Privacy

Enquiries and contact

The form requires the occasion, date, venue, first and last name, email, street, postal code, city and country; for an equipment-only enquiry the address fields are left out. Phone, guest count, preferred DJ and message are optional. The language, an enquiry reference, acknowledgement of the privacy notice, processing status and delivery status are also processed. The form cannot be submitted without required information.

The purpose is to handle your enquiry and prepare a possible booking (Art. 6(1)(b) GDPR). The required checkbox acknowledges this notice; it is not consent to advertising or analytics. For an equipment-only enquiry, the postal address is only requested for the contract and invoice at booking. Requiring a full postal address at the initial stage of a DJ enquiry must be justified before release or the form must be changed.

We store your answer to “Do you need any other suppliers?” (chosen categories and recommended suppliers, or “No, thanks”) with your enquiry. If you chose a category or supplier, we ask the recommended suppliers about availability with the event type, date, venue and guest count; we pass on your name and contact details only after checking with you. Nothing is sent to suppliers automatically. The legal basis is your request (Art. 6(1)(b) GDPR); the answer is erased together with the enquiry.

Stored enquiries and general contact messages are accessible to authorised staff in the protected inbox. General contact requires first name, last name, email and a message, but no event date; a phone number is optional. Event enquiries also offer optional service, timing, contact preference, music, equipment and referral details. Equipment enquiries can also name packages, indoor or outdoor use, power at the venue, delivery or collection, an on-site technician and teardown timing. No automated booking decision is made.

Email notification

After every stored event enquiry and contact message, Resend sends an email to the Mallorca DJs mailbox. It contains all details from the form, the reference and a link to the protected administration area; a reply to this email goes to the email address you provided. For applications the email contains only the reference and the link. Sender, recipient and delivery metadata are also processed. This is not an automatic confirmation email to you. Erasure in the mailbox is still to be defined.

Delivery of the website and abuse prevention

Network requests technically process IP addresses and connection data, among other information. Hosting, logs and their retention depend on the operation still to be confirmed. The purpose is secure website delivery and preventing abusive enquiries (Art. 6(1)(f) GDPR).

Enquiry protection uses a secret key to derive values from the email address and, in the planned Vercel deployment, the IP address. These values, counters and time windows are stored separately from enquiries. This is not full anonymisation. Expiry of a counting window alone does not trigger erasure. Successfully storing a new enquiry removes keys whose stored counting window started more than two hours earlier. A new window may first begin for reused keys. Without such a new enquiry, no fixed erasure time is guaranteed.

Reach measurement without cookies and your objection

We count ourselves how often the pages of this website are viewed, without consent, without cookies and without storing anything on your device. The legal basis is our legitimate interest in simple reach measurement (Art. 6(1)(f) GDPR). Enquiries work independently of this.

Each event contains a random event ID, page category, language, an optional DJ, service or editorial page ID, a server timestamp, the country our hosting provider derives from the network connection, a source group (for example search engine, social network, direct visit or the previous page of this website, never the full referring address), a rough device category (phone, tablet, computer) and the time the page was visible. Names, contact details and form content are not part of it.

Your IP address and your browser's identification string are not stored. They only enter a visitor code formed with a random key generated anew each day and a server secret. The day key is deleted once its day is over and the next count or report runs; after that, a visitor code can no longer be linked to other days. Backups of our database provider may still contain a deleted key until they are deleted themselves; without the separately stored server secret it cannot be used there. Events including the visitor code are deleted after 30 days on the next count or report. Reports show only daily totals, never individual visit paths. Views in the administration area are not counted. Only our processors for hosting and database (Vercel, Supabase) process the data; it is not passed to other third parties.

You can object to this processing at any time (Art. 21 GDPR): if your browser sends the Global Privacy Control or Do Not Track signal, we do not count your visit. You can also turn counting off with the switch below; the mallorca-analytics cookie then stores only this objection for up to 180 days, and “allow again” deletes it. Anyone who declined analytics earlier is still not counted; an earlier consent is removed from the device on the next visit.

Stored enquiries are also counted independently for operational enquiry figures, including by selected service and package; these figures are not a visitor conversion rate. The basis is our legitimate interest in an overview of enquiry handling (Art. 6(1)(f) GDPR).

Protected administration

Staff sign in with email and password through Supabase Auth. An optional second factor uses time-based TOTP codes; once activated, protected administration actions require both factors. Session cookies named mallorca-djs-auth, including possible cookie chunks, support login and session renewal. Roles control access; publications record the user ID and time. This supports secure administration and accountability (Art. 6(1)(f) GDPR). Session duration, account erasure and history retention must be defined for operation.

Images and external links

Images are served from website files or the dedicated Supabase media library through this website. Unpublished uploads are accessible only to authorised staff. No automatically embedded video or social media players are used. External links are subject to the destination provider’s information. The editor permits external HTTPS images, which would send connection data to their provider on page visits. Providers and legal bases must be checked before publishing these images.

Planned providers and transfers

A dedicated Supabase project in Ireland (eu-west-1) provides the database, authentication and media library. Vercel is used for hosting; Resend sends the internal notifications (see above). The provider of the receiving mailbox is still to be named. Hosting regions, processing agreements, subprocessors, logs, backups and international transfers require final verification before public release.

Recommended suppliers we contact at your request first receive only the event type, date, venue and guest count; further details only after checking with you.

The provider agreements contain international transfer provisions and standard contractual clauses. Resend identifies the USA as its primary processing location. This establishes neither a confirmed agreement for this project nor exclusively European processing. The applicable transfer mechanism and access to its safeguards must be established for the final operation.

Storage and erasure

Automatic deletion is not yet implemented for enquiries, their delivery metadata, staff accounts or publication history. The operator must define justified periods or erasure criteria, responsibilities and an executable procedure. Records needed for contracts or taxes must be distinguished from mere enquiries; no blanket retention periods are specified here.

The prepared analytics cleanup removes events older than 30 days on the next collection, owner report or explicitly requested maintenance. Without such a call there is no cleanup; guaranteed daily deletion has not been established. Provider logs, backups, exports and mailbox copies require separate rules. Actual execution must be verified before publication.

Your rights

Subject to statutory conditions you can request access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent for the future without affecting the lawfulness of earlier processing. Use the contact above. You may complain to a data protection authority, in particular the Spanish AEPD.

DJ applications

The separate application form processes your name or DJ name, email, business registration status and, where applicable, business name, business location and tax identifier (NIE/NIF/CIF in Spain or VAT ID abroad), Mallorca residence, equipment skills, self-reported driving licence, Instagram address, reported genuine followers, website, fluent languages and an optional message. No identity document or driving licence photos are requested. This information is used to assess a possible collaboration; the form requests your consent for this purpose (Art. 6(1)(a) GDPR).

Answers are compared against criteria configured by the operator. Meeting them does not verify the information. Unmet criteria produce a rejection draft for human handling; the system does not send automatic rejections or make a binding collaboration decision. The owner can review and process applications. Qualifying applications have an internal notification prepared for info@mallorca-djs.com, containing a protected administration link and reference, not the tax identifier. Delivery remains pending without a configured email channel.

Changing languages can preserve entries in application memory while the application remains open. Application data is not written to Local Storage or Session Storage. The draft is cleared after confirmed submission and discarded on access after 30 minutes without changes; reloading loses it. Event enquiry and general contact drafts, in contrast, use the current tab’s Session Storage and are removed after confirmed submission. Closing the tab ends its session.

Automatic application retention is currently disabled. The owner can configure a period: closed or spam-marked applications are then removed when the inbox opens after that period expires. Open cases, backups and previously exported or emailed copies are not automatically erased by this process. Binding retention rules must be defined before release.