending.

Your details are delivered to me by e-mail. A short acknowledgement of receipt goes to the address you gave. It states your name and the nature of your enquiry, but neither the content of your message nor any of your other details. That is deliberate: only the format of the address is checked, and if there is a typing error, nobody should receive the full text of someone else’s property enquiry. The legal basis is the taking of pre-contractual steps at your request (Art. 6(1)(b) GDPR). Delivery is by e-mail; there is no end-to-end encryption.

To guard against automated submissions I check two things: a field you cannot see, which must remain empty, and whether at least three seconds have passed between the page loading and the form being sent. I also limit the number of requests per connection. For this, your IP address is not stored in plain text, nor is it truncated; instead it is converted by a salted one-way procedure into a check value that serves as the name of a counter file; only this check value and the timestamps are kept. This check value is a pseudonym, not an anonymous value. The legal basis is my legitimate interest in fending off abusive submissions (Art. 6(1)(f) GDPR).

The content of your message is not stored on the web server. It is delivered solely by e-mail and then sits in my mailbox. I do not keep a database of contact enquiries; search profiles from the search request are described in section 5.

The tick box in the form is your confirmation that you have taken note of this policy; without it, nothing is sent.

5. Search request

Through the search request on the home page and on the page “Search” you tell me what you are looking for so that I can inform you about matching properties, including those that are not offered publicly (off-market). When you submit, the following is transmitted: your name, your e-mail address, the channel you prefer (e-mail, WhatsApp or both), your telephone number if you wish, the chosen language and the details of your search: area or towns, type of property, purchase or rental, budget, number of bedrooms, time frame and your wishes or exclusions. Mandatory are your name, your e-mail address, the channel, at least one detail of the search and the checkbox; your telephone number is mandatory only if you choose WhatsApp.

The sole purpose is to inform you about properties that match your search. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give with the checkbox; without it nothing is sent. There is no newsletter, and your details are not passed on to other estate agents or property portals.

If you come via an advertisement, the identifier of the advertisement is transmitted here too as the item “Herkunft” (origin), as described in section 4. It appears only in the message to me.

The search request is delivered to me by e-mail. In addition, I create a search profile from it in my client management system, the newways.suite; with it I match new properties against your search. The search profile contains nothing but your own search wishes. It is kept until you withdraw your consent, and at most for 24 months after your last reply to me; after that I delete it. A short acknowledgement of receipt is sent to the address you gave. It states your name, the channel you chose and the date, but none of your other details, for the same reason as with the contact form (section 4).

I use WhatsApp only if you choose this channel and give your number. What happens at the operator of the service is described in section 12. If you would rather not, choose e-mail.

You can withdraw your consent at any time and without disadvantage: by e-mail to info@marco-mallorca.com, by WhatsApp or simply by replying to the acknowledgement of receipt. I will then delete the search profile. The lawfulness of the processing carried out until then remains unaffected by the withdrawal.

To protect against automated submissions, the same checks apply as for the contact form (section 4): the invisible field, the minimum of three seconds and the limit on requests per connection using the salted check value of your IP address. The content of your search request is not stored on the web server.

The client management system is hosted by DomainFactory GmbH, Neuturmstraße 5, 80331 Munich, Germany, on servers in Germany. WhatsApp messages are sent from the WhatsApp application on my phone; I do not use a provider of the WhatsApp Business Platform.

The data processing agreement pursuant to Art. 28 GDPR with DomainFactory GmbH for the client management system has yet to be confirmed.

6. Digital adviser

This website offers an AI-assisted adviser for questions about buying, selling and the documents needed for either. When you send a question, that question and the last eight messages of the conversation are transmitted to Anthropic PBC, San Francisco, USA, and processed there.

The basis for the transfer to the United States has yet to be entered here: either the adequacy decision on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses, in each case together with a data processing agreement under Art. 28 GDPR. Until this is settled, the transfer rests solely on your explicit consent under Art. 49(1)(a) GDPR. In that case the following applies: the United States does not offer a level of data protection equivalent to that of the European Union, public authorities there may access data under less stringent conditions, and effective legal remedies against this may not be available to you.

You give your consent by sending a question; it applies to the current session. You withdraw it by closing the adviser and not using it further.

If you ask your question on a property page, the file for that property is transmitted as well: key figures, energy certificate, licence status and the list of documents present and missing, with dates. These details contain no personal data; in particular, neither the owner nor the address is transmitted. Your browser sends only the property’s reference number; my server adds the remaining details from the checked property file.

The conversation history is not stored on my server. It exists only in your browser and in the individual request; when you close the page, it is gone. The service provider I use may retain the transmitted content for a limited time for security and abuse checks; I have no influence over this. To keep the service working, I limit requests to six per minute and sixty per day; this uses the same check value of your IP address as the contact form. None of the content of your conversation is stored on the server; the log records only that a request took place.

Please do not enter the names of third parties, any identity-document, bank account or health details, or any confidential documents into the adviser. The adviser gives no legal or tax advice, names no property values and makes no decisions about you. It is no substitute for a conversation.

7. No cookies, no third-party servers

This website sets no cookies — none for analytics, advertising or recognising returning visitors, and no technically necessary ones either. Nor is any data placed in your browser’s storage: no localStorage, no sessionStorage, no session identifier. No tracking pixels, advertising networks or social media buttons are embedded. A consent banner is therefore not required.

Fonts, images, the background film at the top of the home page and all scripts are stored on the same server as the site. Nothing is loaded from third-party providers when you visit, so your browser does not connect to any third party. The film starts muted and is not loaded if your device requests reduced motion or reports a data-saving connection.

There are two exceptions, both hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): the image film “Was ein Haus belegen kann” further down the home page and the island guide film at the top of the guide’s overview page. Each is loaded only when you click its preview image. Until that click, only the preview image on our own server is shown and nothing is loaded from YouTube. When you click, your browser connects to YouTube; YouTube receives your IP address and may set its own cookies. We embed the films in privacy-enhanced mode (youtube-nocookie.com), in which, according to YouTube, no data for personalising advertising is stored before playback. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Details are in Google’s privacy policy at policies.google.com/privacy.

The protected client area described on the home page is not yet in operation and cannot be reached through this website. Once it goes live, you will receive separate information when your access is set up; this policy will then be extended to cover the processing there and the session identifier it requires.

8. Server logs

When the page is called up, my hosting provider, acting as my processor, handles technically necessary data: IP address, time, file requested, amount of data transferred, status code, referring page and the identifier sent by your browser. The purpose is to deliver the page and to fend off attacks and disruptions. The legal basis is my legitimate interest in running the site securely and reliably (Art. 6(1)(f) GDPR). The logs are not combined with other data.

The website is hosted by DomainFactory GmbH, Neuturmstraße 5, 80331 Munich, Germany; the servers are located in Germany.

The hosting provider’s deletion period for the server logs has yet to be entered here.

9. Plazo de conservación

Enquiries that do not lead to a mandate are deleted once the correspondence is concluded, and at the latest after twelve months. Data from a brokerage mandate is kept for the duration of the statutory retention periods; documents from the anti-money-laundering check are subject to a retention period of ten years, which begins when the business relationship ends or when the transaction is carried out, not on the day the data was collected.

A search profile created from a search request is kept until you withdraw your consent, and at most for 24 months after your last reply to me (section 5).

The counter files used to fend off automated submissions contain only a check value and timestamps; they are deleted after 30 days at the latest. The technical log, which records only that a request took place, is deleted after 90 days.

10. Destinatarios

I do not pass your data on to third parties for their own purposes. For operations I use service providers as processors: the hosting provider for running the website and the e-mail provider for sending and receiving messages, each under a contract pursuant to Art. 28 GDPR, as well as DomainFactory GmbH, Munich, as the hosting provider of my client management system (newways.suite), where the search profiles from search requests are kept (section 5); the contract under Art. 28 GDPR with them has yet to be confirmed, see the note there. For the digital adviser, Anthropic PBC, USA, is added; the contract under Art. 28 GDPR with them has yet to be concluded, which is why this transfer currently rests solely on your consent (see section 6). Within a mandate I have been given, disclosure to a notary, a law firm, a gestoría or my tax adviser may become necessary; I will inform you of this in each individual case. Statutory reporting and disclosure obligations towards the tax authorities and SEPBLAC remain unaffected.

Your details are not passed on to other estate agencies or to property portals.

11. Anti-money-laundering check

Once a brokerage mandate is in place, the controller is legally required to identify the parties involved and to retain the documents needed for this (Ley 10/2010). These documents are kept separately and cannot be seen by other parties to the transaction. If anything in the transaction gives grounds for a report, I am legally obliged to notify the competent body (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales, SEPBLAC). By law I may not inform you of such a report or of any investigation that follows from it. I discuss the identification itself, and the documents I ask for, openly with you.

12. Contact by e-mail, telephone and WhatsApp

If you contact me other than through the form, I process the details you send solely to respond to your enquiry (Art. 6(1)(b) and (f) GDPR). WhatsApp is operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a company of the Meta group. The operator processes connection data such as telephone numbers and times under its own responsibility; such data may be transferred to Meta Platforms, Inc. in the United States. According to the operator, this rests on the adequacy decision for the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission. I have no influence over this. If you would rather avoid that, you can reach me just as well by e-mail or telephone. If you choose WhatsApp as the channel in your search request, the same applies to the messages about matching properties that I send you there (section 5).

13. Right to object

Where I process data on the basis of a legitimate interest, you may object to that processing at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal e-mail is enough.

14. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The digital adviser produces information, not decisions; it does not assess you, creates no profile and has no bearing on whether or how I handle your enquiry. The search profile from your search request (section 5) contains nothing but your own search wishes and serves only to match new properties against them; it does not evaluate any personal aspects and is not profiling within the meaning of Art. 4(4) GDPR.

15. Derechos de los interesados

You have the right to confirmation as to whether personal data concerning you is being processed, and the rights to:

• Access, rectification and erasure
• Restriction of processing and objection
• Data portability
• Withdrawal of consent you have given, with effect for the future

For documents that I am required to collect and retain under anti-money-laundering law, these rights are restricted by statute. To that extent I cannot grant access, erasure or objection for as long as the statutory retention obligation lasts.

To exercise these rights, an e-mail to info@marco-mallorca.com is enough. As a rule I can identify you by the address from which you corresponded with me. Only where there is reasonable doubt about your identity will I ask for specific further details; I do not ask for a copy of an identity document without cause, and if I do, you may black out everything on it that is not needed. I reply within one month; for extensive requests this period may be extended by up to two further months, in which case I will let you know.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. If you live in Germany or Austria, you may also contact the supervisory authority for the place where you live.