Privacy policy
Last updated: 5 September 2026
At HYBRYD Mallorca we treat your personal data with the same care we put into the rest of the club: only what we need, only for what we told you, and only for as long as it takes. This page explains exactly how, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Who the controller is
The data controller is HYBRYD ARENA, S.L.U., tax ID B24929820, registered at Carrer Setze de Juliol, 11, 07009 Palma de Mallorca, Illes Balears, España. You can write to us at info@hybrydmallorca.com or call +34 656 70 77 10.
What we collect and why
We do not collect data just in case: every field we ask for has a specific purpose and a legal basis behind it.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries you send through the contact form, by email or by phone. | Name, email, phone number and the content of your message. | Your consent (art. 6.1.a GDPR), given when you tick the box and send the form. | One year from our last contact, unless the enquiry leads to a contract. |
| Managing your membership, your subscription and your use of the facility and Recovery Lab. | Identification and contact details, plus the billing details needed to take payment. | Performance of our contract with you (art. 6.1.b GDPR) and legal obligations (art. 6.1.c). | For the duration of the relationship, then the statutory tax and commercial limitation periods (up to 6 years). |
| Measuring in aggregate how the site is used so we can improve it. | Browsing data collected by the analytics cookies. | Your consent (art. 6.1.a GDPR), which you can withdraw at any time. | As set out in the cookie policy (up to 2 years). |
The fields marked as required on the form are the minimum we need in order to reply; without them we cannot deal with your enquiry. The phone number is optional and we only use it if you would rather we called.
Health data
We do not ask for health data through this website, and we would ask you not to include any in the contact form. If, when you join or before you use the Recovery Lab, we need to know about a medical condition relevant to your safety, we will ask you in writing and separately, with your explicit consent (art. 9.2.a GDPR), and that information is kept with restricted access.
Who else sees your data
We do not sell your data or share it with third parties for their own marketing. We do work with providers who process it on our behalf, under a signed data processing agreement and only on our instructions:
| Provider | What for | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting and content delivery network. | EU / USA, under Standard Contractual Clauses. |
| Zoho Corporation (ZeptoMail) | Delivering contact-form messages to our inbox. | European Union (EU servers). |
| Google Ireland Limited | Google Analytics 4 and the map embedded on the contact page. | EU / USA, under the EU-US Data Privacy Framework. |
| Stripe Payments Europe, Ltd. | Processing payments started from the website. | EU / USA, under Standard Contractual Clauses. |
We may also disclose data to the tax authorities, to banks or to the courts where the law requires it.
Transfers outside the EU
Some of these providers may process data on servers outside the European Economic Area. Where that happens, the transfer relies on the safeguards in Chapter V of the GDPR: Standard Contractual Clauses approved by the European Commission or, in Google's case, its certification under the EU-US Data Privacy Framework.
How long we keep it
The retention period for each purpose is in the table above. As a general rule we keep your data for as long as our relationship lasts and then, blocked, for the statutory limitation periods, available only to courts and public authorities. Once those periods are up, we delete it.
Your rights
The GDPR gives you the following rights over your data, and exercising them is free:
- Access. Find out what data of yours we hold and get a copy of it.
- Rectification. Correct inaccurate data or complete anything missing.
- Erasure. Ask us to delete your data once it is no longer needed.
- Objection. Object to processing based on our legitimate interest.
- Restriction. Ask us to keep the data but stop using it while a claim is resolved.
- Portability. Receive your data in a structured format, or have us send it to another controller.
- Withdraw consent. Withdraw it at any time, without affecting processing carried out beforehand.
To exercise them, write to info@hybrydmallorca.com saying which right you want to exercise and enclosing a copy of your ID document, so we can be sure it is you. We will reply within one month.
If you feel we have not handled your request properly, you can complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid), the competent supervisory authority.
Security
The whole site is served over encrypted HTTPS and form submissions travel protected. We apply technical and organisational measures appropriate to the risk, limit access to the people on the team who need it, and review our providers regularly. No system is infallible, but we commit to telling you if a breach ever occurred that put your rights at risk.
Children
This site is not aimed at children under 14 and we do not knowingly collect their data. Minors may only use the facility with the authorisation of a parent or guardian.
Cookies
The cookies and local storage this site uses are listed one by one in the cookie policy, where you can also change your choice at any time.
Changes to this policy
We will update this policy if what we do with data changes, if we change providers, or if the applicable rules change. The version in force is always the one published on this page, with its update date.