GDPR and automation go together from the moment a workflow touches a customer's name, phone number or booking, and in Mallorca almost everything worth automating touches them: booking confirmations at a hotel, appointment reminders at a clinic in Palma, charter quotes, buyer follow-up at an estate agency. This article explains how we approach it in every project so that your customers' data is handled sensibly and stays in Europe. What follows are technical and organisational decisions; the legal judgement on your specific case belongs to your lawyer or your data protection officer.
Start by processing less data
The first decision in any automation is which data it genuinely needs. The temptation when connecting systems is to pass "the whole customer record" from one place to another because it is more convenient. GDPR asks for the opposite, and it also simplifies the project.
Examples of how we apply it:
- An appointment reminder needs a first name, a time and a phone number. It does not need the clinical history.
- An arrival notice for a holiday apartment needs the name of the booking holder and the date. It does not need the passport number of every occupant.
- A daily sales report needs amounts and categories. It does not need to list customers by full name.
Every field that does not travel is a field that does not have to be protected, logged or deleted later.
Know where the data lives at every step
An automation is a chain: the data leaves one system, passes through a tool and enters another. For each link we ask which country the server is in and who the provider is. In practice:
- Google Workspace and Microsoft 365 allow you to choose a data storage region in Europe. It is worth checking that it is configured that way rather than left at the default.
- Our automations are installed on our own server within the EU; that is what we do by default, so the workflow and the data passing through it never leave Europe. Make offers EU hosting in its business plans.
- The language models that agents use can be run through providers with processing in Europe or, for sensitive cases, on a server of your own with open-source models. Choosing one or the other is a decision we take with the client according to the type of data.
- WhatsApp Business API belongs to Meta; messages pass through its infrastructure. It is a processing activity to be documented, with the official provider you use as intermediary.
The result of this exercise is a one-page diagram that says which data passes through where. We hand it to the client at the end of every project and it serves for the record of processing activities.
Your own tools versus cloud services
Many AI automation tools operate as a service in the United States. They can be used lawfully, but they require contractual clauses, transfer assessments and an ongoing follow-up that a 10-person business does not usually want to take on.
Our preference is to build with what you already have (your email, your Drive, your Holded, your booking software) and host the automation layer and the agents on European servers that we control or that the client controls. When an agent needs a language model, we use providers with processing in the EU or open-source models on our own server. This costs a little more configuration at the start and saves a great deal of paperwork later.
The data processor contract
If we, or any provider, access your customers' data to build or maintain an automation, we act as data processors and a contract is needed to govern it (Article 28 of GDPR). We sign it with every client before touching real data. What it must cover, in plain language:
- Which data we process and for what purpose.
- That we follow your instructions only.
- Which security measures we apply.
- Which sub-processors we use (the server provider, the AI model provider) and where they are.
- What happens to the data when the relationship ends.
Ask for this contract from any company that automates anything for you. If they do not know what you are talking about, that is a sign.
Consent and WhatsApp
WhatsApp is the channel with the greatest impact in Mallorca, and also the one that demands the most care. Rules we apply whenever we build workflows on the WhatsApp Business API:
- The customer has given their number for that purpose and knows it. A booking or an appointment implies they can receive confirmations and reminders about that booking or appointment; it does not imply they can receive offers.
- Promotional messages go separately and with explicit consent, with a clear way to opt out ("reply STOP").
- The agent does not import phone lists from other sources or write to anyone who has not initiated the relationship.
- Message templates are approved in Meta and kept documented.
Logs and deletion
Two things an automation does better than a person, if they are designed in from the start:
Logs. Every action by a workflow or an agent is recorded: which data it read, what it sent, to whom, when. That makes it possible to answer a customer who asks what you know about them and to demonstrate, if necessary, that the system did what it should. The logs are also kept in the EU and retained for a defined period, not forever.
Deletion. We agree with the client how long each piece of data is kept (for example, the conversations of a booking chatbot are deleted a set number of months after check-out) and the automation carries it out on its own. When a customer asks to be deleted, the process runs through every connected system, not only the first one.
Frequently asked questions
Can I use an AI agent with patient data or financial customer data?
Yes, with more care. Health data is a special category and requires a stronger legal basis, an impact assessment and serious technical measures. In those cases we work with models on our own server within the EU and limit what the agent sees to the minimum. Your data protection officer should be involved from the start.
Do I need consent to automate appointment reminders?
Normally the reminder is part of the service the customer has contracted and rests on that relationship, not on separate consent. What you do need is to inform them clearly (at the time of booking) that they will receive reminders and through which channel. Confirm this point with your lawyer for your specific case.
What happens to my data if I stop working with you?
The data processor contract establishes that we return or delete the data we have had access to, and that the accounts, the workflows and the servers remain in your name. We hand over the updated processing diagram and the credentials, and the automation keeps working without us.
If you want to know which of your business processes can be automated and how the data would stand at every step, we review it in our initial assessment (€1,500), which is deducted from the first project. Request an assessment
We implement it for you
We work at the leading edge of artificial intelligence and agents: we build on the most advanced agent platforms of the moment and we do it at your business, in Mallorca, with published prices and a person from your team approving anything that goes out. We start with an initial assessment and a written plan.