1. Data Protection at a Glance
General Information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally. For detailed information on the subject of data protection, please refer to our privacy policy set out below.
Data Collection on Our Website
Who is responsible for the data collection on this website?
The data processing on this website is carried out by the website operator: Christian Donnert (for contact details, please refer to Section 3 “Information on the Responsible Body” or our legal notice / imprint).
How do we collect your data?
Your data is collected when you provide it to us (e.g. during registration, when posting a classified ad, using the internal messaging feature, or via a contact form).
Other data is collected automatically or upon your consent when you visit the website by our IT systems. This is primarily technical data (e.g. web browser, operating system, time of page access, screen resolution, and IP address).
What do we use your data for?
Part of the data is collected to ensure the error-free and secure operation of the website, manage user accounts, and publish classified ads. Other data is used to protect against fraud, spam, and fake accounts, and to serve advertisements (provided you have given your consent).
What rights do you have regarding your data?
You have the right to receive information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request the rectification, blocking, or deletion of this data, to demand data portability, and to revoke any granted consents at any time. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
2. Hosting
External Hosting by netcup
We host our website with the provider netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany (hereinafter referred to as “netcup”). When you visit our website, netcup collects various server log files including your IP address.
The use of netcup is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in providing our online presence as reliably, quickly, and securely as possible on servers located within the Federal Republic of Germany.
Data Processing Agreement: We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with netcup GmbH. This ensures that netcup processes the data of our website visitors strictly in accordance with our instructions and in compliance with the GDPR.
3. General Information and Mandatory Information
Data Protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (GDPR, TDDDG) and this privacy policy.
Information on the Responsible Body
The controller responsible for data processing on this website is:
Christian Donnert
Hamberg 11
25594 Vaale
Germany
Email: info@mallorca-zero.com
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
Storage Period
Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial retention periods).
Legal Bases of Data Processing
We process personal data on the following bases:
- Art. 6 (1) (a) GDPR / Section 25 (1) TDDDG: If you have given us your explicit consent (e.g. for personalized ads via cookie banner or newsletter).
- Art. 6 (1) (b) GDPR: For the performance of a contract or pre-contractual measures (e.g. registration, publishing classified ads, booking paid optional features, internal user mailbox).
- Art. 6 (1) (c) GDPR: For the fulfillment of a legal obligation (e.g. tax retention obligations for invoices).
- Art. 6 (1) (f) GDPR / Section 25 (2) TDDDG: To safeguard our legitimate interests (e.g. ensuring IT security, defense against fraud and spam attacks, economic operation of the platform).
Revocation of Your Consent to Data Processing
Many data processing operations are only possible with your express consent. You can revoke an already given consent at any time. An informal email notification to us or adjustment via the “Privacy Settings” link in our footer is sufficient. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR)
IF DATA PROCESSING IS BASED ON ART. 6 (1) (E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES TO ASSERT, EXERCISE, OR DEFEND LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING.
Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement. A list of data protection authorities can be found at: Addresses of State Data Protection Authorities.
Right to Data Portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.
SSL and TLS Encryption
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the lock icon in your browser address bar and the “https://” prefix.
Information, Rectification, and Erasure
Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipient, and the purpose of the data processing, as well as a right to rectification or erasure of this data. You can contact us at any time regarding this.
4. Data Collection on Our Website
Cookies & Web Storage
Our website uses so-called “cookies” and local browser storage. Cookies are small text files that are stored on your device and do not cause any harm.
Technically necessary cookies (e.g. session ID, authentication tokens for permanent login “stay_token”, cookie consent status) are stored on the basis of Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR, as we have a legitimate interest in the smooth functionality of the platform.
Cookies that are not technically strictly necessary (e.g. for Google AdSense advertising banners) are only stored following your express consent via the cookie consent banner (Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR). You can change or revoke these settings at any time via the “Privacy Settings” link at the bottom of the page.
Server Log Files
The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
- Browser type and browser version
- Operating system used
- Referrer URL (the previously visited page)
- Host name of the accessing computer / IP address
- Time of the server request
This data is not merged with other data sources. The collection of this data is based on Art. 6 (1) (f) GDPR.
Registration and User Account
You can register on our website to post classified ads, manage listings, and send messages. We use the data entered for this purpose (email address, username, password) exclusively for providing your user account (Art. 6 (1) (b) GDPR).
Posting and Publishing Classified Ads
When you publish a classified ad on our platform, the data you enter (title, description text, images, price, postal code/city, and any voluntarily provided phone numbers) is publicly published on the Internet. This information can be viewed by anyone and is also captured and indexed by external search engines (e.g. Google, Bing).
Publication takes place for the performance of the user contract pursuant to Art. 6 (1) (b) GDPR. Upon deactivation or deletion of your listing, the ad is removed from the public area.
Internal Messaging System (Mailbox)
Our platform provides an internal messaging system through which registered prospective buyers and sellers can communicate directly with each other. The exchanged messages and timestamps are stored on our servers in order to maintain the conversation history for both parties. Processing takes place for contract performance and provision of platform functionality (Art. 6 (1) (b) GDPR).
Order Processing in the Online Shop and Paid Options
If you book paid supplementary services (e.g. Premium Partner listings, advertising banners, or Top Ads), we process inventory, communication, and billing data for contract fulfillment (Art. 6 (1) (b) GDPR) and compliance with statutory tax retention periods (Art. 6 (1) (c) GDPR).
5. IT Security, Fraud Prevention, and Abuse Protection
As a marketplace operator, we face particular risks from phishing, fraudulent fake listings, automated bot attacks, and account takeovers. In order to protect our honest users and ensure system stability, we employ automated security and protection mechanisms:
- Technical Device and Client Characteristics: During login and ad creation, we collect technical characteristics (such as browser version, operating system, screen resolution, time zone, and language settings) to detect automated unauthorized access and scripts (bots).
- Network and Reputation Verification: IP addresses are automatically analyzed for known security risks (e.g. whether the connection originates from a publicly known anonymization network such as TOR, datacenter proxies, or conspicuous hosting networks) and checked for plausibility against the specified time zone.
- Security and Login Logging: Authentication events (such as successful logins, auto-logins, failed attempts, and account locks) are stored with timestamp and IP address in internal security logs to defend against brute-force attacks and trace abuse.
Legal Basis: The processing of this data is based on our prevailing legitimate interest pursuant to Art. 6 (1) (f) GDPR in maintaining IT security, protecting against fraudulent classified ads, and fulfilling statutory duties of care.
6. Use of Artificial Intelligence (AI)
To improve quality, enable automated translation, and detect abusive content, we use modern AI services and language models (including Google Gemini by Google Ireland Limited / Google LLC, OpenAI by OpenAI Inc., and DeepL):
- Ad Translation & Categorization: Entered ad titles and description texts are automatically analyzed to suggest suitable categories and translate listings into Spanish and English for our international visitors.
- Semantic Vector Search: Mathematical vectors are generated from ad texts to display relevant search results and similar listings to visitors.
- Security Check: Ad texts and images are examined for prohibited content, fraud indicators (scam), spam, and copyright infringements.
Data Protection and Confidentiality: When transmitting data to AI services, no personal user master data (such as account passwords, user account email addresses, or payment data) is transmitted—only the content relevant to the advertisement (text, image). In accordance with contractual API agreements with the providers, the transmitted data is not used to train general AI models.
Legal Basis and Third-Country Transfer: Processing is carried out for contract fulfillment (Art. 6 (1) (b) GDPR) and within the scope of our legitimate interest in a secure and multilingual platform (Art. 6 (1) (f) GDPR). The US providers Google LLC and OpenAI Inc. are certified under the EU-US Data Privacy Framework (DPF), meaning that a valid adequacy decision of the European Commission pursuant to Art. 45 GDPR applies to data transfers to the US.
7. Advertising Partners & Consent Management
Google AdSense
This website uses Google AdSense, a service for integrating advertisements provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google AdSense uses cookies and similar recognition technologies to analyze user behavior and serve relevant advertisements.
Processing takes place exclusively on the basis of your express consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. If you do not give consent, only non-personalized advertisements will be served.
Revocation & Settings: You can adjust or revoke your advertising and privacy settings at any time via the consent management window. To do so, click on the link “Privacy Settings” in our footer.
8. Payment Service Providers
For paid services, we offer payment via external payment service providers. The legal basis for the transfer is Art. 6 (1) (b) GDPR (contract performance):
- Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Details in Stripe's privacy policy: stripe.com/privacy.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Details in PayPal's privacy policy: paypal.com/privacy.
9. Newsletter
If you would like to receive the newsletter offered on the website, we require an email address from you. Processing takes place exclusively on the basis of your consent (Art. 6 (1) (a) GDPR). You can revoke this consent at any time by unsubscribing from the newsletter via the link included in every email.