Privacy Policy

1. Data Controller

The Data Controller is responsible for the protection of personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/18).

2. What Personal Data We Collect

We only process the personal data you voluntarily provide to us when you contact us via:

• Email
• Telephone
• Booking form on this website

This may include:

• Your name
• Contact information (email or phone)
• Check-in and check-out dates
• Number of guests
• Information related to your inquiry or reservation (special requests, pet information, etc.)

3. Purpose of Processing

We use your personal data solely for:

• Responding to your inquiry
• Communication regarding reservations
• Fulfilling legal obligations for accommodation providers in Croatia (eVisitor, invoicing, and similar requirements)

We do not use your data for newsletters, marketing, or profiling.

4. Legal Basis for Processing

The processing of your personal data is based on:

• Art. 6(1)(b) GDPR – performance of a contract or steps prior to entering into a contract (reservation)
• Art. 6(1)(c) GDPR – compliance with legal obligations in the Republic of Croatia
• Art. 6(1)(a) GDPR – consent (when you voluntarily contact us)

5. Third-Party Services

5.1 EmailJS

We use EmailJS (EmailJS Ltd., UK) to process booking form submissions. When you submit a booking request through our website, your data is transmitted via EmailJS to our email address. EmailJS acts as a data processor and processes your data only according to our instructions.

EmailJS stores your data temporarily to deliver the email. Data is processed within the European Union and in compliance with GDPR.

For more information, see EmailJS Privacy Policy: emailjs.com/legal/privacy-policy

5.2 Calendar Synchronization (Airbnb & Booking.com)

To display real-time availability on our website, we automatically synchronize occupancy information from our Airbnb and Booking.com listings via iCal feeds. These feeds only contain blocked dates (when the apartment is unavailable) and do not include any personal information about guests.

The calendar sync is one-directional: we only retrieve availability data. No personal data from our website is sent to Airbnb or Booking.com through this feature.

If direct retrieval is technically unavailable, we occasionally use an intermediary relay service (e.g. corsproxy.io or allorigins.win) to load the availability data only. No data about our website visitors is transmitted in this process either.

5.3 Booking Request Storage

When you send a request through our booking form, your details are delivered to us by email and also stored in a secured database on our own server (Hostinger) so that we can process and manage the request. Access to this data is limited exclusively to us as the operator, through a password-protected administration area. We keep your request only as long as necessary to process it and carry out a possible stay; if no booking results, the request is deleted after twelve months at the latest, subject to any statutory retention obligations. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract).

6. Data Storage and Sharing

Your data is stored and processed only within the European Union.

Data may be shared with:

• EmailJS (for processing booking form submissions)
• eVisitor (mandatory system for guest registration in Croatia)
• Accounting services (if applicable)
• Croatian tax authorities (when legally required)

We do not share your data with third parties not required for lawful processing.

7. Data Retention

Data obtained through inquiries is retained for:

• Up to 12 months for communication and offers
• As required by Croatian tourism laws (eVisitor records)
• As required by Croatian tax regulations (usually 11 years for invoices)

8. Your Rights

You have the right to:

• Access your personal data
• Rectify incorrect information
• Request deletion (unless retention is legally required)
• Restrict processing
• Object to processing
• Request data portability

To exercise your rights, contact us via email.

9. Cookies and Local Storage

For visitors to our website, we do not use any tracking, advertising, or analytics cookies, and we do not track your behaviour across visits.

Only two technically necessary exceptions apply: if you dismiss our privacy notice with "Got it", your browser remembers this via local storage (localStorage) so the notice does not reappear. In addition, the password-protected administration area, used exclusively by us as the operator, uses a technically necessary session cookie. Neither is used for tracking and neither is relevant to ordinary visitors.

10. Data Security

We take all necessary technical and organizational measures to protect your personal data in accordance with the GDPR and Croatian legislation.

11. Supervisory Authority

If you believe your rights have been violated, you may file a complaint with AZOP.

12. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us at: