Last Updated: February 2026
PURPOSE OF THIS POLICY
This privacy policy outlines the personal data we collect from you, the reasons for collecting it, and how we intend to use it. It also highlights some of the key rights you have under data protection laws. Your personal data is safeguarded by the EU General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka). Throughout this privacy policy, we refer to these regulations as data protection laws.
We will only process your personal data in accordance with our privacy policy, any notifications or agreements made with you, or as permitted by data protection laws.
Our Role
In relation to data protection laws, we, Adriatica Collective d.o.o., are a data controller in respect of the personal data you provide us with.
Data Controller:
Adriatica Collective d.o.o.
Kapucinski trg 5
42000 Varaždin
Croatia
OIB: HR81362615815
Email: [email protected]
Phone: +385 98 928 0582
DEFINITIONS
When we refer to "personal data", we are referring to any information that pertains to an identified or identifiable individual.
When we refer to processing personal data, this "processing" encompasses all actions we may take with your personal data, including but not limited to collecting, storing, using, disclosing to third parties, and erasing it.
WHICH PERSONAL DATA WE COLLECT
We collect personal information from and about you whenever you interact with our services or contact us in any way, whether directly or indirectly. For instance, you might make a booking or enquiry through a travel agent, or share personal details with a third party involved in your travel arrangements, such as a local service provider in Croatia. We may also gather information from publicly available sources (for example, public records) to help us better understand our clients for internal marketing purposes.
Examples of the personal data we may collect include, but are not limited to:
- Names of all travellers
- Contact details (such as phone number, postal address, and email) for the person making the booking
- Details of any medical conditions, disabilities, or reduced mobility that may affect travellers – this falls under special categories of personal data (see below)
- Information about your group, including ages, dates of birth, genders, nationalities, and passport details
- Next-of-kin details
- Dietary requirements
- Records of our communications with you
- Copies of identification documents, such as passports or driving licences
- Feedback about our services, including any received from third parties
- CCTV footage used for property security purposes
- Payment and transaction information
For a simple enquiry, we typically need to process only the name and contact details of the person making it.
Legal Basis for Processing
When processing a booking or enquiry, we handle your personal data (excluding any special category data – see below) on the basis that it is necessary to fulfil our contract with you, or to take steps at your request before entering into a contract. We may also process it to comply with legal obligations or to protect your vital interests (for example, in an emergency).
SPECIAL CATEGORIES OF PERSONAL DATA
Personal data relating to your health, racial or ethnic origin, religious beliefs, or sexual orientation falls under special categories of personal data. While other information may also fall under special categories, it is typically unrelated to the booking and provision of travel arrangements.
Processing special categories of personal data generally requires your explicit consent.
Therefore, details regarding any disabilities, medical conditions, mobility restrictions, or other health-related issues that may impact your travel arrangements (and associated needs), as well as dietary restrictions that reveal religious beliefs or health concerns, are considered special categories of personal data. We will request your consent to process this information when you make your booking or inquiry.
SHARING YOUR PERSONAL DATA WITH THIRD PARTIES
When you make a booking, we will share the necessary personal data with the relevant suppliers involved in your chosen arrangements (such as property owners, caretakers, experience providers, chefs, car rental companies, restaurants, activity providers, boat operators, etc.), as well as any other third parties (for example, banks or credit card providers) who require this information to facilitate your holiday.
This information may also be disclosed to government or public authorities, such as customs, immigration, or tax authorities, if they require it or if mandated by law. Certain details may additionally be shared with security or credit reference agencies.
We may also provide personal data to companies or individuals that perform services on our behalf, such as:
- Marketing agencies
- Website hosting providers
- Payment processing services
- Customer relationship management systems
- Email service providers
We only share with third parties the personal data that is essential for them to fulfil their roles. Except in the case of government or public authorities (over which we have no control), we take appropriate measures to ensure that any recipient of your personal data agrees to keep it secure, uses it solely for the purpose of delivering their services, and does not collect additional personal data from you while providing those services.
SMS Marketing Data Protection
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
This means that if you have opted in to receive SMS messages from us, your phone number and consent details will not be used for any other purpose or shared with any third party. We only use this information to deliver the messages you have agreed to receive.
WHERE YOUR PERSONAL DATA WILL BE PROCESSED
Your personal data may undergo processing within Croatia and/or any other country(ies) within the European Economic Area (EEA). The EEA comprises all member states of the European Union, along with Norway, Iceland, and Liechtenstein.
Additionally, we may process personal data outside the EEA in limited circumstances. It's important to note that data protection laws outside the EEA may not be as stringent as those within the EEA. Personal data will not be transferred to a country outside the EEA unless one of the following conditions is met:
- The European Commission deems the country to provide an adequate level of data protection
- The personal data is transferred to a company that is contractually obligated to handle the data in line with our instructions and to maintain appropriate security measures, as we deem satisfactory
- We are compelled to provide the personal data to a government/public authority to facilitate your holiday arrangements
PROTECTION OF YOUR PERSONAL DATA
We implement appropriate technical and organisational safeguards to prevent unauthorised or unlawful processing of personal data, as well as accidental loss, destruction, or damage to it. These measures are commensurate with the potential harm resulting from such unauthorised or unlawful processing or accidental loss, destruction, or damage, considering the nature of the data to be protected. We also take into account the state of technological advancements and the expenses associated with implementing these measures.
Our security measures include:
- Encryption of sensitive data
- Secure server infrastructure
- Regular security audits and updates
- Access controls and authentication procedures
- Employee training on data protection
- Confidentiality agreements with all staff and contractors
USING AND RETAINING YOUR PERSONAL DATA
We will retain and use your personal data for marketing purposes only where you have explicitly consented to this, or (in the case of email marketing) where we are permitted to do so under the Croatian Electronic Communications Act and the GDPR.
Email Marketing
Under Croatian law and the GDPR, we may send you marketing emails if you have previously shared your email address with us during the process of booking a holiday or during related negotiations, and the marketing relates to similar services or products we offer (soft opt-in). You will always have the option to opt out of receiving such emails: this will be provided when you first give us your email address and in every marketing email we send.
Other Marketing Communications
You can give your consent to receive marketing materials online, by telephone, or via text message. For text message marketing, we require your explicit consent, and you will be given the opportunity to opt out when you first provide your phone number and in every marketing SMS (simply reply STOP). You are also free to specify your preferred communication channels.
WITHDRAWING CONSENT
You have the option to withdraw your consent for receiving marketing material or other communications from us, whether in general or via specific channels, at any time. You can do so by:
- Emailing us at [email protected]
- Calling us at +385 98 928 0582
- Clicking the unsubscribe link in any marketing email
- Replying STOP to any marketing SMS
YOUR RIGHTS UNDER DATA PROTECTION LAWS
Under the GDPR and Croatian data protection laws, you have the following rights:
Right of Access
You have the right to request (by letter or email) details of the personal data we hold or process about you, including the purposes of processing and any recipients or categories of recipients to whom it may have been disclosed. We will not charge a fee for responding to such a request unless it is manifestly unfounded, excessive, or repetitive. We will respond promptly and in any case within one month, though this period may be extended by up to two further months if the request is complex or we receive multiple requests from you.
Right to Rectification
If you believe any of your personal data is incorrect, outdated, or incomplete, please inform us by email as soon as possible. We will correct it within one month, or within three months if the request is particularly complex.
Right to Erasure ("Right to be Forgotten")
In certain circumstances, you can ask us to erase your personal data – for example, if you withdraw consent to marketing and the data was processed solely for that purpose. However, this right is not absolute. Please refer to the section below for details on our standard retention periods.
Right to Restriction of Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object
You have the right to object to processing of your personal data for direct marketing purposes at any time.
DURATION OF RETAINING DATA
We will retain your personal data in an identifiable form only for as long as necessary to fulfil the original purpose for which it was collected or for any other legitimate business needs.
For data provided in connection with holiday bookings or other contracted services, we may keep it for up to 6 years after the completion of those arrangements. This retention period is necessary for:
- Legal and accounting requirements
- Handling any disputes or claims
- Tax obligations
- Compliance with Croatian commercial law
In certain limited cases, a longer retention period may apply where required by law.
If you have consented to marketing communications, we may continue using your data for that purpose until you withdraw consent or until we reasonably determine that your consent is no longer valid.
WEBSITE COOKIES
Like most websites, ours uses cookies. A cookie is a small data file placed on your device by our server to collect information about your visit and to recognise you on future visits. Cookies help us identify users and personalise your experience by tailoring content to your preferences.
Types of Cookies We Use
- Essential Cookies: Necessary for the website to function properly
- Performance Cookies: Help us understand how visitors interact with our website
- Functionality Cookies: Remember your preferences and choices
- Marketing Cookies: Track your browsing habits to deliver relevant advertising
We may also work with third-party providers who collect non-personally identifiable data to analyse site traffic and perform similar functions. These providers may set their own cookies to gather information about your visit.
You can disable or delete cookies via your browser settings if you prefer. However, this may prevent access to certain parts of the site, reduce functionality, or mean you miss out on content relevant to your interests.
If you have visited our website, we may display advertisements for our services on other websites, apps, or social media platforms based on your browsing activity.
CHILDREN'S PRIVACY
In accordance with Croatian implementation of the GDPR, we do not knowingly collect personal data from children under the age of 16 without parental consent. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information.
UPDATES TO THIS POLICY
We may update this privacy policy from time to time. Changes could be necessary due to developments in data protection legislation, guidance from regulators such as the Croatian Personal Data Protection Agency (AZOP), or updates to our internal procedures.
When we make significant changes, we will notify you by posting the updated policy on our website with a new "Last Updated" date. We encourage you to review this policy periodically.
COMPLAINTS AND SUPERVISORY AUTHORITY
If you are unhappy with any aspect of our processing of your personal data, please contact us by email at [email protected] or by phone at +385 98 928 0582. We will investigate and respond as quickly as possible.
If you remain dissatisfied, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka - AZOP).
Croatian Personal Data Protection Agency (AZOP):
Selska cesta 136
10000 Zagreb
Croatia
Website: www.azop.hr
Email: [email protected]
Phone: +385 1 4609 000
CONTACT US
If you have any questions about this privacy policy or how we handle your personal data, please contact us:
Adriatica Collective d.o.o.
Kapucinski trg 5
42000 Varaždin
Croatia
Email: [email protected]
Phone: +385 98 928 0582
Website: www.croatia-vacations.com