Privacy policy

How this website currently works

The Holiday Villa Rita website currently acts as an informational presentation of the villa and its contact channels. There is no user account area, guest profile or on-site contact form that stores enquiry data directly through the website itself.

We do not currently use our own cookies or similar tools for analytics, marketing or personalisation. However, some third-party content loaded on the website, such as the Google Maps embed or remote Google Fonts, may trigger technical connections to external providers and those providers may process IP address, browser metadata, cookies or similar identifiers under their own rules.

• no user registration
• no newsletter or user profiles
• no first-party analytics or marketing tracking
• no enquiry form embedded on the website

Controller and contact details

The controller for data processing connected with this website and direct communication is KRISTINA BOBEK, personal identification number (OIB): 73959442535.

For privacy questions and data subject requests, contact us at [email protected], by phone at +385 98 937 0909, or by post at Franje Bužanića 14, 42204 Turčin, Croatia.

What data we process when you contact us

We only process personal data when you choose to send it to us through direct communication, for example by email, phone, WhatsApp, Facebook or Instagram.

That may include your name, email address, phone number, message content, preferred dates, number of guests and any other information needed to answer an enquiry, arrange a booking or prepare a stay.

• contact details you choose to share
• message content and enquiry details
• information needed for reservation handling and stay preparation
• data you voluntarily provide through your chosen communication channel

Purpose and legal basis

We use this information to respond to enquiries, manage communication, confirm or prepare bookings, organise stays and comply with legal obligations related to accommodation services.

The legal basis depends on the situation and will usually include steps taken at your request before entering into a contract, performance of a contract, legitimate interests in handling business communication and protecting operations, and legal compliance where applicable.

Technical delivery and infrastructure

The website relies on hosting and network infrastructure needed for publication, protection and technical delivery of content. This includes Cloudflare services for network delivery, security, logs and related technical functions, while the exact technical providers may vary from time to time depending on the active production environment.

Those providers may process necessary technical data such as IP address, access time, HTTP request details, response status and basic security logs solely for website delivery, abuse prevention, stability and system security.

We do not use that limited technical processing for visitor profiling or advertising, only to the extent required for availability, protection and operation of the website.

Third-party services, links and embedded content

The website currently uses a Google Maps location embed, remote Google Fonts, direct links to WhatsApp, Facebook and Instagram, and some remotely hosted editorial images from Unsplash.

At the time of this update, reservations are arranged directly, so Booking.com and Airbnb are not active booking channels on the website itself. If that changes, these legal pages will be updated.

If you open an external link or load embedded content, the relevant provider may process technical data under its own rules. We are not responsible for the content, availability or data-processing practices of Google Maps or other third-party services.

• Google Maps for the location map
• Google Fonts for typography delivery
• WhatsApp, Facebook and Instagram for communication or social profiles
• Unsplash for certain remotely hosted editorial images

International transfers and third countries

Some technical and communication providers we use or link to may process data outside the European Economic Area, especially global services such as Google, Meta platforms, WhatsApp, Cloudflare or Unsplash.

Where such services are used, any transfer relies on the transfer mechanisms offered by those providers, such as standard contractual clauses or another applicable legal basis, to the extent relevant in the specific case.

Retention, sharing and protection

Data received through direct communication is kept only for as long as needed to answer an enquiry, continue the communication and, where relevant, prepare or perform a booking. Data related to a confirmed stay, payment, guest records or other legal obligations may be kept longer where required by applicable law.

We do not sell personal data. Information may be shared only where necessary for technical website delivery, performance of a contract, legal compliance, protection of legal interests or where the communication and reservation process takes place through a third-party platform you chose yourself. Reasonable organisational and technical safeguards are applied, but internet communication can never be guaranteed as entirely risk-free.

Automated decision-making and profiling

We do not carry out automated individual decision-making or profiling under the GDPR based on data collected through this website.

Your rights and complaints

Subject to applicable law, you may request access to personal data, correction of inaccurate information, erasure, restriction of processing, objection to processing and, where relevant, data portability.

To exercise your rights, contact us using the published contact details. If you believe the processing does not comply with the law, you also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP).

• right of access and a copy of your data
• right to rectification and completion
• right to erasure where legally available
• right to restriction and objection
• right to withdraw consent where processing is based on consent
• right to complain to a supervisory authority