Who is responsible
Mallorca Cycling Lab and NUS Mallorca are run by Lluc Matas, the person responsible for your data (the data controller). Write to [email protected] for any privacy request: a copy of your data, a correction, deletion or an objection. We answer within one month. You can also complain to the Spanish data protection authority (AEPD).
Who helps us run the site
Railway hosts the site and the Ride Buddies database. Resend delivers sign-in codes and email alerts. Google provides the maps, place details and, if you choose it, Google sign-in; Google Analytics runs only with your consent. Mailchimp runs Mallorca 312 Watch, Cloudflare Turnstile protects the correction forms and a private GitHub repository holds the reports. DeepL translates the text of hotel ratings (only the text, never your name or email). They process data only on our instructions.
What we collect and why
Reading the guide needs no account. With your consent we collect aggregated analytics to see which pages are useful (Art. 6(1)(a) GDPR); declining changes nothing on the site. We never sell data or build advertising profiles.
Partner and affiliate links
Some links, such as hotel searches near an event start, are partner links and are labelled "Partner link". When you follow one, the partner sees that you came from us, and, if you allowed analytics, we count the click. Partners never pay for rankings.
Mallorca 312 Watch
If you choose Mallorca 312 Watch, your email address, language and selected topics are sent directly to Mailchimp for provider-managed double opt-in, preferences and unsubscribe. We do not store subscriber email addresses in our local watcher database.
Corrections, maps and photos
Optional analytics can be declined with no loss of functionality. Correction reports and business claims are protected by Cloudflare Turnstile and sent to a dedicated private GitHub repository for review. Claim contact details are used only to verify authority and kept only as long as needed. Maps and photos from OpenStreetMap and Google load only when opened; those providers may receive your IP address.
Ride Buddies accounts
Ride Buddies is optional. If you use it, we create an account with your email address and — if you sign in with Google — your Google account ID, name and profile photo. You add your first name, last initial, languages, pace and an optional bio, plus the trips you post (dates, base town, pace, note). Other signed-in riders see only your first name, last initial, photo, languages, pace and trips; your email address is never shown. Messages are stored so both people in a conversation can read them. We use this data only to run the board: matching riders, delivering messages and keeping it safe (blocks, reports and moderation).
Ride Buddies data is stored on servers in the EU. Sign-in codes are emailed through Resend (EU region), and Google handles your sign-in if you choose it. Your session cookie lasts up to 90 days; sign-in codes are deleted within a day of expiring, and trips 30 days after they end. You can download your data or delete your account at any time from your Ride Buddies profile — deletion immediately removes your profile, trips and sessions (messages you sent stay in the other rider's conversation without your name). Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the board safe (Art. 6(1)(f) GDPR).
Notifications are off until you turn them on, with one exception: when another rider messages you or asks to join your ride, we email you so you don't miss it. Turn that off in your profile or with the link in each email. Push notifications go through your browser's push service (for example Google, Apple or Mozilla), which only sees an encrypted message. Notification emails are sent through Resend, each with a one-click unsubscribe link. We keep a record of notifications sent for 30 days.
If you are not signed in, you can see an anonymous summary of upcoming trips — region, pace, bike type and week only, without names, towns or exact dates.