Privacy Policy

1. Controller

LifeXperiences SL
Avenida Joan Miró 138
07015 Palma de Mallorca, Spain

NIF: B57406373
Registro Mercantil de Palma de Mallorca, Hoja PM-54114
Email: info@lifexperiences.com
Phone: +34 971 100 908

We process personal data under the General Data Protection Regulation (GDPR) and the Spanish data protection act (Ley Orgánica 3/2018, LOPDGDD). For any question about data protection, contact us at the email address or postal address above. Further company details are listed in our legal notice (footer link on every page).

2. The short version

• Until you give consent in the cookie banner, this website sets only technically necessary cookies and sends no request to any third party. Fonts, images and scripts come from our own server.
• Only with your consent do we load the MAYA chat assistant and, for usage statistics, Google Analytics 4 (through Google Tag Manager). You can change your choice at any time via “Cookie settings” in the footer. We use no advertising or remarketing services.
• For every page view, our server logs technical connection data, including your IP address (section 3).
• We receive other personal data when you send it to us — through our forms, the newsletter signup, by email, phone or WhatsApp — or when we are in business contact with you (section 9).
• In our newsletters we measure whether they are opened and which links are clicked (section 6).
• Some of our service providers also process data outside the EU (section 11).

3. Hosting and server logs

Our website runs on a server in a data centre of Hetzner Online GmbH in Falkenstein, Germany. Our hosting provider processes the data on this server on our behalf under a data-processing agreement (Art. 28 GDPR).

For every request, the web server records connection data in log files: IP address, date and time, the requested address including any parameters attached to it (such as search terms from our site search or campaign parameters), status code, amount of data transferred, the previous page (referrer) and browser identification. Error logs also contain the IP address. This is technically necessary to deliver the site and to keep it stable and secure (Art. 6(1)(f) GDPR).

In the access logs, the full IP address is kept only in the current file. During nightly processing, that is within about 24 hours, it is shortened by removing the last part of the address. The shortened logs are rotated by file size, and the oldest file is deleted once there are ten. How far back they reach therefore depends on traffic: currently about two to three weeks for the HTTPS access log, and back to December 2024 for the log of plain-HTTP requests, which the server only redirects to HTTPS. The web server’s error log currently reaches back up to about 13 months. From the logs, the server software AWStats compiles access statistics, which stay on the server. We do not combine log data with other data sources.

When an error occurs in our application, it is recorded in a separate error log. This log can contain an email address, for example when a notification could not be delivered. No fixed deletion period is currently set for it.

4. Cookies and consent

Technically necessary cookies

We set these cookies without consent, because the website does not work without them:

• PHPSESSID — links your browser to a technical session on our server. The session holds the security token of our forms; if a form cannot be sent because of an input error, it also holds your entries for a short time, so you do not have to type them again. Set on your first page view and deleted when you close your browser.
• FluentLocale — remembers the language you chose. Lifetime 90 days.
• lxp_consent — stores your choice in the cookie banner (see below). Set only once you make a choice. Lifetime six months.

These cookies contain no tracking identifiers. They require no consent (Art. 5(3) of the ePrivacy Directive; Art. 22(2) of the Spanish Information Society Services Act 34/2002, LSSI); the legal basis is our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR). Until you give consent, we set no other cookies. The Google reviews we show on some pages are also fetched from Google by our server; your browser does not connect to Google for them.

Your choice in the cookie banner

We load all other services only with your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device, Art. 22(2) LSSI). We ask through a cookie banner that offers “Accept all” and “Reject all” with equal prominence, plus “Settings”. In the settings you choose the two optional categories separately: “Functional” (MAYA chat assistant) and “Statistics” (Google Tag Manager and Google Analytics 4). Neither is pre-selected.

We store your choice in the cookie lxp_consent. To be able to prove your consent (Art. 7(1) GDPR), we also log every decision on our server: a random identifier (the same as in the cookie), the kind of decision, the categories chosen, the version of the settings, the language, your browser identification and the time. We do not store your IP address with it. We keep each entry for as long as we may need to prove the consent: while it applies and, after you withdraw or change it, for as long as proceedings about it are possible (up to three years, Art. 72(1) LOPDGDD). Deletion is currently not automated.

Statistics: Google Tag Manager and Google Analytics 4

If you allow the Statistics category, we load Google Tag Manager and, through it, Google Analytics 4, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics shows us how our website is used, for example which pages are viewed and how visitors find us. Without your consent, neither service is loaded.

The data processed includes the pages viewed (including attached parameters such as search terms or campaign parameters), time on page, the page you came from, device and browser details and your approximate location. Some actions may also be recorded, such as clicks on our phone number, our email address or our social media links, and sending a contact form (without its content). To recognise returning visits, Google Analytics sets the cookies _ga and _ga_ followed by an identifier, with a lifetime of up to two years. Google receives your IP address when the services load, for technical reasons; Google Analytics 4 does not store it.

We do not use Google Analytics for advertising. The advertising signals of Google Consent Mode (ad_storage, ad_user_data, ad_personalization) stay denied. Analytics data is kept in Google Analytics for no more than 14 months and then deleted.

This can involve a transfer to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR), supplemented by the EU Standard Contractual Clauses. Google’s privacy policy: https://policies.google.com/privacy

Functional: MAYA chat assistant

If you allow the Functional category, we load our AI chat assistant “Lexi”. It is provided by MAYA (mayatravel.ai), a service of Live the World BV, Belgium. The chat program is loaded through the Amazon CloudFront content delivery network.

As soon as the assistant has loaded, even if you never open the chat, your browser sends MAYA your IP address, browser and language details and the address of the page you are on, and MAYA creates a chat record. What you type into the chat is sent to MAYA and processed there to answer you.

MAYA sets four cookies on our domain whose names begin with maya_: two for the chat session, as soon as the assistant has loaded (lifetime seven days), and two that remember whether the chat window is open, once you open it (lifetime about one hour and 24 hours respectively). MAYA also keeps a counter of daily chat messages in your browser’s local storage, which stays there until you delete it in your browser.

The legal basis is your consent (Art. 6(1)(a) GDPR). According to the provider, the data is stored and processed in Belgium, Germany, the USA and the United Kingdom. MAYA states that it keeps personal data no longer than necessary. You can ask for your chat data to be deleted through us (section 1) or directly from MAYA at info@livetheworld.com. MAYA’s privacy policy: https://www.mayatravel.ai/privacy-policy

Withdrawing or changing your consent

You can withdraw or change your consent at any time, with effect for the future, via “Cookie settings” in the footer (Art. 7(3) GDPR). The page then reloads, and services you have deselected are no longer loaded. We delete the Google Analytics cookies when you do this. MAYA’s cookies stay in your browser until they expire (seven days at most) but are no longer used; you can delete them and the message counter at any time in your browser settings.

5. Enquiries and proposal requests

Our website has two contact forms: the briefing form for proposal requests and a short message form. In the briefing form we process your first name, last name, work email address and your brief, plus the optional details company, type of event, destination, group size, preferred dates and budget per person; in the message form your name, email address and message. We use this data to answer your enquiry and prepare a proposal (Art. 6(1)(b) GDPR).

With your enquiry we also store your IP address, browser identification and browser language, the page on which you sent the form and its language, the website you came from (only if it was another website), and the campaign parameters utm_source, utm_medium and utm_campaign if the page address contained them. If you arrive through a link with such parameters, we add them to the address of the links you follow within our website, so that they are still there when you reach the form; no cookie is set for this. This lets us detect misuse and see how enquiries reach us (Art. 6(1)(f) GDPR).

Your enquiry is stored in our database on our server and linked to the matching entry in our customer and contact database (section 9); if your address is not in it yet, we create an entry. If our automatic checks give an enquiry a spam score (see below), even one too low for it to be marked, we do not create a new entry for it there. This does not sign you up for the newsletter. At the same time we receive a notification email at info@lifexperiences.com with your details (without your IP address). It is sent through Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France), which acts on our behalf under a data-processing agreement (Art. 28 GDPR). Brevo stores the data on servers in the EU; for access from outside the EU, see sections 6 and 11. Section 7 describes how emails reach us.

To protect the forms against automated misuse we use no captcha and no external service, only our own checks on our server: invisible extra fields, a minimum time to fill in the form, a check that the form was sent from our website, and a limit on submissions per IP address. This applies to all forms, including the newsletter signup. Submissions that fail one of these checks are not stored. We then log only the form, the reason and the IP address, in one log file per day; we keep the files of the last 14 days on which such an entry was written and delete older ones. For the limit and to detect duplicate enquiries, we use hash values of the IP address, or of email address and message, that expire after ten minutes at most; expired entries remain in our server’s cache directory until it is next cleared. If the content of an enquiry looks suspicious, it is still stored and delivered, but marked, and a member of our team decides how to handle it (Art. 6(1)(f) GDPR).

We keep an enquiry for as long as we need it to answer you and to follow it up; after that we keep it blocked only for as long as claims arising from it can be raised (Art. 32 LOPDGDD), and then delete it. Deletion is currently not automated. If a contract follows, the statutory retention periods apply (section 9). You can ask for erasure at any time (section 12).

6. Newsletter

Our newsletter keeps you informed about our projects, destinations and offers. All you need to sign up is your email address. We send the newsletter only with your consent (Art. 6(1)(a) GDPR). On our website you give it when signing up, by ticking a checkbox that is not pre-ticked; if you gave it to us another way, for example in writing or at a trade fair, we record when and how.

When you sign up we store your email address, your language, the page you signed up on, the time of signup, your IP address and your browser identification, so that we can prove your consent (Art. 7(1) in conjunction with Art. 6(1)(f) GDPR).

Email service provider. We send the newsletter through Brevo, a service of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France. Brevo processes the data on our behalf and on our instructions under a data-processing agreement (Art. 28 GDPR), and stores it on servers in the European Union. For support and maintenance, Brevo group companies in the USA and India and some of Brevo’s sub-processors may access the data from outside the EU. Brevo safeguards these transfers with the EU Standard Contractual Clauses and, for the USA, the EU-US Data Privacy Framework (Art. 45 and 46(2)(c) GDPR). Your address is also stored in our own customer and contact database on our server (section 9). Brevo’s privacy policy: https://www.brevo.com/legal/privacypolicy/

Measuring opens and clicks. Our newsletters contain an invisible tracking pixel and trackable links. For each recipient we record whether and when a newsletter was delivered and opened and which links were clicked, and store this with your address. It shows us which topics interest you, so we can shape our content accordingly. The legal basis is your consent to the newsletter (Art. 6(1)(a) GDPR). You cannot withdraw your consent to this measurement separately; to stop it, unsubscribe from the newsletter.

Deliverability. If a mail server reports that an address cannot be reached, we note this and stop sending to that address (Art. 6(1)(f) GDPR, our legitimate interest in reliable email delivery).

Unsubscribing. Every newsletter contains an unsubscribe link. You may also withdraw your consent at any time, with effect for the future, by emailing info@lifexperiences.com (Art. 7(3) GDPR). After you unsubscribe we keep your address with an unsubscribe note, so that you receive no further newsletters. We also keep the evidence of your consent (time, IP address, browser identification) and the delivery, open and click data, to be able to defend ourselves against claims (Art. 6(1)(f) GDPR); these are currently not deleted automatically after a fixed period. You can ask for complete erasure at any time; we can then no longer rule out that you end up on a mailing list again.

7. Contact by email or phone

If you contact us directly, we process the data you provide to handle the correspondence (Art. 6(1)(b) GDPR; for general enquiries Art. 6(1)(f) GDPR, our legitimate interest being to answer you). Retention follows section 5.

Emails to @lifexperiences.com addresses, including the notifications from our forms, are received through the email security service Mimecast, whose servers handling our domain are located in South Africa; from there they are delivered to our mailboxes at Microsoft 365. For the transfer to South Africa, see section 11. For messages via WhatsApp, see section 10.

8. Job applications

Our website has no application form. Applications reach us by email at the address given in the job posting, usually recruitment@lifexperiences.com, by the route described in section 7. Application data is processed solely for the recruitment process (Art. 6(1)(b) GDPR). If you are not hired, application documents are deleted no later than six months after the process ends, unless you consent to a longer retention for future openings.

9. Clients, partners and our contact database

For the performance of contracts we process business contact and transaction data of clients, partners and suppliers (Art. 6(1)(b) GDPR). Where you are the contact person of a company, the legal basis is our legitimate interest in maintaining the business relationship with that company (Art. 6(1)(f) GDPR, Art. 19 LOPDGDD). We retain this data for the duration of the contract and for up to seven years thereafter, as required by Spanish commercial and tax law, unless the law requires a longer period (Art. 6(1)(c) GDPR; clause 9.3 of our General Terms and Conditions).

We keep business contacts in our customer and contact database on our server. An entry can contain: salutation, title, name, email address, company, job title, country, language, the type of contact and of company, the state of the business relationship, interests in destinations and services, how and when the contact came about, notes by our team and, if you receive our newsletter, the evidence of your consent and the delivery, open and click data (section 6). Where the data did not come from you, we received it at trade fairs and events (for example from a badge scan or business card), from business partners, convention bureaus or event organisers who passed contact lists to us, through referrals, or from publicly accessible sources such as company websites and professional networks (for example LinkedIn). The legal basis is our legitimate interest in maintaining our business relationships (Art. 6(1)(f) GDPR). Only contacts who have given their consent receive newsletters from this database. We keep an entry for as long as the business relationship lasts or we can reasonably expect to be in contact with you again; after that we delete it, unless statutory retention periods apply. Deletion is currently not automated. You can object to this processing at any time (section 12).

10. Links to social networks and other services

Our website links to our profiles on Instagram and LinkedIn, to WhatsApp and to our listing on Google Maps. These are plain links — no widgets or plugins of these platforms load on this site, and no data flows to these providers until you click a link. When you click, you leave our website, and the platform’s own privacy policy applies. If you write to us via WhatsApp, WhatsApp (Meta) processes your message under its own terms. The full descriptions of our job openings open on publications.lifexperiences.com; that address is part of our domain but is run by the flip-book service Publuu (see section 11).

11. Recipients and transfers outside the EU

Personal data is accessible only to the LifeXperiences team members who need it for their work, and to these service providers:

• Hosting: our server in a data centre of Hetzner Online GmbH, Germany (section 3)
• Website development and server administration: our external IT service provider, who maintains the website and the server for us and, to do so, has access to the database, including copies of it used for development and testing
• Brevo (Sendinblue SAS, France): newsletters, mailings and the notifications from our forms (sections 5 and 6)
• Mimecast and Microsoft 365: receiving and storing our email (section 7)
• Google (Google Ireland Limited, Ireland): only with your consent to the Statistics category (section 4)
• MAYA (Live the World BV, Belgium): only with your consent to the Functional category (section 4)

Data is processed outside the EU/EEA in these cases:

• Google Analytics: transfer to Google LLC in the USA on the basis of the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by the EU Standard Contractual Clauses.
• Brevo: access by Brevo group companies in the USA and India and by some of Brevo’s sub-processors for support and maintenance, safeguarded by the EU Standard Contractual Clauses and, for the USA, the EU-US Data Privacy Framework.
• MAYA: according to the provider, data is also stored and processed in the USA and the United Kingdom. According to its privacy policy, MAYA protects transfers outside the EEA with appropriate safeguards such as the EU Standard Contractual Clauses (Art. 46 GDPR).
• Job descriptions: the pages on publications.lifexperiences.com are served by the flip-book service Publuu from Amazon Web Services servers in the USA; your IP address, your browser details and the cookies set for our domain (for example those of Google Analytics, if you allowed it) reach them when you open a job description.
• Email: our email security service Mimecast processes incoming email on servers in South Africa. There is no adequacy decision of the European Commission for South Africa.

Where a transfer relies on the EU Standard Contractual Clauses, you can obtain a copy from us (section 1).

We do not sell data and make no automated decisions within the meaning of Art. 22 GDPR. We evaluate newsletter opens and clicks (section 6) only to shape our content.

12. Your rights

• Access to your data (Art. 15 GDPR)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interest (Art. 21)
• Withdrawal of any consent, with effect for the future (Art. 7(3))

To exercise any of these rights, email info@lifexperiences.com or write to the address in section 1.

Right to object. Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Where we use your data for direct marketing, you can object at any time without giving reasons, and we will then no longer use it for that purpose (Art. 21(2) and (3) GDPR).

Do you have to provide data? You are not required by law or contract to provide personal data. Without the details marked as required in a form, however, we cannot handle your enquiry, and without your email address we cannot send you the newsletter. The connection data in section 3 is needed to show you the website.

13. Supervisory authority

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Agencia Española de Protección de Datos (AEPD), Paseo de la Castellana 141, planta 9, 28046 Madrid, www.aepd.es; you may also contact the supervisory authority in the EU member state where you habitually live or work.

14. Updates

We revise this policy whenever our processing changes.

Last updated: 27 September 2026