Last updated: 29 September 2026
Legal Notice
This Legal Notice identifies the operator of brunnhoff.com and governs the use of this website.
Website operator and service provider:
Lars Brunnhoff
Self-employed professional registered in Spain, operating under the registered trading name Brunnhoff & Partners.
Tax identification:
NIF / NIE: Z4490492T
EU VAT identification number: ESZ4490492T
Business address:
Calle Sindicato 74
2 derecha
07002 Palma
Spain
Email: office@brunnhoff.com
Website: brunnhoff.com
Professional activity:
Business consultancy, operational support for private residences and property-related services.
This website presents the professional services of Brunnhoff & Partners, including business consultancy, operational support, coordination and supervision services for private residences and selected property-related projects in Mallorca. Lars Brunnhoff is responsible for the website content.
Website content is provided for general information. It does not constitute individual legal, tax, financial or technical advice. The scope and terms of professional services are established in the applicable agreement with the client.
Texts, photographs, graphics, design elements and other website materials are protected by applicable intellectual property laws where relevant. Use beyond what the law permits requires permission from the relevant rights holder.
Links to external websites are provided for information. Those websites are operated independently and have their own terms and privacy practices. This does not exclude any responsibility that cannot lawfully be excluded.
Spanish law applies, without prejudice to mandatory consumer protection rules and other mandatory rights that may apply.
Privacy Policy
This Privacy Policy explains how Brunnhoff & Partners processes personal data in connection with this website, enquiries and professional relationships with clients, suppliers and their representatives.
We have made a deliberate decision to use European providers and European-hosted infrastructure for our website, email, internal collaboration and invoicing. This is our standard for the systems and services we select and control. The providers and processing locations are described below.
1. Data controller
The controller responsible for the processing described in this policy is:
Lars Brunnhoff, operating as Brunnhoff & Partners
Calle Sindicato 74, 2 derecha
07002 Palma, Spain
Email: office@brunnhoff.com
References to “we”, “us” and “our” in this policy refer to this business.
2. Website operation and hosting
Our WordPress website is hosted by cyon AG in Switzerland. When you access it, the hosting infrastructure processes technical information needed to deliver and secure the website. This can include your IP address, access time, requested address, referral information, browser and operating-system information, response status and transferred data volume.
This information may be recorded in access or security logs for website delivery, troubleshooting, protection against misuse and investigation of technical incidents. Server-side processing is separate from cookies and other storage in your browser.
Legal basis: Article 6(1)(f) GDPR, our legitimate interest in providing a reliable and secure website.
Technical logs are retained only for the period necessary for their operational and security purposes. Where a specific incident requires investigation or the preservation of evidence, relevant records may be retained for that purpose for longer.
Provider information: cyon Privacy Policy.
3. Cookies and website analytics
The public website is currently configured without visitor cookies, local storage or session storage used to remember or track visitors. We do not use Google Analytics or advertising pixels. Restricted administration and login functions may use separate authentication and security cookies.
Further information is available in our Cookie Policy.
Plausible Analytics
We use Plausible Analytics, provided by Plausible Insights OÜ in Estonia, to understand website usage and improve our content. Our configuration records page views. Optional measurement of downloads, outbound link clicks, form submissions and internal search terms is disabled.
According to Plausible, the service does not use cookies, local storage or persistent visitor identifiers. Page addresses and available referral information are transmitted for measurement. Technical connection information, including the IP address and browser information, is used to derive approximate location and a daily, website-specific identifier. The provider states that raw IP addresses and raw User-Agent strings are not stored in its analytics database and that the daily identifier does not enable recognition across websites or across days.
Plausible stores event and session records from which statistical reports are generated. Its visitor analytics data is processed and stored in the European Union. Our website delivers the script and measurement requests through our own domain; the analytics service remains provided by Plausible.
To the extent that personal data is processed in connection with this measurement, we rely on Article 6(1)(f) GDPR. Our legitimate interest is understanding the use of our public website while limiting the information collected and avoiding persistent visitor tracking. Information on the right to object is provided below.
Our retention limit for website analytics records is three years. This concerns records on the analytics provider’s servers, not cookies or other information stored in your browser.
Provider information: Plausible Data Policy.
Google Search Console
We use Google Search Console to review indexing, technical issues and our website’s performance in Google Search. This administrative service is separate from visitor analytics installed on the website. Its use does not itself install Google Analytics or place Google cookies through our website.
Provider information: Google Privacy Policy.
4. Email enquiries and business communication
Email is the contact method offered on this website. There is no website contact form. When you contact us, we process your email address, name where provided, message content, attachments and other information you choose to share.
We use this information to respond, clarify your requirements and, where applicable, prepare or carry out professional services. Please provide only information relevant to your enquiry.
Email is handled through Proton Mail, provided by Proton AG in Switzerland. Proton states that Mail data is stored in encrypted form on servers in Switzerland, Germany or Norway. Email correspondence with external recipients also involves the recipient’s email service. Not all external email exchanges are automatically end-to-end encrypted.
Legal basis: Article 6(1)(b) GDPR for steps requested before entering a contract and for contract performance; Article 6(1)(f) GDPR for other business enquiries and communication with representatives of clients or suppliers. Our legitimate interest is responding to relevant enquiries and managing professional relationships.
Provider information: Proton Mail Privacy Policy.
5. Professional services and internal coordination
When providing services, we may process client and supplier contact details, property references, instructions, correspondence, task records, relevant documents and photographs documenting property conditions or work. We limit this information to what is relevant for the assignment.
Information may be provided by you, your authorised representatives or people involved in the relevant work. Property references and photographs can constitute personal data where they can be associated with an identifiable person, even if a name is not displayed.
We use Threema Work for encrypted internal communication and the exchange of relevant photographs and messages. The service is provided by Threema GmbH in Switzerland. Message content is end-to-end encrypted; use of the service also involves the technical information necessary for its operation.
We use Nextcloud hosted by Keyweb AG in Germany for internal document and task management. Keyweb states that its KeyCloud hosting stores data in Germany. Access to business information is limited according to operational responsibilities.
Legal basis: Article 6(1)(b) GDPR where processing is necessary to perform a contract with the individual concerned, and Article 6(1)(f) GDPR for necessary coordination involving representatives, suppliers and other people connected with an assignment. Our legitimate interests are organising agreed services, communicating effectively and documenting relevant work.
Provider information: Threema Work Privacy Policy and Keyweb Privacy Policy.
This policy does not replace separate information provided to employees about the processing of their employment data.
6. Invoicing and statutory records
We process the identification, address, tax, service and payment information necessary to prepare invoices, maintain business records and comply with applicable accounting and tax obligations.
For invoicing, we use PiFact, provided by Programari Enginyeria Informàtica SL in Spain. The provider has confirmed that the service is hosted in Amsterdam through Nominalia and that its databases, backups, technical logs and recovery systems remain within the European Union.
Legal basis: Article 6(1)(b) GDPR where necessary for contract performance and Article 6(1)(c) GDPR for applicable accounting, invoicing and tax obligations.
Provider information: PiFact.
7. Access and recipients
Personal data is accessible only to people who need it for their responsibilities. Relevant recipients may include the service providers described above, authorised personnel, professional advisers and suppliers involved in an assignment where disclosure is necessary. Public authorities may receive information where required by law.
We do not sell personal data. We limit disclosures to the information necessary for the relevant purpose.
8. Processing locations and international transfers
The arrangements described above use providers based in the European Union or Switzerland, with the processing locations specified in the relevant sections. Norway is within the European Economic Area. Switzerland benefits from an adequacy decision of the European Commission.
A provider’s registered office is not, by itself, a guarantee about every processing operation or subprocessor. Where a transfer of personal data outside the European Economic Area requires safeguards, the applicable transfer mechanism must be in place, such as an adequacy decision or appropriate contractual safeguards. You may contact us for information about safeguards relevant to your data.
9. Retention and deletion
We apply the following retention rules, subject to applicable legal obligations and the need to establish, exercise or defend legal claims:
- Enquiries that do not lead to an engagement: deleted twelve months after the last contact, unless a specific legal reason requires longer retention.
- Relevant client and supplier correspondence and engagement records: retained during the engagement and normally for six years after its end. Records retained afterwards are restricted to retention, compliance and legal-claims purposes rather than routine operational use.
- Accounting, invoice and tax records: retained for the applicable statutory periods. Where the six-year commercial retention obligation applies, it is calculated from the relevant last accounting entry. Specific legal requirements or unresolved proceedings may require longer retention.
- Operational task records and photographs: retained while needed for the assignment and its documentation. Material that is no longer necessary is deleted; material required as part of the business record follows the applicable retention rule above.
- Messages without a continuing business or legal purpose: routinely deleted rather than retained as business archives.
- Website analytics: retained for up to three years. Technical website logs follow the purpose-based limits described in section 2.
Where Spanish law requires data to be blocked following rectification or erasure, it is restricted for the legally prescribed purposes and destroyed when the applicable period expires. Retention is not permission to reuse information for unrelated purposes.
10. Your rights
Subject to the conditions in applicable law, you may request access to your personal data, correction, erasure, restriction of processing and data portability. Where processing is based on consent, you may withdraw that consent without affecting the lawfulness of earlier processing.
Right to object: where we rely on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will assess the objection and stop the relevant processing unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims.
To exercise your rights, contact office@brunnhoff.com. We may request proportionate information to verify your identity. Where we cannot identify you within analytics records, we will explain any resulting limitation; we do not collect additional identification data solely to identify website visitors.
You may lodge a complaint with the Spanish Data Protection Agency, Agencia Española de Protección de Datos (AEPD), or another competent supervisory authority.
11. Providing information and data security
You decide what information to include in an initial enquiry. Certain information is necessary to respond, provide agreed services or issue a legally compliant invoice. If that information is not supplied, we may be unable to complete the relevant task.
We use technical and organisational measures appropriate to the information processed, including encrypted connections, access restrictions and protected storage. These measures reduce risk but cannot guarantee absolute security.
12. Changes and contact
We update this policy when our processing arrangements or applicable requirements change. The current version is available on this page.
For questions about this policy or the handling of your personal data, please contact us at office@brunnhoff.com.