Your data, handled with care.

The data controller is LOTUS Ibiza (hereinafter, "LOTUS", "we", "us"), based at Avenida 8 de Agosto 32, Puerta 2, 07800 Eivissa, Illes Balears, Spain.

Contact for data protection matters: hello@lotusibiza.com.

• Contact form data: name, email address, subject and message content you voluntarily submit.
• Email correspondence: any information contained in messages you send us.
• Technical data: IP address, browser type, device, pages visited, referring URL, and timestamps, collected automatically through server logs and cookies (see our Cookies Policy).

• Respond to your enquiries — legal basis: your consent and pre-contractual measures (Art. 6.1.a and 6.1.b GDPR).
• Manage commercial relationships with artists, brands, collectors and partners — legal basis: contract performance (Art. 6.1.b GDPR).
• Comply with legal obligations (tax, accounting, anti-money-laundering where applicable) — Art. 6.1.c GDPR.
• Site security and analytics — legal basis: legitimate interest (Art. 6.1.f GDPR), balanced against your rights.
• Marketing communications (only if you have explicitly opted in) — Art. 6.1.a GDPR; you may withdraw consent at any time.

We keep your data only for as long as necessary to fulfil the purposes for which it was collected, and afterwards for the period required by Spanish law (typically 6 years for accounting records, 5 years for contractual matters). Enquiry data is deleted within 24 months of the last contact unless a relationship is ongoing.

We do not sell your data. We may share data with:

• Hosting, email and analytics providers acting as data processors under written agreement.
• Public authorities where required by law.

Where providers are located outside the European Economic Area, transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision.

Under the GDPR you have the right to:

• Access, rectify or erase your personal data.
• Restrict or object to processing.
• Request data portability.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — www.aepd.es).

To exercise any of these rights, write to hello@lotusibiza.com with proof of identity. We will respond within one month.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction, in accordance with Art. 32 GDPR.

Our services are not directed at persons under 14. We do not knowingly collect data from minors without the consent of their legal guardians.

We may update this policy to reflect legal or operational changes. The current version will always be available at this URL with its update date.