Privacy Policy
Last updated: 22 June 2026
This English version is a courtesy translation. In case of any discrepancy, the Spanish version prevails. Read the Spanish version (Política de Privacidad).
This policy complies with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). The Spanish text is the legally binding version.
1. Data controller
| Controller | Mirko Banno (Ibiza Beyond) — sole trader (autónomo) |
| Tax ID (NIF / NIE) | Y3194712A |
| Address | Carrer de sa Creu 30, 07800 Eivissa, Illes Balears, Spain |
| Contact | info@ibizabeyond.com |
2. Data we process
- Contact data provided in forms: name, email address, telephone number, dates and number of guests, villa of interest and message.
- Browsing data: IP address, approximate country (IP geolocation), language, device and pages visited.
- Account data (if you register): credentials and saved preferences (e.g. favourites).
3. Purposes and legal basis
| Handling requests and sending quotes | Performance of pre-contractual measures and of a contract (art. 6.1.b GDPR) |
| Commercial communications (if you consent to them) | Consent (art. 6.1.a GDPR) |
| Security, fraud prevention and improvement of the site | Legitimate interest (art. 6.1.f GDPR) |
| Compliance with legal and tax obligations | Legal obligation (art. 6.1.c GDPR) |
4. Retention period
Data are kept for as long as the relationship lasts and, thereafter, for the legally required periods (commercial, tax). Data processed on the basis of consent are kept until that consent is withdrawn.
5. Recipients and data processors
No data are disclosed to third parties unless required by law. To provide the service, the following providers, among others, are involved acting as data processors:
- Supabase (database and backend hosting).
- Google Cloud (website hosting — EU region).
- Google Ireland Ltd. (Google Analytics 4 and Google Tag Manager: aggregated usage statistics, only with your consent).
- Microsoft Ireland Operations Ltd. (Microsoft Clarity: heatmaps and anonymous recordings of browsing sessions to improve the site, with form fields masked; only with your consent).
- Meta Platforms / WhatsApp (when the user chooses to contact us via WhatsApp).
- IP geolocation and email service providers.
6. International transfers
Where a provider processes data outside the European Economic Area, such transfers are covered by adequacy decisions or by the Standard Contractual Clauses approved by the European Commission.
7. Rights of the data subject
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to info@ibizabeyond.com with proof of your identity. If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es).
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration (encryption in transit, access control and row-level security (RLS) in the database).
9. Cookies
The use of cookies is described in detail in the Cookie Policy.