Privacy policy
This English version is an informational translation, not a certified legal translation. The Spanish text is the editorial reference; mandatory privacy and consumer rights are not limited by that reference. Spanish original
Version 2026-09-21.2 · Updated: 2026-09-21
1. Controller and contact
The controller for processing carried out to handle enquiries is Mundimar Puerto Portals S.A., Spanish tax ID A07424468, with registered office at Antoni Maria Alcover, 2, locales 93-94, Puerto Portals, 07181 Portals Nous, Calvià, Mallorca. The business operates at Antoni Maria Alcover, 2, locales 93-94, Puerto Portals, 07181 Portals Nous, Calvià, Mallorca.
Contact mundimar@mundimarportals.com or the landline +34 971 676 369. This email is an initial contact channel for privacy matters; you do not need a dedicated address or a specific form to exercise your rights.
Data protection officer: The requirement to appoint a data protection officer has been assessed and ruled out: Mundimar is not a public authority or body, does not carry out regular and systematic monitoring on a large scale and does not process special-category or criminal-offence data on a large scale (Article 37 GDPR).. Contact details will be provided here if an appointment is confirmed.
2. Scope and sources
This information covers browsing this website and enquiries about boatyard, painting and mechanical services through its contact channels. It does not replace notices required for contracts, invoices, employees or CCTV, none of which this website implements.
Data comes from information you provide, technical requests from your browser and, where relevant, someone legitimately acting on your behalf. If professional contact details are received through an organisation or representative, the individual must also be informed under Article 14 GDPR unless an applicable exception exists.
This website does not obtain third-party commercial profiles or use contact lists for advertising. Avoid including other people’s information unless it is needed to handle your request.
3. Requested data and minimisation
The prepared form requires only a reply email address and an enquiry description. Name, company, telephone, department, vessel model, length and beam are optional. Leaving optional fields blank does not prevent an enquiry; Mundimar may later request only the technical details needed to assess a job.
Vessel characteristics may become personal data when linked to an identifiable owner, captain or other person. The form asks for the model and dimensions, not ownership documents, registration numbers, real-time location or crew details.
The message contains only completed fields and the page language. Empty fields are omitted. The privacy version and honeypot are not included in the message. The form accepts no attachments and does not request payments, identity documents or special-category data.
Drafts are not automatically saved in cookies, localStorage or sessionStorage. While you complete the form, content remains in the page fields; your browser may apply its own autofill or session restoration, which you control.
Include only what is needed to assess the work. Do not send identity documents, bank details, health information, passwords or crew members’ or other people’s personal data.
4. Purposes and legal bases
Specific quotation or service requests: assess the request, clarify requirements and prepare a potential service, based on steps requested by the individual before entering into a contract (Article 6(1)(b) GDPR). The form alone does not create a contract or confirm availability or a price.
Other enquiries: reply and manage the communication, with the proposed basis being Mundimar’s legitimate interest in handling requests initiated by the user (Article 6(1)(f) GDPR). Necessity, proportionality and balancing must be documented; this basis does not permit unrestricted reuse.
Business or professional contacts: maintain only the relevant professional relationship within the limits of Article 19 of Spain’s LOPDGDD. Contractual necessity does not automatically apply to a person merely representing a company, nor is permission for advertising presumed.
Operation and abuse prevention: serve the website, diagnose faults and filter spam using necessary technical data, with the proposed basis being the legitimate interest in a secure, available contact channel. Processing must be limited to that purpose and assessed against individuals’ rights.
Legal obligations and claims: only where a specific applicable duty exists or information is needed to establish, exercise or defend a claim. A general legal obligation is not invoked to retain every enquiry.
5. Form, WhatsApp, email and telephone
The form prepares a WhatsApp message in your browser. Pressing “Send enquiry via WhatsApp” puts your details into an HTTPS wa.me link and opens that external service. There is no background submission to Mundimar or Netlify Forms. You review the draft and decide whether to send it within WhatsApp. Opening the link does not confirm receipt by Mundimar, reading, availability or acceptance of a job.
The email link opens your configured application; communication also passes through the sender’s and recipient’s email providers. Mundimar has identified IONOS as its mailbox provider. Email is not treated as free from third parties merely because the form is not used.
The telephone link starts a call, if supported, through your application and carrier. The website does not record calls or request microphone access. Any telephone-service records or practices outside the website must be confirmed and explained by Mundimar; call recording is not presumed.
6. WhatsApp as an external channel
The confirmed WhatsApp number is +34 683 23 41 41. It is separate from Mundimar’s landline. The website does not load a Meta SDK, widget or WhatsApp resources while you browse. Access takes place when you select a link or the form button.
When you open the pre-filled link, your field contents pass to the external service as part of the URL, even before you decide to send the message to Mundimar. That URL may appear in browser history. WhatsApp is part of the Meta group and its processing is also governed by its own policy, including technical and account data and possible processing outside the EEA. For users in the European Region, its policy identifies WhatsApp Ireland Limited as the provider. Mundimar has stated that Administration accesses the account through two authorised devices. Avoid sensitive data; landline and email remain available alternatives. Backups and retention for this channel must be covered by its internal policy.
7. Hosting, forms and recipients
Netlify, Inc. hosts this website and delivers its files, and may therefore handle technical connection data. This version does not use Netlify Forms to receive enquiries: the form prepares a WhatsApp link and does not submit its fields to the host.
The current transport does not send enquiries to Netlify Forms or its Akismet filter. A configuration or registered form left in the account from an earlier version does not mean this website still submits data to it. The account owner must review any historical records; this change does not access or delete earlier enquiries.
Netlify publishes a data processing agreement (DPA) for customer data processed on the customer’s behalf. The contracting party and processor chain must be verified. Netlify’s policy as controller for its own accounts does not replace that assessment.
Mundimar has confirmed that iRyx has no access to enquiries, mailboxes, logs or copies containing personal data. If the maintenance scope changes and access occurs on Mundimar’s behalf, instructions, permissions and duties must be defined through the appropriate agreement.
Information may be accessible to Mundimar’s Administration team to handle the request and necessary communication providers. Mundimar has stated that no other tools are used to copy or manage these enquiries. Disclosure to authorities or other recipients requires an applicable obligation or justification. This website includes no data sales, advertising networks or publication of enquiries.
8. Processing outside the EEA
Netlify is a US provider whose infrastructure and subcontracting may involve processing outside the European Economic Area, including the United States. A visitor’s location or the location of a CDN node does not establish where form submissions are stored.
Netlify’s documentation provides for the EU-US Data Privacy Framework and standard contractual clauses in specified circumstances. Applicability to the contracting party and service, current certification, subprocessors and specific safeguards must be verified. Transfers are not described as automatically lawful.
You may request information about applicable safeguards and how to obtain a copy by contacting mundimar@mundimarportals.com. The WhatsApp channel is also subject to the international operations described by its provider. Contractual review of the services and Mundimar’s account remains pending; this technical integration is not legal certification and does not activate Netlify Forms.
9. Retention and deletion
Enquiries that do not lead to a contract will be retained for no more than 365 days from the last relevant contact, to respond and carry out the requested follow-up. They will then be erased or anonymised unless a longer statutory period, the exercise of rights or the establishment, exercise or defence of legal claims requires otherwise.
Unaccepted quotations will be retained for no more than 365 days from issue. They will then be erased or anonymised unless a longer statutory period, the exercise of rights or the establishment, exercise or defence of legal claims requires otherwise.
Customer and service records will be retained for 6 years where they form part of contractual, commercial or supporting documentation, in accordance with Article 30 of the Spanish Commercial Code and applicable tax duties. Examinations, warranties or claims may require a longer period. Data that is no longer necessary will not be retained indiscriminately.
The website creates no new copies in Netlify Forms. Any historical copies from earlier configurations will be reviewed and erased within no more than 6 months. Backups will be rotated and erased within 6 months of generation unless a longer statutory period, the exercise of rights or the establishment, exercise or defence of legal claims requires otherwise.
Hosting technical logs will be retained for no more than 6 months from generation unless a security investigation, longer statutory period, the exercise of rights or the defence of legal claims requires otherwise. The website creates no application log of form content. Where legal blocking applies, data will be removed from ordinary use and access restricted.
10. Your rights and how to exercise them
You may request access, correction of inaccurate data and erasure where applicable; also restriction, objection to processing based on legitimate interests and portability where its conditions are met, particularly automated processing based on consent or contract. The scope of each right depends on the circumstances.
Send requests to mundimar@mundimarportals.com, identifying the right concerned and the information needed to locate the processing. An identity-document copy is not required as a routine first step; proportionate additional information will be requested only where there are reasonable doubts about identity. A duly authorised representative may act for you.
Mundimar will respond without undue delay and no later than one month after receipt. The period may be extended by two further months where complexity or the number of requests so requires; in that case you will be informed within the first month and given the reasons. Exercising rights is free except in the exceptional cases permitted by law.
You may complain to the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos, AEPD) at www.aepd.es if you believe that processing infringes the law or the response to your rights request is inadequate. For a complaint about an unanswered request, retain the earlier request and any reply.
11. Profiling, marketing and children
The website includes no commercial profiling or automated decisions with legal or similarly significant effects. The honeypot prevents link preparation if its hidden field contains information; that field is not sent to third parties. Landline and email remain available for human assistance if you cannot use the form.
There is no newsletter or marketing checkbox. An enquiry does not subscribe you to campaigns. Any future commercial communication needs its own justification, information and objection or unsubscribe mechanism under applicable law; this policy gives no blanket authorisation.
The website is intended for adults enquiring about marine services and for professionals. It has no age-verification system and is not designed to collect children’s data. No date of birth is requested. If a child’s information is received, the need and legal basis for processing, representative involvement and deletion where appropriate must be assessed; reaching a particular age is not presumed to confer capacity to contract for these services.
13. Changes and applicable framework
The version and date identify the text revision, not certification of compliance. Material changes to purposes, providers or technologies require a notice review and consent only where needed. Merely changing this page does not authorise retrospective new purposes.
The framework considered is Regulation (EU) 2016/679, Spanish Organic Law 3/2018 and Law 34/2002 as applicable to this website. Identifying and operational facts were supplied by Mundimar. Proposed legal bases, retention periods and provider contracts or safeguards must be validated by Mundimar and its advisers before treating this information as final.
Last reviewed: September 2026. This document will be reviewed whenever the law or processing activities change.