Legal

Privacy Policy

1. Controller

Blue Key Enterprise SL, Monsenyor Palmer Nr. 6, 7-1, 07014 Palma de Mallorca, Spain. Email: [email protected].

2. General

This is a static website without logins or user accounts. We only process personal data where the purposes described below require it or where law permits.

3. Hosting and server logs

This website is published through Vivd Solutions, Dweerblöcken 4, 22393 Hamburg, Germany, which processes website and project data on our behalf under its Data Processing Agreement. Vivd's access statistics record aggregated page, referrer, country, device, browser and operating-system categories without storing IP addresses, full URLs, query strings or visitor identifiers. Individual counting records are kept for up to three months, daily statistics for 13 months and monthly statistics for 25 months. Vivd's current provider information is available in its Subprocessors list and Data Processing Agreement.

4. Analytics and cookies

Vivd Traffic counts page views, downloads and missing pages without a visitor or session identifier. This is separate from the optional analytics described below. Our legal basis for this aggregate counting is our legitimate interest in understanding demand and operating the website (Art. 6(1)(f) GDPR). You can object using Traffic opt-out; that choice is remembered in a necessary cookie for this domain. The retention periods for Traffic are stated in section 3.

With your consent, we use Vivd Visitors & Engagement to understand page visits, returning browsers, sessions, campaign sources, visible content sections and clicks on event links, social links and other marked website controls. A visibility event means that at least half of a marked content area was on screen in an active tab for at least one second; it does not mean that you read it. A ticket-link click is not a purchase, and clicking Subscribe is not a confirmed newsletter subscription. We do not create extra page views when you scroll between sections.

Optional analytics uses random browser and session identifiers, page paths without query strings, referring domains, device categories and predefined interaction names. Campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content) may be recorded separately even though the full query string is not recorded. We do not send names, email addresses, form entries or the text you enter into the website as interaction data. Browser identifiers do not establish a person's identity.

The legal basis for optional analytics is your consent (Art. 6(1)(a) GDPR and, where applicable, Art. 22(2) of Spain's Law 34/2002 on information society services). The analytics script and additional interaction measurement start only after you accept. Earlier interactions are not queued or replayed. We respect Do Not Track and Global Privacy Control for this optional measurement. Rejecting analytics does not prevent you from using the website, registering through an event provider or subscribing to the newsletter.

You can change your choice or withdraw consent at any time using Cookie settings, also available in the footer. Select Reject optional analytics to withdraw. Withdrawal stops further optional measurement and removes the analytics identifiers in this browser; it does not automatically delete records already sent. For a deletion request, contact [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal.

Browser storage: mallorca-minds-analytics-consent remembers your acceptance or rejection and the consent version for up to 365 days, equally for both choices. A changed measurement scope requires a new choice. After acceptance, vivd_analytics_visitor_id is held in local storage across visits; vivd_analytics_session_id is held in session storage for the browser's page session. Vivd may also use vivd_analytics_consent to remember its consent signal. Local storage has no automatic browser expiry: this website checks the decision on later visits, when returning to an open tab and while the page remains open, and clears analytics identifiers when the choice expires or is withdrawn. You may also clear browser storage yourself. These browser lifetimes are not the retention periods for data already received by Vivd.

Analytics retention: Vivd's published Privacy Policy states that raw website analytics events are deleted after 180 days (information checked on 24 October 2026). We are confirming that this period applies to the optional analytics used here, and the separate periods for visitor/session records, derived reports and backups. The 180-day statement is not a confirmed retention guarantee for all these data categories. The Traffic periods in section 3 are separate. Vivd processes optional analytics on our behalf under the Data Processing Agreement linked above.

5. Contact

If you contact us by email or through our event contacts, we process the data you provide (name, email address, message content) to respond. Legal basis: Art. 6(1)(b) or (f) GDPR. Data is deleted once it is no longer needed and no statutory retention duties apply.

5a. Speaker applications through Google Forms

When you apply to speak at a Mallorca Minds event through our Google Form, Blue Key Enterprise SL receives and reviews all the application information you submit. This includes your name, contact details, talk ideas, interests, experience, availability and other answers. We use it to assess whether your contribution fits one of our events and to consider you for a possible speaking slot, including at a later event. We contact you through the contact details you provide. Applying does not guarantee a speaking slot.

Leif-Hendrik Schulz reviews the applications on behalf of Blue Key Enterprise SL. We use Google Forms to collect the answers and also keep applicant details and a link to the application in our Notion CRM for speaker planning. Google's own processing is described in its Privacy Policy. Use of Google's services can involve processing outside the European Economic Area, including in the USA.

We process an application to assess and arrange a possible speaking engagement at your request (Art. 6(1)(b) GDPR). Our basis for keeping it for consideration at later events is our legitimate interest in planning suitable speakers for Mallorca Minds events (Art. 6(1)(f) GDPR). You may object to that ongoing consideration at any time by contacting [email protected].

We retain application data for 24 months from receipt of the application. At the end of that period, the application data is to be deleted from Google Forms, the speaker-planning CRM and any other application copies. If a speaking engagement is agreed, separate records needed to organise that engagement or meet legal obligations are retained only for those purposes and for as long as necessary.

You can request access, correction or deletion using [email protected]; the rights described in section 10 also apply. A speaker application does not subscribe you to our newsletter or give permission to photograph, record or publish your contribution. Please do not include sensitive personal information or private information about other people in your application.

5b. Notion CRM

We use Notion (Notion Labs, Inc.) to organise speaker applications and participant contacts for the purposes described in sections 5a and 6. Within Mallorca Minds, only Leif-Hendrik Schulz has access. This does not exclude technical processing by Notion and its service providers. Processing may take place outside the European Economic Area, including in the USA. Further information is available in Notion's Privacy Policy.

Our retention rules also apply to the copies we hold in Notion: speaker applications are kept for 24 months from receipt; participant records follow the purpose-based criteria in section 6. Archiving is not deletion. Notion's separate technical recovery and backup arrangements are described in its deletion and recovery information; they do not extend our permitted active use of your data.

6. Events and tickets

We use Eventbrite for registrations and ticket purchases for Mallorca Minds events. Blue Key Enterprise SL is responsible for our use of the participant data we receive, such as names, email addresses and booking information. We use this data to manage bookings, organise the booked event and communicate about it. The legal basis is performance of the event contract (Art. 6(1)(b) GDPR), or compliance with applicable legal obligations where required (Art. 6(1)(c) GDPR).

Eventbrite, Inc., USA, processes core ticketing data on our behalf under its Data Processing Addendum for Organizers. For its own platform purposes, Eventbrite also acts as an independent controller. Its processing and retention are described in the Eventbrite Privacy Policy. Processing can involve transfers outside the European Economic Area, including to the USA. For transfers under the organizer agreement, Eventbrite provides EU Standard Contractual Clauses linked in its Data Processing Addendum.

We may also keep our own copy of participant contact and booking information, including in a customer relationship management system (CRM), for event administration and related participant communication. Holding a contact in our CRM does not make that person a newsletter subscriber or, by itself, authorise promotional emails. Deletion from Eventbrite does not automatically delete a separate copy held by us. You can contact us about our copies at [email protected].

Invitations to future events and requests to join our newsletter are promotional messages, even if sent only once. Such emails require your prior request or consent, unless the existing-customer exception in Art. 21(2) of Spain's Law 34/2002 applies. That exception requires a prior contractual relationship, lawfully obtained contact details, promotion of our own similar services, and a simple, free opportunity to object both when the details are collected and in every promotional email. A past registration or attendance alone does not establish that all these conditions are met.

Where that exception applies, our GDPR basis for the related direct marketing is our legitimate interest in informing existing customers about similar events (Art. 6(1)(f) GDPR); otherwise, where consent is used, Art. 6(1)(a) GDPR applies. You may object to direct marketing at any time, without giving a reason, using the opt-out in the message or by emailing [email protected]. Following an objection, your data must no longer be used for direct marketing. Newsletter signup remains separate and requires the confirmation described below.

We retain our own participant records for as long as needed to organise and follow up the relevant event, then delete them unless a specific continuing purpose or legal obligation requires retention. Required accounting or contract records are kept separately for the applicable statutory period; this does not justify keeping the entire contact profile. Eventbrite's own retention periods do not automatically apply to our Notion records or exports. An objection to marketing stops that use; only the minimum information necessary to respect the objection may be retained for that purpose.

7. Online sessions and recordings

Some Mallorca Minds online sessions may be recorded. If you switch on your camera or microphone, or ask a question, you may be visible and audible in the recording. An AI assistant may be used to transcribe the session and create a summary.

A recording may later be shared with people who were not part of the session. Extracts, clips and screenshots may be used to promote Mallorca Minds and future events on our website, Instagram, Facebook, LinkedIn, Eventbrite and other media.

You can take part with your camera off. Online sessions run on Google Meet. The specific event's terms and conditions may contain additional information or a separate acknowledgement for that session. Questions or requests about recordings and related personal data can be sent to [email protected].

8. Newsletter

If you choose to sign up, we use Vivd Newsletter to store your email address and manage your subscription. Signup is separate from event registration or other contact with Mallorca Minds; those email addresses are not automatically added to the newsletter list.

We send a confirmation email so you can verify your address. Only confirmed subscribers will receive the newsletter when it begins. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in a newsletter or by contacting us. Your address is used to manage the subscription and send the newsletter, not for unrelated marketing.

9. Social media

This website links to our Instagram, Facebook and LinkedIn profiles. Clicking them leaves this website; the respective providers are responsible for data processing there under their own privacy policies. Data transfers to third countries (including the USA) are possible with these services.

9a. Fonts

The Inter and Newsreader typefaces are delivered with this website. Your browser does not contact Google Fonts to load these typefaces. The font files are used only to display text, not for analytics, and do not require optional analytics consent. The font licences are available here.

10. Your rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) GDPR. Consent given may be withdrawn at any time with future effect (Art. 7(3) GDPR). You may lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular the Spanish data protection authority (AEPD) or the authority of your place of residence. Requests go to [email protected].

11. Data security

The website is served over an encrypted connection (TLS). We apply appropriate technical and organisational measures to protect your data against loss and unauthorised access.

12. Version and changes

Version: 24 October 2026. This policy will be updated whenever data processing on this website changes.