Privacy Policy

Version: August 2026

1. Privacy at a glance

Mallorca spielt Golf shows the golf courses of the island, ratings by other players and your own rounds. Without an account we process only the technically necessary access data; everything else only arises once you sign in:

• Without an account — course data and ratings are only read. Favourites and your own rounds are held exclusively on your device.
• With an account — email address, password as a hash value, your ratings and, from Premium or Premium Plus onwards, your profile and your scorecards on our server.

We do not use any analytics or tracking services, no social media plug-ins and no newsletter systems. No profiling and no automated decision-making take place. Data is not sold to third parties. In the free tier advertising is displayed — see section 8.

2. Controller

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Legal bases

We process personal data on the basis of Art. 6(1)(b) GDPR (performance of the user contract, see Terms), Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation), Art. 6(1)(c) GDPR (statutory retention obligations for payments) and, where consent has been given, Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time with effect for the future.

SSL/TLS encryption

This site and all interfaces of the service are delivered exclusively over an encrypted connection (recognisable by https:// in the address bar). Data transmitted cannot therefore be read by third parties.

3. Hosting

Mallorca spielt Golf runs on a server in a data centre within the European Union. All application data — accounts, course data, ratings and scorecards — is held on that server. No content delivery network is used; fonts, icons and scripts are also delivered from our own server and not loaded from external hosts.

4. Website access data

When a page is requested, your browser transmits technically necessary information that the server records in log files:

• the address requested, date and time of the request
• the amount of data transferred and the HTTP status code
• browser type and version, operating system
• the referring page, where transmitted
• IP address

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure operation and the defence against attacks. This data is not merged with other data sources. Logs are deleted after 30 days at the latest, unless they are needed to investigate a specific case of abuse.

To fend off automated attacks we store the IP address of suspicious requests in a block list for a limited time.

Contacting us

If you write to us by e-mail, we process your details in order to handle the enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. Messages remain with us until the purpose ceases to apply and no statutory retention periods stand in the way.

5. Account and sign-in

Viewing courses and reading ratings works without an account. An account is required for your own ratings, for syncing between several devices and for scorecards. In that case we process:

• email address and, where provided, name
• the password — exclusively as a non-reversible hash value, never in plain text
• a session identifier by which the app recognises you on each call
• the tier enabled (free, Premium, Premium Plus, Enterprise) and the confirmation status of the account
• the times of creation and of the last change
• time-limited identifiers for the confirmation email and for resetting the password

The legal basis is Art. 6 (1) (b) GDPR. The account applies to Mallorca spielt Golf only. Other applications of the provider keep separate accounts with their own data records, even with the same email address; no synchronisation between them takes place.

6. Ratings

For a rating we store the course rated, the score from 1 to 10, the comment, the date and the identifier of your account. Ratings are visible to other users of the app — your email address is not shown. Please do not enter any details in a comment that you do not wish to publish.

The account identifier is stored in order to let you edit and delete your own ratings and to enforce the 30-day lock per course (see Terms & Conditions §7). The legal basis is Art. 6 (1) (b) GDPR, and additionally Art. 6 (1) (f) GDPR for the lock (protection against multiple ratings).

7. Scorecards and profile

A scorecard contains the date, course, par, the strokes per hole, the total and a note. Scorecards and the profile snapshot (display name, settings, optional profile picture) are stored on the server as one file each per account, in a separate directory assigned to that account. They cannot be retrieved freely over the web: the authorisation is checked on every single call using the account identifier and the session identifier.

This data is intended for you alone and is not shown to other users. The purpose of storing it is to sync between your devices and to back up your rounds; the legal basis is Art. 6 (1) (b) GDPR. Without an account, rounds and favourites do not leave your device.

8. Advertising

In the free tier the app displays advertising banners via Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In order to deliver an advert, Google processes technical data of your device, in particular the IP address, device type, operating system and the system's advertising identifier.

On iOS you decide via the system prompt for App Tracking Transparency whether a cross-device advertising identifier may be used; without your consent only non-personalised advertising is delivered. In this respect the legal basis is your consent under Art. 6 (1) (a) GDPR, and otherwise Art. 6 (1) (f) GDPR (funding of the free use). You can withdraw your consent at any time in the system settings of your device. Purchasing Premium or Premium Plus removes the advertising entirely; no further data is then transmitted to the advertising service. More on the processing by Google: policies.google.com/privacy.

9. Purchases via the App Store

Paid tiers are handled as an in-app purchase via the Apple App Store (Apple Distribution International Ltd., Cork, Ireland). You enter the payment data there; it does not reach our server. We only learn which tier is enabled for your account and store that status with the account. The legal basis is Art. 6 (1) (b) GDPR as well as Art. 6 (1) (c) GDPR for retention under commercial and tax law. The privacy notices of the distribution platform apply in addition.

10. E-mail

The service sends e-mail only in response to an event: confirmation of registration, password reset and notices about the account. Dispatch is handled by the provider's mail server. There is no advertising or newsletter mailing.

11. Storage on the device

The app stores data in the local storage of the device (IndexedDB and localStorage). These details remain on your device and are not transmitted to us — except when syncing with your account:

• the course data including ratings, so that the app can be used without a network connection
• your favourites and your scorecards
• the session (account identifier, session identifier, display name) and, if set, the hash value of your PIN code
• the language selected and the System/Light/Dark setting
• the status of the last sync and the tier enabled

The legal basis is Art. 6 (1) (b) GDPR; the storage is necessary for operation. Signing out, resetting the local data in the profile or removing the app deletes these entries. We do not set cookies for advertising or analytics purposes; the start page on the web only sets the technically necessary session cookie of the web server.

If you sign in on a device with a different account, favourites, your own ratings and scorecards on that device are reset.

12. Push notifications in the app

If you agree to notifications, the operating system generates a device identifier via Firebase Cloud Messaging (Google Ireland Limited) which we assign to your account so that we can send you notices. The legal basis is your consent under Art. 6 (1) (a) GDPR, given by agreeing to notifications in the operating system. You can withdraw it at any time in the system settings of your device; the stored device identifier is then no longer used and is removed when the account is deleted. There are no push notifications in the browser.

13. Retention period and deletion

• Account data — until you delete the account.
• Ratings, profile and scorecards — until you delete them or your account. We do not delete them on our own initiative.
• Access logs — after 30 days at the latest.
• Payment records — in line with the statutory retention periods, as a rule six to ten years.

You delete your account yourself via the profile in the app. Account data, ratings, profile and scorecards are removed from the server and the account is deactivated. The process cannot be reversed. Accounts with other applications of the provider remain unaffected and have to be deleted there separately.

14. Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Consent given can be withdrawn at any time with effect for the future.

Please contact [email protected].

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

15. Changes to this policy

We adapt this policy when the service or the legal situation changes. The version published here at the time applies. In the case of substantial changes we additionally inform account holders in the application or by e-mail.