Privacy

Who is responsible for your data

FrankVestor GmbH, Pestalozzistraße 25, 22305 Hamburg, Germany, represented by Andreas Frank, is responsible for this website, general enquiries, club information and the business directory. Contact: kontakt@mallorcabusinessclub.de, telephone +34 601 995 948.

Christiane Frank, self-employed sole trader (Autónoma), Carrer Mascarell 1 Bl. 2 - 1B, 07610 Palma, Spain, is independently responsible for registration, delivery, payment and invoicing of her workshops. Contact: workshop@mallorcabusinessclub.de, telephone +34 601 995 948. Selecting “Meetups & workshops” in the contact form sends your message directly to Christiane Frank. FrankVestor GmbH provides the technical forwarding service.

Website and hosting

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Accessing it involves processing technically necessary data, including IP address, time, requested file, browser information and technical error messages. The basis is Article 6(1)(f) GDPR: our legitimate interest in secure operation and delivery of the website. Where the provider acts as a processor, an Article 28 GDPR processing agreement is required.

Technical logs are retained only as long as necessary for operation, troubleshooting and preventing or investigating security incidents. The logging and deletion periods configured for this hosting apply. Incident-specific security evidence may be needed until an incident is resolved. The website loads no external fonts or external analytics scripts.

Necessary sessions and abuse prevention

Opening the contact or registration form or signing in as an administrator starts a session using the “mbc_session” cookie. It protects forms against forged requests and enables protected administrator access. The cookie lasts for the browser session. The legal bases are section 25(2) TDDDG for necessary storage or access and Article 6(1)(f) GDPR for processing required for security and the requested functionality.

To limit abusive requests, the server derives a cryptographically protected value from the IP address, purpose and time window. The limiting table does not store the IP address in plain text. Contact requests are limited per hour. Expired values are removed during daily cleanup. No advertising profiles or fingerprinting are created.

Contact form, email and WhatsApp

We process the selected topic, name, email address and message to answer your enquiry. Contract-related enquiries use Article 6(1)(b) GDPR; otherwise the basis is our legitimate interest in replying under Article 6(1)(f). Acknowledging the privacy notice does not consent to advertising. Required fields are needed to handle the enquiry; the form cannot be sent without them. You may contact us directly instead.

The contact form sends an email to the responsible contact address. It does not store another copy in the website database. Messages then remain in the relevant mailbox and are deleted once the enquiry is resolved and no statutory retention duties or legitimate evidence requirements remain.

WhatsApp opens only when you activate a corresponding link. The provider is WhatsApp Ireland Limited. Its privacy notice also applies: https://www.whatsapp.com/legal/privacy-policy-eea. WhatsApp processes communication and usage data independently; processing outside the EEA, particularly in the USA, is possible. Use email if you prefer not to use this service. Do not send identity-document images, health information or other particularly sensitive data through the form or WhatsApp.

Workshop registration and payment

For registration by email, the website sends your form entries directly to Christiane Frank by server email. No email app opens. The website does not store an additional copy of the message in its database or create a visitor profile; the registration is held in the organiser’s email inbox. To prevent duplicate submissions, a random form identifier and sending status are temporarily stored in the session, without message content. For WhatsApp, the registration assistant prepares the message in your browser. It is transmitted through WhatsApp only when you send it yourself there. Please provide other participants’ data only with their authorisation and make this privacy notice available to them.

Christiane Frank processes names, contact details, participant numbers, dates, billing addresses and, if relevant, company and tax details to perform the contract under Article 6(1)(b) GDPR. Invoice and payment data are retained to comply with legal obligations under Article 6(1)(c). Only participant data needed to deliver the event are provided to the speaker or venue. Participant lists are not published.

Payment takes place outside this website via PayPal, Bizum or bank transfer using the invoice. Payment providers and banks process the necessary data under their own privacy notices. The website contains no automatically loaded payment widgets. Tax advisers and competent authorities may receive invoice data where legally required. Contract and invoice records are retained for applicable tax, commercial retention and limitation periods, then deleted unless continuing obligations or legal claims require retention.

Visitor statistics without tracking cookies

The website counts page views with page path, timestamp, broad device category and, where available, referring domain. Statistics store no IP addresses, cookie identifiers or individual user IDs. URL query values are not included. No personal browsing profiles are created. Administrator visits, recognised bots and visits signalling Do Not Track or Global Privacy Control are excluded. Individual statistics records are deleted after 90 days. The purpose is to improve the website with minimal data; where technical collection involves personal data, Article 6(1)(f) GDPR is the basis.

Videos and maps only after your choice

Video thumbnails are served locally. Vimeo's player loads and connects to Vimeo only after your confirming click. IP address, browser information and usage data may be transmitted, including possible processing in the USA. The player uses the “dnt” setting. This does not prevent every transmission, all necessary cookies or the sending of existing Vimeo cookies. Loading is based on your consent under Article 6(1)(a) GDPR and, where required, section 25(1) TDDDG. Information: https://vimeo.com/privacy.

The interactive OpenStreetMap map also loads only after your choice. The provider receives technically necessary data, such as IP address and browser information. The responsible provider is the OpenStreetMap Foundation, United Kingdom. Information: https://osmfoundation.org/wiki/Privacy_Policy. An external directions link takes you to the selected provider, whose privacy notice applies. Reloading the page without granting permission again deactivates the services; transmissions that already occurred cannot be undone.

Business profiles and editorial content

To publish agreed business profiles, we process supplied business contact details, descriptions and images under the agreement pursuant to Article 6(1)(b) GDPR or legitimate interests under Article 6(1)(f). Any required consent, for example for certain photographs of people, is obtained separately. Profiles remain online for the agreed publication period. Those concerned can contact us for correction or review of a deletion request. Optional AI translation is intended for editorial website content; contact messages and registration data are not translated through it.

Your rights and complaints

Subject to legal requirements, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time for the future. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time. No solely automated decisions with legal or similarly significant effects are made.

To exercise your rights, contact the controller responsible for the relevant area as identified above. You may also complain to a data protection authority, particularly where you live. For FrankVestor GmbH, this is the Hamburg Commissioner for Data Protection and Freedom of Information: https://datenschutz-hamburg.de. For Christiane Frank in Spain, it is the Agencia Española de Protección de Datos: https://www.aepd.es.