Privacy policy
This English version is an informational translation, not a certified legal translation. The Spanish text is the editorial reference; mandatory privacy and consumer rights are not limited by that reference. Spanish original
Version 2026-09-05.2 · Updated: 2026-09-05
Review draft: contains information awaiting confirmation by Mundimar and requires legal review before final publication.
1. Controller and contact
The controller for processing carried out to handle Mundimar enquiries is Mundimar Puerto Portals S.A.. Business location: Puerto Portals, Calvià, Mallorca. The full registered office address awaits confirmation: [AWAITING CONFIRMATION].
Contact mundimar@mundimarportals.com or the landline +34 971 676 369. This email is an initial contact channel for privacy matters; you do not need a dedicated address or a specific form to exercise your rights.
Data protection officer: [AWAITING CONFIRMATION]. Contact details will be provided here if an appointment is confirmed.
2. Scope and sources
This information covers browsing this website and enquiries about boatyard, painting and mechanical services through its contact channels. It does not replace notices required for contracts, invoices, employees or CCTV, none of which this website implements.
Data comes from information you provide, technical requests from your browser and, where relevant, someone legitimately acting on your behalf. If professional contact details are received through an organisation or representative, the individual must also be informed under Article 14 GDPR unless an applicable exception exists.
This website does not obtain third-party commercial profiles or use contact lists for advertising. Avoid including other people’s information unless it is needed to handle your request.
3. Requested data and minimisation
The prepared form requires only a reply email address and an enquiry description. Name, company, telephone, department, vessel model, length and beam are optional. Leaving optional fields blank does not prevent an enquiry; Mundimar may later request only the technical details needed to assess a job.
Vessel characteristics may become personal data when linked to an identifiable owner, captain or other person. The form asks for the model and dimensions, not ownership documents, registration numbers, real-time location or crew details.
The message contains only completed fields and the page language. Empty fields are omitted. The privacy version and honeypot are not included in the message. The form accepts no attachments and does not request payments, identity documents or special-category data.
Drafts are not automatically saved in cookies, localStorage or sessionStorage. While you complete the form, content remains in the page fields; your browser may apply its own autofill or session restoration, which you control.
Include only what is needed to assess the work. Do not send identity documents, bank details, health information, passwords or crew members’ or other people’s personal data.
4. Purposes and legal bases
Specific quotation or service requests: assess the request, clarify requirements and prepare a potential service, based on steps requested by the individual before entering into a contract (Article 6(1)(b) GDPR). The form alone does not create a contract or confirm availability or a price.
Other enquiries: reply and manage the communication, with the proposed basis being Mundimar’s legitimate interest in handling requests initiated by the user (Article 6(1)(f) GDPR). Necessity, proportionality and balancing must be documented; this basis does not permit unrestricted reuse.
Business or professional contacts: maintain only the relevant professional relationship within the limits of Article 19 of Spain’s LOPDGDD. Contractual necessity does not automatically apply to a person merely representing a company, nor is permission for advertising presumed.
Operation and abuse prevention: serve the website, diagnose faults and filter spam using necessary technical data, with the proposed basis being the legitimate interest in a secure, available contact channel. Processing must be limited to that purpose and assessed against individuals’ rights.
Legal obligations and claims: only where a specific applicable duty exists or information is needed to establish, exercise or defend a claim. A general legal obligation is not invoked to retain every enquiry.
5. Form, WhatsApp, email and telephone
The form prepares a WhatsApp message in your browser. Pressing “Send enquiry via WhatsApp” puts your details into an HTTPS wa.me link and opens that external service. There is no background submission to Mundimar or Netlify Forms. You review the draft and decide whether to send it within WhatsApp. Opening the link does not confirm receipt by Mundimar, reading, availability or acceptance of a job.
The email link opens your configured application; communication also passes through the sender’s and recipient’s email providers. Mundimar’s mailbox provider awaits confirmation: [AWAITING CONFIRMATION]. Email is not treated as free from third parties merely because the form is not used.
The telephone link starts a call, if supported, through your application and carrier. The website does not record calls or request microphone access. Any telephone-service records or practices outside the website must be confirmed and explained by Mundimar; call recording is not presumed.
6. WhatsApp as an external channel
The confirmed WhatsApp number is +34 683 23 41 41. It is separate from Mundimar’s landline. The website does not load a Meta SDK, widget or WhatsApp resources while you browse. Access takes place when you select a link or the form button.
When you open the pre-filled link, your field contents pass to the external service as part of the URL, even before you decide to send the message to Mundimar. That URL may appear in browser history. WhatsApp is part of the Meta group and its processing is also governed by its own policy, including technical and account data and possible processing outside the EEA. For users in the European Region, its policy identifies WhatsApp Ireland Limited as the provider. Conversation encryption is not claimed to protect link parameters by itself. Avoid sensitive data; landline and email remain available alternatives. Mundimar must establish its account type, access, backups and retention arrangements for this channel.
7. Hosting, forms and recipients
Netlify, Inc. hosts this website and delivers its files, and may therefore handle technical connection data. This version does not use Netlify Forms to receive enquiries: the form prepares a WhatsApp link and does not submit its fields to the host.
The current transport does not send enquiries to Netlify Forms or its Akismet filter. A configuration or registered form left in the account from an earlier version does not mean this website still submits data to it. The account owner must review any historical records; this change does not access or delete earlier enquiries.
Netlify publishes a data processing agreement (DPA) for customer data processed on the customer’s behalf. The contracting party and processor chain must be verified. Netlify’s policy as controller for its own accounts does not replace that assessment.
Development by iRyx does not itself imply access to enquiries. If maintenance involves data access or administration of the receiving account, instructions, permissions and duties must be defined through the appropriate agreement. No blanket exemption from responsibility is attributed to the developer.
Information may be accessible to Mundimar personnel authorised to handle the request and necessary communication providers. Disclosure to authorities or other recipients requires an applicable obligation or justification. This website includes no data sales, advertising networks or publication of enquiries.
8. Processing outside the EEA
Netlify is a US provider whose infrastructure and subcontracting may involve processing outside the European Economic Area, including the United States. A visitor’s location or the location of a CDN node does not establish where form submissions are stored.
Netlify’s documentation provides for the EU-US Data Privacy Framework and standard contractual clauses in specified circumstances. Applicability to the contracting party and service, current certification, subprocessors and specific safeguards must be verified. Transfers are not described as automatically lawful.
You may request information about applicable safeguards and how to obtain a copy by contacting mundimar@mundimarportals.com. The WhatsApp channel is also subject to the international operations described by its provider. Contractual review of the services and Mundimar’s account remains pending; this technical integration is not legal certification and does not activate Netlify Forms.
9. Retention and deletion
Enquiries that do not lead to a contract: retention is limited to resolving the request and reasonably necessary follow-up. Mundimar must confirm the maximum operational period from closure or the last relevant contact: [AWAITING CONFIRMATION]. This does not authorise indefinite retention.
Unaccepted quotations: the period must relate to the offer’s validity and justified follow-up; maximum awaiting confirmation: [AWAITING CONFIRMATION]. Not every enquiry is automatically treated as accounting documentation.
If a contract follows, the relevant records have their own retention periods. Subject to scope and calculation, reference periods include six years for commercial records under Article 30 of the Commercial Code and tax limitation periods, generally four years, under the General Tax Law. Interruptions, examinations, warranties or claims may affect the applicable period. These periods do not justify indiscriminately retaining every form field.
This version creates no new copies of form fields in Netlify Forms. The account owner must review and delete any historical enquiries from earlier configurations; automatic deletion has not been verified. The period for those copies remains pending: [AWAITING CONFIRMATION]. Mundimar must include WhatsApp conversations, emails, exports and backups in its retention procedures, limiting access and unnecessary duplicates.
Hosting technical-log retention awaits confirmation with the provider: [AWAITING CONFIRMATION]. The website creates no application log of form content. Where data must be blocked to meet legal liabilities, it must be removed from ordinary use, access restricted and the data erased when the applicable period ends.
10. Your rights and how to exercise them
You may request access, correction of inaccurate data and erasure where applicable; also restriction, objection to processing based on legitimate interests and portability where its conditions are met, particularly automated processing based on consent or contract. The scope of each right depends on the circumstances.
Send your request to mundimar@mundimarportals.com, identifying the right and the information needed to locate the processing. An identity-document copy is not required as a routine first step. Proportionate additional information will be requested only where there are reasonable doubts about identity. A duly authorised representative may act for you.
Requests must generally be answered within one month of receipt; an extension of up to two further months requires the circumstances and notification provided for by GDPR. Exercising rights is free except for legally permitted exceptional cases. If future processing relies on consent, you may withdraw it without affecting earlier lawful processing.
You may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or another competent supervisory authority without waiving other rights. For complaints about an unfulfilled rights request, retain your earlier request and any reply.
11. Profiling, marketing and children
The website includes no commercial profiling or automated decisions with legal or similarly significant effects. The honeypot prevents link preparation if its hidden field contains information; that field is not sent to third parties. Landline and email remain available for human assistance if you cannot use the form.
There is no newsletter or marketing checkbox. An enquiry does not subscribe you to campaigns. Any future commercial communication needs its own justification, information and objection or unsubscribe mechanism under applicable law; this policy gives no blanket authorisation.
The website is intended for adults enquiring about marine services and for professionals. It has no age-verification system and is not designed to collect children’s data. No date of birth is requested. If a child’s information is received, the need and legal basis for processing, representative involvement and deletion where appropriate must be assessed; reaching a particular age is not presumed to confer capacity to contract for these services.
13. Changes and applicable framework
The version and date identify the text revision, not certification of compliance. Material changes to purposes, providers or technologies require a notice review and consent only where needed. Merely changing this page does not authorise retrospective new purposes.
The framework considered is Regulation (EU) 2016/679, Spanish Organic Law 3/2018 and Law 34/2002 as applicable to this website. Owner details, proposed legal bases, retention and outstanding agreements must be validated by Mundimar and its advisers before treating this information as final.