Privacy Policy
Working version — this text is being reviewed and may change before it is final.
Still to be completed
- Legal confirmation of who is the data controller (and whether joint controllership applies)
- Data protection contact (and DPO, if one is required)
- Legal basis for each purpose
- Retention periods
- Safeguards for transfers outside the EU/EEA
- Email provider that delivers the sign-in codes
Who is responsible
Palma Experience is a tourism intermediation marketplace operated by PALMA AGENCY DI DAVIDE FIORE, an Italian sole proprietorship (ditta individuale) owned by Davide Fiore, trading as Palma Agency. Proposed data controller: Davide Fiore (sole proprietor of PALMA AGENCY DI DAVIDE FIORE), tax domicile Via Cal di Prade 5, 31028 Vazzola (TV), Italy, VAT number (partita IVA) 05636490269. This identification was indicated by the owner; the legal determination of who is the data controller, and whether joint controllership applies, is still being verified with a legal advisor. Contact: palmaproperty10@gmail.com.
What we collect
- Account: your email address. You sign in with a code sent by email; there is no password.
- Availability requests: first and last name, email, phone, date, number of guests, the extras you choose and any note you write.
- Messages: what you write to the team or a host, files you attach, and the contact details given with your request.
- Reviews: if you write a review, its text, rating and name. Reviews shown from Google and Airbnb come from public profiles.
- Technical data needed to run and protect the service, including a security cookie when you send a request (see the Cookie Policy).
What we use it for
- To let you sign in and to send you the sign-in code.
- To handle your availability requests and bookings, and pass them to the host concerned.
- To exchange messages with you about your request and to help you when you contact support.
- To keep the service secure and to prevent misuse.
- Palma does not currently send marketing communications.
Legal bases
The legal bases for each purpose are being confirmed with a legal advisor and will be stated here.
Who receives it
- The local operator involved in your request receives the details needed to run the experience.
- Palma team members with administrator access, who handle requests and messages.
- Supabase, which provides the database, sign-in and file storage (EU region, Ireland).
- Lovable, which hosts the application, with Cloudflare for network delivery.
- An email provider that delivers the sign-in codes (provider being confirmed).
- An external AI image provider, only for photos of experiences prepared by the team; no customer data is sent (see the page on artificial intelligence).
Transfers outside the EU/EEA
The database is in the EU. Some providers, such as the AI image provider, may process data outside the EU/EEA. The safeguards that apply are being verified and will be stated here.
How long we keep it
No automatic deletion schedule is configured at the moment. Retention periods are being defined and will be stated here.
Security
Customers can see only their own requests and messages; access to operational data is limited to Palma administrators. The site is served over HTTPS.
Automated decisions and AI
Palma does not take decisions about you based solely on automated processing, including AI, that produce legal or similarly significant effects: requests and bookings are handled by people.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, to receive a copy, and to withdraw consent where it was the basis. Write to palmaproperty10@gmail.com from the address you used with Palma; we may ask you to confirm your identity first. We reply within the legal deadlines. Some data must be kept for legal reasons. You may also complain to the Spanish Data Protection Agency (AEPD) or to your own authority.
Changes
When this policy changes, the new version is published on this page.