Privacy Policy
Last updated: September 2026
1. Controller
Adventure Tours Mallorca S.L. (brand “Diving & Adventure”), C/ Can Calafat 48, Nave 60, Local 4, Polígono Son Oms, 07199 Palma, Spain, NIF B67682914. Phone +34 619 980 242, email info@divingandadventure.com. No data protection officer has been appointed, as there is no legal obligation to do so.
2. Legal bases
We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD, Ley Orgánica 3/2018):
- Contract (Art. 6(1)(b) GDPR): booking, delivery and invoicing of the activity.
- Legal obligation (Art. 6(1)(c) GDPR): retention of invoices, information to authorities.
- Legitimate interest (Art. 6(1)(f) GDPR): secure operation of the website, defence against claims.
- Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): health information, publication of photos, statistics cookies. You can withdraw your consent at any time with effect for the future.
We do not sell data and do not make automated individual decisions within the meaning of Art. 22 GDPR.
3. Visiting the website
The website is delivered via the network of Cloudflare, Inc., San Francisco (USA), which acts as our hosting provider on our behalf. When you visit the website, technical data is stored automatically: IP address, date and time, page visited, browser and operating system. This is necessary for secure operation (legitimate interest). The data is deleted after 14 days at the latest. The website is encrypted via TLS. Fonts are loaded from our own server; no connection to Google is made for this.
4. Contact
If you contact us by email, phone, WhatsApp or form, we process your details to answer your enquiry (pre-contractual measures or legitimate interest). WhatsApp is operated by WhatsApp Ireland Ltd. (Meta); data may be transferred to the USA. If you do not want this, please send us an email. Enquiries without a booking are deleted 12 months after the last contact.
5. Booking and payment
Booking data. For the booking, we process name, email, phone number, date, number of participants, where applicable the age of participants, accommodation and chosen meeting point, as well as payment information (contract).
Technical processing. Bookings are handled via our own booking system, operated at Microsoft Ireland Operations Ltd., Dublin (Microsoft Azure), and via the booking system of Bókun ehf., Reykjavík, Iceland. Both process the data on our behalf under a data processing agreement (Art. 28 GDPR). Iceland is part of the European Economic Area, where the GDPR applies.
Booking of buggy tours. Booking and payment processing for the buggy tours are handled via the booking system of Regiondo GmbH, Munich, Germany. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
Payment. Online payments are processed via Stripe Payments Europe Ltd., Dublin, and, where offered, via PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. The payment services process your payment data to handle the payment and prevent fraud, partly as independent controllers; their privacy notices also apply. We do not receive full card details. Data may be transferred to the USA; see section 9.
Partner platforms. If you book via a partner platform or travel agency, it transmits to us the data required to carry out the activity. Processing by the platform is governed by its own privacy policy.
Emails. Booking confirmation, reminders and meeting point information are part of performing the contract. After the activity, we send you the link to your photos and ask for a review. We only send advertising for our own similar services if you have not objected (Art. 21(2) LSSI); every email contains an unsubscribe link. We only send advertising for other companies with your express consent.
6. Carrying out the activity
Participation agreements. On site, we process name, address, date of birth and signature, for buggy drivers also driving licence details (number, category, validity) and for divers their certification and diving experience. The purpose is to perform the contract and handle accidents, damage and insurance claims.
Health information. Before diving, you complete a medical questionnaire. We process this health data only with your express consent (Art. 9(2)(a) GDPR) to check your fitness to dive. Only the responsible dive instructors have access. For diving courses, we transmit the data required for certification to the training organisation (e.g. PADI). Without this information, participation is not possible for safety reasons.
Traffic fines. If a buggy driver commits a traffic offence, we as the vehicle keeper are legally obliged to identify the driver to the traffic authority (DGT) (Art. 11 Spanish Traffic Act) and pass on their details for this purpose (Art. 6(1)(c) GDPR).
Emergencies. In the event of an accident, we pass on the necessary data to emergency services, doctors and insurers to protect your vital interests (Art. 6(1)(d) and Art. 9(2)(c) GDPR).
Photos and videos. We provide recordings made during the activity via a download link. Images in which you are recognisable are only published with your consent. You can object to being photographed before the start.
7. Analytics
Only if you give your consent in the cookie banner do we load Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to analyse how the website is used (e.g. pages visited, clicks on booking steps, origin of visitors). Without consent, Google Analytics is not loaded. We store your choice in your browser’s local storage. Google Analytics cookies are stored for a maximum of 14 months. You can withdraw your consent at any time via the “Cookie settings” link in the footer; Google Analytics will then no longer be loaded.
8. Retention periods
| Data | Retention period |
|---|---|
| Server logs | 14 days |
| Enquiries without booking | 12 months after last contact |
| Booking and invoice data | 6 years (Art. 30 Spanish Commercial Code) |
| Participation agreements, driving licence and certification data | 5 years after the activity (Art. 1964 Spanish Civil Code) |
| Medical questionnaire | 5 years after the activity |
| Photos for participants | Download link 30 days, then deletion, unless consent to publication has been given |
If legal proceedings or an insurance claim are pending, we retain the relevant data until they are concluded.
9. Transfers to third countries
Cloudflare, Stripe, PayPal, Google, Meta (WhatsApp) and Microsoft may transfer data to the USA. These companies are certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); in addition, standard contractual clauses of the European Commission apply.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You may object to processing based on our legitimate interest (Art. 21 GDPR) and withdraw consent at any time. To do so, write to info@divingandadventure.com; we will reply within one month.
You can lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of your country of residence.
11. Changes
We update this privacy policy when our services or the legal situation change. The version published on the website applies.