Data protection

Privacy policy, status: April 2025.

This privacy policy explains the type, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offer and the associated websites, functions and content as well as external online presences, such as our social media profile (hereinafter jointly referred to as “online offer”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

General information

The client for the collection, processing and use of personal data within the meaning of the Data Protection Act and responsible for the content:

PUEBLO ESPAÑOL MALLORCA
Calle Pueblo Español, 55,
07014 Palma, Balearic Islands, Spain
E-mail: office@pueblo-espanol.com

Types of data processed:

  • Inventory data (e.g., names, addresses)
  • Contact details (e.g., e-mail, telephone numbers)
  • Content data (e.g., text entries, photographs, videos)
  • Usage data (e.g., websites visited, interest in content, access times)
  • Meta/communication data (e.g., device information, IP addresses)
  • Contract data (e.g., subject matter of the contract, term, customer category)
  • Payment data (e.g., bank details, payment history)

Categories of affected persons

Visitors and users of the online offer (hereinafter we also refer to the data subjects collectively as “users”).

Purpose of the processing

  • Provision of the online offer, its functions and contents
  • Answering contact requests and communicating with users
  • Security measures
  • Reach measurement/marketing
  • Processing orders and payments in the online store
  • Management of subscriptions and contractual relationships
  • Provision of personalized content based on user behavior

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not stated in the privacy policy, the following applies: The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR, the legal basis for processing for the performance of our services and implementation of contractual measures as well as responding to inquiries is Art. 6 para. 1 lit. b GDPR, the legal basis for processing to fulfil our legal obligations is Art. 6 para. 1 lit. c GDPR, and the legal basis for processing to protect our legitimate interests is Art. 6 para. 1 lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

Security measures

We take appropriate technical and organizational measures in accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

Cooperation with processors and third parties

If we disclose data to other persons and companies (processors or third parties) as part of our processing, transfer it to them or otherwise grant them access to the data, this will only be done on the basis of legal permission (e.g. if the transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract pursuant to Art. 6 para. 1 lit. b GDPR), you have given your consent, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

If we commission third parties with the processing of data on the basis of a so-called “order processing contract”, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services or disclosure or transfer of data to third parties, this will only take place if it is done to fulfill our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we only process or have the data processed in a third country if the special requirements of Art. 44 et seq. GDPR are met.

Use of Stripe for payment processing

We use the payment service provider Stripe to process payments for our online courses, subscriptions and orders in the online store. Stripe collects and stores your payment data (e.g. credit card number, bank details) and transaction information (e.g. date, amount). Stripe fulfills the requirements of the GDPR and offers a high level of data security. Further information on the processing of data by Stripe can be found in Stripe’s privacy policy.

Subscription system and contract data

To manage your subscription, we process contract data, including the selected subscription plan, the contract term and payment and billing data. This information is used for the provision and processing of subscriptions and for customer support. The legal basis for this is the fulfillment of the contract pursuant to Art. 6 para. 1 lit. b GDPR.

Personalization of course content

We collect and process data about your use of our online offering in order to be able to offer you course content and recommendations tailored to your interests. This includes information such as courses attended, preferences and interactions within the online offering. This data is used exclusively to improve our offering and to personalize content. The legal basis is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

Data analysis to improve the course offering

We use data such as completion rates, progress within the courses and usage patterns to improve our course offerings and to analyze the learning progress of our users. This data is evaluated anonymously and is used to optimize the course content and the user-friendliness of our platform.

Use of the online store

As part of the use of our online store, we process personal data for the processing of orders. This includes inventory data (e.g. name, address), contact data (e.g. e-mail address, telephone number) and order data (e.g. products ordered, billing address, delivery address). This data is used exclusively to fulfill your orders and to handle the associated processes (e.g. shipping, payment). The legal basis is the fulfillment of the contract pursuant to Art. 6 para. 1 lit. b GDPR.

Shipping and delivery

To fulfill your orders, we pass on your delivery data (e.g. name, address) to shipping service providers. This data is used exclusively for the delivery of the ordered goods and is subject to the respective data protection provisions of the service provider. The legal basis for this is the fulfillment of the contract in accordance with Art. 6 para. 1 lit. b GDPR.

Cookies in the online store

Our online store uses cookies to save the contents of your shopping cart during your purchase. These cookies are necessary to ensure that your selected products remain in your shopping cart, even if you switch between different pages. The cookies are automatically deleted after you have completed your purchase or when you close your browser. The legal basis for the use of these cookies is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

Returns and complaints

If you make use of your right of return or submit a complaint, we will process the relevant data to process your return or complaint. This data includes the order data, payment information and any additional information required to process the return or complaint.

Storage duration

Your data collected as part of an order or subscription will be stored for the duration of the contract. After termination of the subscription or after completion of the order, your data will be deleted or anonymized, taking into account statutory retention periods, unless there are legal obligations for further storage.

Newsletter dispatch with Brevo (formerly SendinBlue)

We use Brevo (formerly SendinBlue) as a service provider for sending our newsletter. Brevo is a platform of Sendinblue GmbH, which falls under the data protection guidelines of the European Union.

The data provided when registering for the newsletter (e.g. e-mail address) will be stored on Brevo’s servers and used exclusively for sending the newsletter. The data will not be passed on to third parties.

Brevo is a service that makes it possible to organize and analyze the sending of newsletters. With the help of Brevo, we can analyze the behavior of newsletter recipients. This includes, for example, how many recipients have opened the newsletter and how often certain links in the newsletter have been clicked on. This data is collected pseudonymously and used exclusively to improve our content. This data is not linked to the identity of the respective user.

Legal basis for sending the newsletter

The newsletter is sent on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time. The revocation can be made via the unsubscribe link in the newsletter or by sending us a message. The data processing carried out until the revocation remains lawful.

Analysis by Brevo

Brevo enables us to analyze the behavior of newsletter recipients. This includes analyzing how many recipients have opened the newsletter and how often which link was clicked on. In this way, we can determine which content is particularly relevant for recipients and adapt future newsletters accordingly. The data is only collected in pseudonymized form and is not linked to other personal data of the recipients.

The analysis is carried out on the basis of Art. 6 para. 1 lit. f GDPR, as we have a legitimate interest in optimizing and improving our newsletter.

Storage duration

The data you provide us with for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and deleted after you unsubscribe from the newsletter. Data stored by us for other purposes remains unaffected by this.

Conclusion of a contract for order processing

We have concluded an order processing contract with Brevo in which we oblige Brevo to protect our customers’ data and not to pass it on to third parties. This contract complies with the requirements of the GDPR and ensures that Brevo only processes the data in accordance with our instructions and takes the necessary technical and organizational measures to protect personal data.

Cookies and right to object to direct advertising

Cookies” are small files that are stored on users’ computers. Different information can be stored within the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit to an online service. Temporary cookies, or “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online service and closes their browser. The content of a shopping cart in an online store or a login status, for example, can be stored in such a cookie. Cookies that remain stored even after the browser is closed are referred to as “permanent” or “persistent”. For example, the login status can be saved if the user visits the website after several days. The interests of users can also be stored in such a cookie and used for reach measurement or marketing purposes. “Third-party cookies” are cookies that are offered by providers other than the controller who operates the online service (otherwise, if they are only the controller’s cookies, they are referred to as “first-party cookies”).

Deletion of data

The data processed by us will be deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations. If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Business-related processing

We also process

  • Contract data (e.g., subject matter of the contract, term, customer category).
  • Payment data (e.g., bank details, payment history)

from our customers, interested parties and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.