Skip to content
MAJORVYEssentials

MAJORVY ESSENTIALS

Privacy policy

How MAJORVY ESSENTIALS handles personal data, under the GDPR and the Spanish Data Protection Act (LOPDGDD).

Draft — not legally effective

Every highlighted slot below is a fact only the operator knows, or a decision only a Spanish consumer-law adviser can make. Until they are filled this page is excluded from search engines and must not be linked from a contract.

Controller

OPERATOR_LEGAL_NAME, OPERATOR_ADDRESS, OPERATOR_EMAIL.

Data protection officer: DPO_OR_NONE.

What we collect, and why

When you place an order we collect your name, email address, telephone number if you give one, your room number, and any delivery note you write. We need these to deliver what you ordered and to contact you if something changes. The legal basis is performance of a contract (article 6(1)(b) GDPR).

Your order itself — items, dates, amounts — is stored for the same reason, and afterwards to meet Spanish accounting and tax retention duties (article 6(1)(c) GDPR).

When you scan a QR code we store a random session identifier, which hotel and placement the code belonged to, and your browser's user-agent string. This measures how well each placement works. It contains no name and no account. The legal basis is our legitimate interest in understanding which placements are worth printing (article 6(1)(f) GDPR).

If you submit the hotel partner form we store the hotel name, your name, email, telephone and room count in order to answer you (article 6(1)(b) and (f) GDPR).

Who processes it for us

We do not sell personal data and do not use it for advertising. It is handled by the following processors, each under a data processing agreement:

  • Supabase — database, authentication and file storage. Data is held in the EU (Frankfurt).
  • Vercel — hosting and delivery of the website.
  • Stripe — payment processing. Card details are entered on Stripe's own page and never reach our servers.
  • Resend — sending your order confirmation by email.

Your hotel is told that a delivery is expected for a room and what it was worth. It is not told what you ordered. That restriction is enforced in the database, not merely in the interface.

Transfers outside the EU

INTERNATIONAL_TRANSFERS — Stripe, Vercel and Resend are US-headquartered and process some data outside the EEA under the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

How long we keep it

Orders and invoices: RETENTION_ORDERS, as required by Spanish commercial and tax law.

QR scan records: RETENTION_ANALYTICS.

Hotel partner enquiries: RETENTION_LEADS.

Unpaid orders abandoned at checkout are cancelled automatically after 45 minutes and the reservation released.

Your rights

You may request access to your data, its correction or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to OPERATOR_EMAIL.

You may also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).

Is it compulsory?

Name, email and room number are necessary to fulfil an order — without them we cannot deliver. Everything else is optional.

Open questions for counsel

  • Retention periods: Spanish commercial law points at six years and tax law at four; confirm which applies and from when.
  • Whether the QR attribution cookie can rest on legitimate interest or needs consent. See the cookies page — this is the only cookie that raises the question.
  • Whether a DPO is required. Unlikely at this scale, but it should be a recorded decision rather than an omission.