Last updated 5 November 2026 · 2026-11-05.v1
- Service
- Mallorca Valet Parking by Azul Cars
- Company / controller
- AZUL VENTURES 2022 S.L.
- Trade name
- Azul Cars
- CIF
- B72770365
- Registered office
- Carrer Son Malferit, 18, Llevant, 07007 Palma, Illes Balears, Spain
- Commercial registry
- Registro Mercantil de Palma de Mallorca
- Contact
- info@azulcars.com · +34 971 10 13 32
- Group
- Isle of Mallorca
1. Controller and contact
AZUL VENTURES 2022 S.L., trading as Azul Cars, CIF B72770365, is the controller for Mallorca Valet Parking bookings and enquiries. Address: Carrer Son Malferit, 18, Llevant, 07007 Palma, Illes Balears, Spain. Contact: info@azulcars.com or +34 971 10 13 32. The Isle of Mallorca group name does not replace this controller identification.
This policy covers enquiries and quote requests, guests and registered customers, vehicle collection/parking/return, approved additional work, transport, service communications and payment records. Identified independent third parties may also process data under their own notices for services you contract with them.
2. Data, sources and required fields
We receive the information you supply through the website, your account/booking, email, telephone or messaging. It includes name, contact details, billing/tax details where necessary, vehicle make/model/registration and relevant operating information, selected services, requested dates, flight/FBO/vessel timing, handover locations and access instructions. Vehicle condition evidence includes photographs, timestamps, mileage, damage notes and fuel/battery levels. Account information can include saved vehicles and authentication identifiers; guests receive private booking credentials. We receive payment amounts, status and transaction references, not full card numbers or security codes.
An enquiry or lead form collects only the contact details and service/route information needed to respond and prepare a quote. You need not create an account or agree to marketing to ask a question. Technical records can include IP address, browser/device information, security/access logs and the storage described below. Approved workshop/gestoría/transport work may require further vehicle documents, representation authority or customs/registration data; we explain the requirement when requesting them.
We may receive necessary information from your authorised representative, FBO/marina contact, carrier or workshop. Where required by GDPR art. 14, we identify that source and provide this information when first communicating with you, before disclosure to another recipient, or within one month, as applicable. Do not submit another person's data without authority or unnecessarily include sensitive data, identity documents or card credentials. Fields identified as necessary are needed to respond or perform the requested service; missing essential data can prevent a quote/booking. Optional preferences and marketing consent are never a condition of the core service.
3. Purposes and lawful bases
Enquiries and quotes: we respond, assess availability and prepare proposals on the basis of precontractual steps at your request under GDPR art. 6.1.b. If you are contacting us as another person's representative or simply asking a non-contractual question, the basis is our legitimate interest in responding appropriately, subject to your rights.
Bookings and performance: we calculate the price, arrange authorised vehicle movement, parking/custody and approved extras/transport, verify release authority, provide account or guest access, process payments/refunds and send necessary service communications. Processing necessary for your contract is based on art. 6.1.b. Necessary representative/contact data may rely on the corresponding legitimate interest in delivering the customer's authorised service.
Condition evidence, security and disputes: we record the vehicle's condition to document receipt/return and protect both parties, operate access controls, prevent fraud and investigate complaints. The basis is art. 6.1.f, our legitimate interest in reliable custody evidence and a secure service, balanced against privacy. We restrict access, minimise images and do not use condition photos for advertising. Where a record is legally required, art. 6.1.c applies instead.
Accounting, tax and legal compliance: invoices, accounting documentation, lawful authority requests and necessary compliance records are processed under art. 6.1.c. Necessary evidence for establishing, exercising or defending claims is retained on the applicable lawful basis, not for unrelated marketing.
Optional marketing and non-essential tracking: marketing for the stated brand/purpose, if offered, uses a separate optional consent under art. 6.1.a. Any other group company's marketing or data sharing requires its own clear information and appropriate basis; booking is not blanket group-marketing permission. Non-essential terminal tracking requires the consent described in the cookie notice. You may withdraw consent without affecting the booking or earlier lawful processing. Purely operational updates, invoices and mandatory contract information are not marketing.
Automated decisions: the booking calculator uses the dates, parking option, selected services and distance to produce a quote. You can contact info@azulcars.com for a human review of a quotation or booking issue. Any legally relevant personalised pricing or solely automated decision affecting your rights must be identified before use with the applicable information and safeguards.
4. Vehicle photos, location and maps
Condition photos document the car, not passengers or unrelated people. Avoid leaving personal documents or valuables visible; our staff should avoid or redact incidental personal information. We limit images to what is needed for the handover/service and any justified claim. Condition photos are not CCTV; any premises CCTV needs its own notice and separate assessment.
You may type an address or select a pin. Address search/reverse-geocoding sends the necessary query or coordinates to the configured maps provider; the selected point supports collection/return and distance pricing. “Use my current location” obtains a device location only when you request it and allow the browser prompt. Browser permission alone is not a general consent to advertising. This feature does not authorise continuous vehicle/person tracking.
Interactive maps use Google Maps technology through our configured platform's maps proxy. They load when requested, but the map provider/platform may receive technical request information. Any non-essential tracking must remain blocked unless valid consent is obtained. You can use an address/instructions without enabling device location, and a no-tracking alternative must remain available where maps involve optional tracking. Opening WhatsApp or an external map transfers you to an independent service with its own privacy notice; information you then send there is handled under the relevant arrangements.
5. People and providers receiving data
Authorised staff/drivers receive only the data needed for their roles. Personal access links are not public. Group membership does not mean unrestricted access or sale of customer data to other brands.
We use the following categories of providers, to the extent active for your service:
Technical service providers process necessary data for hosting, database, media/file storage, authentication and owner/staff notifications through the configured Manus/platform services. Staff notifications support the requested service, not marketing.
Maps and address lookup: Google Maps technology via the configured Manus maps proxy . A proxy does not by itself establish that all processing stays in the EEA.
Necessary service communications use the enabled contact channels. Transactional email uses SMTP or Resend only when configured. Marketing is optional. Email delivery failure does not remove our duty to supply mandatory durable information.
Payments: Redsys and , plus the applicable card/Bizum payment participants. Payment providers may act as independent controllers for authentication, fraud and regulatory purposes; their notices describe that processing. We receive only the transaction data needed for our own payment/refund and accounting purposes.
Approved specialist and transport services: the workshop, gestoría, ITV centre, road/maritime carrier or other provider identified before approval, with the minimum vehicle/contact/appointment/document data needed. Their role can be independent controller or processor depending on the actual service; a commercial partner is not automatically a processor. Named direct-contract providers give their own notice.
Claims/compliance: insurers, professional advisers and authorities where necessary and legally justified, and courts/consumer bodies where appropriate. Insurers receive only relevant claim information; their identity is supplied when a claim or purchased cover requires it.
Providers acting solely on our instructions must have GDPR-compliant processing terms and security/access obligations. We do not authorise them to use your data for unrelated purposes.
6. International transfers
Where a transfer is made, it must have an applicable GDPR Chapter V basis, such as an adequacy decision covering the relevant destination/entity or the European Commission's Standard Contractual Clauses with the required assessment and supplementary safeguards. A US provider is not covered by the EU–US Data Privacy Framework merely because it is American; certification and scope must be checked. Routine transfers must not rely on a blanket booking-consent waiver.
Information about the relevant safeguards is available at info@azulcars.com. International processing cannot be ruled out merely because a service uses a proxy or European hosting. Applicable provider countries, overseas access and transfer mechanisms must be identified for the enabled services; routine transfers cannot rely on a blanket booking-consent waiver.
7. Retention
We keep operational data only for its defined purpose, then delete, anonymise or restrict it as required. We do not keep every photograph, coordinate or account preference for the full accounting period merely because an invoice must be retained. Where a legal obligation or claim requires retention, we retain only the necessary evidence with restricted access. The following category-specific periods or criteria apply:
| Category | Retention period or criterion |
|---|---|
| Enquiries and unaccepted quotes | Until the enquiry is answered and the requested quote/follow-up is closed. Thereafter only necessary evidence is retained for a documented live claim or applicable limitation period; it is not automatically added to marketing. |
| Booking, accepted terms, authorised quotes, handover receipts and necessary communications | Operationally for the booking and aftercare; necessary contractual evidence may be restricted for the applicable claims period, ordinarily five years from when an ordinary Spanish personal contractual claim can be exercised, subject to interruption/suspension and special shorter/longer periods. Documents that also have accounting status follow the accounting rule below. |
| Routine vehicle photos, condition notes and precise location/access information | Only while needed for performance, post-service condition review and relevant evidence under a documented claim/legal hold. Afterwards they should be deleted or minimised. A hold lasts only as needed for resolution and applicable legal periods; no fixed routine deletion period is asserted here. |
| Invoices, payment reconciliation and accounting support | Normally six years from the last accounting entry under the Commercial Code. Tax prescription is ordinarily four years from the applicable statutory starting date; interruptions, tax carry-forwards/checking and other legal requirements can extend retention for the relevant evidence. |
| Accounts and saved vehicles | While the account remains active or until deletion is requested. After closure, remove optional account/saved-vehicle data; retain only separately necessary booking/accounting/claims evidence on its own basis. |
| Guest access and authentication/security records | Only while needed for authorised booking access and proportionate security purposes; relevant evidence may be restricted for a specific incident or legal requirement. No fixed log deletion period or automatic credential expiry is asserted here. Current device-storage durations appear in the cookie notice. |
| Approved administrative/transport documents | Until the authorised work and any legally required aftercare are completed; restrict any necessary retained legal/claim evidence under the applicable rule. Do not retain full identity documents where a minimal verification record suffices. |
| Complaints, disputes, chargebacks and insurance claims | Until resolved and for the applicable evidence/limitation period, with restricted access. Special carriage reservation/limitation periods are not a universal deadline for all service data. |
| Marketing preferences and consent proof | Until consent is withdrawn or the stated purpose ends. Afterwards retain only the minimal suppression/consent evidence needed to honour opt-out and demonstrate lawful handling during the relevant liability period. |
| Backups | Only within the applicable backup lifecycle and justified recovery requirements. Restored data remains subject to deletion restrictions. A backup is not a reason for unlimited retention; no fixed backup expiry cycle is asserted here. |
The ordinary five-year claims period is not a universal statutory retention mandate for all personal data. You may request the applicable criterion for your record and ask for deletion/restriction. We explain any legal reason that prevents immediate deletion.
8. Your rights and complaints
You can request access, rectification, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier lawful processing. Write to info@azulcars.com or our registered office with your request. We verify identity proportionately if needed; we do not routinely require a full identity-document copy for every request.
We respond without undue delay and normally within one month. A legally permitted extension of up to two additional months for complex/numerous requests is explained within the first month. Rights are generally free; any exception follows GDPR art. 12.5. You may complain to the Agencia Española de Protección de Datos, https://www.aepd.es/, including through its electronic headquarters at https://sedeaepd.gob.es/. You may also use another supervisory authority where GDPR art. 77 permits, including where you habitually reside or work. Contacting us first is helpful but does not waive that right.
9. Security, browser access and changes
We use proportionate access controls and security measures and ask you to protect your account/private link. Anyone with a guest credential may be able to view its booking, so do not share it publicly or retain it on a shared device. Use “forget booking”, logout and browser-storage deletion where appropriate; tell us promptly if credentials are exposed so they can be revoked or replaced. No online service can promise absolute security.
Our cookie/storage notice explains authentication and optional device storage. Important changes to purposes/recipients or new consent-based processing are communicated as legally required; publication of a new policy is not consent to a new incompatible purpose. Earlier accepted service terms remain unchanged.