Privacy Policy

1. Who we are

Mallorca Massage Agency, operated under the brand Island Touch, is a professional mobile massage agency based in Palma de Mallorca, Spain. We provide certified massage therapists at hotels, private villas, yachts and apartments across Mallorca.

This Privacy Policy explains how we collect, use, store and protect your personal data when you interact with our website (mallorcamassageagency.eu) or contact us via WhatsApp, email or telephone.

2. What data we collect

Data you provide directly

• Name and surname (when booking)
• Phone number and/or WhatsApp number
• Email address (if provided)
• Location or accommodation address (for service delivery)
• Treatment preferences and session details
• Payment information (processed through third-party providers — we do not store card details)

Data collected automatically

• IP address and approximate location
• Browser type and device information
• Pages visited and time spent on the website
• Referring website or search query

3. Legal basis for processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract performance — to deliver the massage service you have booked.
• Legitimate interests — to respond to enquiries, improve our service and prevent fraud.
• Legal obligation — to comply with applicable Spanish and EU law.
• Consent — where you have explicitly agreed to marketing communications.

4. How we use your data

• To confirm and manage your booking
• To assign the appropriate therapist and coordinate the session
• To communicate with you about your booking via WhatsApp, phone or email
• To send optional post-session feedback requests or review invitations
• To comply with legal and fiscal obligations
• To improve our website and services through anonymised analytics

We do not use your data for automated decision-making or profiling.

5. WhatsApp communications

Our primary communication channel is WhatsApp. By contacting us via WhatsApp, you acknowledge that your messages are processed by Meta Platforms Ireland Ltd. under their own privacy policy. We use WhatsApp solely for booking coordination and customer service. We do not send unsolicited marketing messages via WhatsApp.

6. Data retention

We retain your personal data only for as long as necessary:

• Booking data — up to 4 years after the last service, for legal and fiscal purposes.
• Communication records — up to 2 years after last contact.
• Website analytics data — anonymised; retained up to 26 months.

After the applicable retention period, data is securely deleted or irreversibly anonymised.

7. Data sharing

We do not sell your personal data. We share it only with:

• Therapists in our network — who receive the minimum information needed to deliver your session (first name, location, treatment type).
• Payment processors — only transaction-related data, processed under their own privacy policies.
• Analytics providers — anonymised data only (e.g. Google Analytics with IP anonymisation enabled).
• Legal authorities — if required by applicable law.

8. International transfers

Some of our service providers (including WhatsApp/Meta and Google) may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V, including Standard Contractual Clauses.

9. Your rights

Under the GDPR and Spanish data protection law (LOPDGDD), you have the following rights:

• Right of access — to obtain a copy of the data we hold about you.
• Right of rectification — to correct inaccurate or incomplete data.
• Right of erasure ("right to be forgotten") — to request deletion of your data.
• Right to restriction of processing — to limit how we use your data.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interests.
• Right to withdraw consent — at any time, without affecting prior processing.

To exercise any of these rights, contact us at carlitos.brawn@hotmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD — aepd.es).

10. Cookies

Our website uses no cookies at all: no essential, analytical, preference or advertising cookies. We do not use Google Analytics or any other third-party analytics tool, and typefaces are served from our own servers, so browsing transmits no data to third parties. Should we add cookies in future, we will ask for your consent first. Full detail in our Cookie Policy. We do not use advertising, tracking or third-party marketing cookies.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include secure communication channels, access controls and regular security reviews.

12. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of our services after any changes constitutes acceptance of the updated policy.

13. Contact