1. Data controller

  • Controller: Menorca Bus, S.L. (Tax ID B07642218)
  • Address: C/ Bajolí 7, POIMA, 07714 Maó (Menorca), Illes Balears
  • Contact to exercise your rights: hola@calmasociety.com

2. What data we process, why, and on what legal basis

  • Newsletter and welcome guide: your email, language, the page you subscribed from, date and time, and your IP address as proof of the subscription. To send you what you asked for (art. 6.1.a: your consent; art. 21 Spanish LSSI). The newsletter occasionally includes advertising from Menorca Bus, the company that publishes the magazine — see the legal notice, §2.
  • Contact form: your name, email and message, to answer your enquiry (art. 6.1.b: this is what you ask us to do by writing in, not a separate "consent").
  • Business form: your business details and the name and email of the contact person, to assess and maintain the editorial listing (art. 6.1.b) and, if the relationship continues, to manage it (art. 6.1.f).
  • Register of collaborating businesses: business name, contact person, email, phone, status of the conversation and, where there is an agreement, its terms. If we contacted you first, we obtained your professional contact details from your business's public website or public directories; we process them on the basis of our legitimate interest in the relationship with your business (art. 6.1.f; art. 19 Spanish LOPDGDD) and, once there is an agreement, to perform it (art. 6.1.b and 6.1.c).
  • Trip planner: the plan is worked out in your browser. Your answers travel in the page address so it can be built, and we neither store them nor link them to you; we only process your email if you choose to subscribe (see "Newsletter" above).
  • Audience measurement: the URL visited, the referring page, device type, language and an IP address that is immediately converted into a non-reversible daily identifier. No cookies, no cross-site tracking; legitimate interest in understanding how the site is used (art. 6.1.f). You can opt out by enabling "Do Not Track" (DNT) or "Global Privacy Control" (GPC) in your browser.
  • Security: IP addresses and technical logs to protect the site against abuse (art. 6.1.f).
  • Email: if you write to us, we process your data to reply and, where relevant, manage the relationship (art. 6.1.b/f).

3. How long we keep your data

  • Newsletter: until you unsubscribe; afterwards we keep your email on a suppression list, so we don't write to you again.
  • Contact enquiries: 12 months from the last reply.
  • Collaborators with an agreement: for the duration of the relationship plus 5 years, for tax purposes.
  • Business enquiries with no reply: 12 months.
  • Audience data: 6 months in detail; afterwards, aggregate statistics only.
  • Security logs: 7 days.

4. Who has access to your data (processors)

We do not sell or share your data. We only disclose it to the following providers, acting as processors, and to Menorca Bus, S.L. — our own publisher —:

  • MailerLite Limited (Ireland; newsletter delivery; data hosted in the EU).
  • Formspree, Inc. (contact and business forms; US).
  • Cloudflare, Inc. (hosting, security, the collaborators database and domain email; US).
  • Vercel Inc. (the editorial team's internal panel; US).
  • Umami Software (audience measurement; EU/US).
  • Google LLC (email).

5. International transfers

Some of these providers process data in the United States, under the safeguards of GDPR art. 46 (standard contractual clauses) or the EU-US Data Privacy Framework. You can request a copy of these safeguards by writing to hola@calmasociety.com.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time (for example, via the unsubscribe link in each newsletter), by writing to hola@calmasociety.com. We reply within one month. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

7. Security

We apply reasonable technical and organisational measures: the site is always served over an encrypted (HTTPS) connection, access to internal panels is restricted by credentials, and we work with providers holding recognised certifications (SOC 2, ISO 27001). We keep a log of security incidents.

8. Minors

This site is not directed to children under 14. We do not knowingly collect data from minors without the consent of a parent or legal guardian.

9. Changes to this policy

We may update this policy to reflect legal or service changes. The date of the last update is shown at the top.

See also the Legal notice and Cookie policy.