Privacy notice
Who looks after your information, why we use it and how to make a request.
Effective 9 September 2026
Who is responsible
Lluc Matas Pomar is responsible for the personal information processed for NUS Cycling Mallorca. For collection enquiries, privacy questions or requests to exercise your rights, contact legal@nusmallorca.com.
legal@nusmallorca.comFirst access and email updates
If you choose to sign up, we use your email address to send NUS collection news and launch updates on the basis of your consent. We also keep your selected language, the form you used, and the time and version of your consent. Signing up is optional: without your email we cannot add you to the list, but you can still browse and contact us. First access is not a purchase or reservation. You can withdraw your consent at any time by emailing us, or through the unsubscribe link in a marketing message.
When you contact us
We use your email address, the information you include and our correspondence to answer your enquiry or handle your request. Our basis is our legitimate interest in responding to people who contact NUS; where an enquiry concerns a prospective contract, we use it to take the steps you request before that contract. Please send only the information needed for your enquiry. We process privacy-rights requests to meet our legal obligations.
Website measurement and analytics cookies
We use two separate forms of measurement. First, we keep aggregate first-party counts of page views, valid signup attempts and signup requests accepted by our server. These operational counts use no analytics cookies, local storage, persistent visitor identifiers or profiles and do not include your email, IP address, referral URL, query strings or an individual event timestamp; our basis is our legitimate interest in operating and improving NUS. Second, only if you choose ‘Accept analytics’, Google Analytics 4 receives page views, product browsing and signup-funnel events. We never send your signup email or URL query strings to Google. GA4 may set analytics cookies and process device, browser and approximate location information; our basis for this use is your consent. Google advertising storage, signals and personalisation remain disabled. You can withdraw consent at any time through Cookie settings in the footer.
Service providers and transfers
Resend manages our subscriber list, Railway hosts the application and Cloudflare provides network and security services. If you accept analytics, Google LLC provides Google Analytics 4. These providers process information needed to deliver their services and may use infrastructure or subprocessors outside the European Economic Area, including in the United States. Their data-processing terms describe the applicable safeguards, including standard contractual clauses for relevant international transfers. You can request further information or a copy of the applicable safeguards by email. We do not sell your information or share the list for other organisations’ marketing.
How long we keep information
We review the signup list monthly and remove subscriptions that are 24 months old unless you have explicitly signed up again. We stop marketing when you withdraw consent; a minimal unsubscribe record is kept only to prevent further mailings and is reviewed annually for necessity. If you request erasure, we assess and remove information that is no longer needed, keeping only what a specific legal obligation or claim requires. Resolved enquiries are deleted after 12 months. Privacy-request correspondence is kept for three years after closure. Aggregate first-party measurement exports are kept for up to 12 months; temporary service logs follow the provider’s configured retention. GA4 event-level and user-level data is configured for two-month retention, its analytics cookies expire after at most six months without renewal, and your stored analytics choice is requested again after six months. A documented legal hold may extend retention only for affected records.
Your rights and requests
You can ask for access to, correction or erasure of your personal information, restriction of processing, and portability where applicable. You can object to processing based on legitimate interests and withdraw consent without affecting processing already lawfully carried out. Email legal@nusmallorca.com and explain your request; we may ask for proportionate information to verify it. We normally respond within one month. If a permitted extension is needed, we will explain it within that first month. You can also complain to the Spanish Data Protection Agency (AEPD).
legal@nusmallorca.comSpanish Data Protection Agency (AEPD)Your choices
Google Analytics is blocked unless you actively accept it. Rejecting is as easy as accepting and does not affect browsing, contacting NUS or joining the mailing list. You can change your analytics choice at any time through Cookie settings in the footer. The consent preference itself is stored locally so the site can remember your choice. We use no advertising cookies and make no automated decisions with legal or similarly significant effects.