Privacy Policy

Last updated: 2 July 2026

1. Data Controller

The controller responsible for your personal data is:

• Apartments Grgić d.o.o. (Apartments Grgić društvo s ograničenom odgovornošću za pružanje usluga i ostalih vrsta smještaja)
• Registered seat: Hermanova ulica 1E, 10000 Zagreb, Croatia
• OIB (personal identification number): 74441802989
• Court registry number (MBS): 081600070, Commercial Court in Zagreb
• Email: apartmentsgrgic2@gmail.com or info@apartmentsgrgic.hr
• Phone: +385 91 9129 578 or +385 95 8202 402

For any question regarding this Policy or the processing of your personal data, please contact us using the details above.

2. What Data We Collect

2.1 Booking inquiry form

When you submit an inquiry through our booking form, we collect:

• Your name
• Your email address
• Requested check-in and check-out dates
• Number of guests
• Any additional information you choose to include in your message

2.2 Guest registration (eVisitor)

When you check in (or prior to arrival), we are legally required to collect mandatory information for the Croatian tourist information system (eVisitor): full name, gender, date of birth, citizenship, country and city of residence, and travel document type and number (identity card or passport). We collect this data only for confirmed bookings and forward it to eVisitor as required by law.

2.3 Data collected automatically

When you visit our website, certain technical data is processed automatically, including your IP address, browser type and version, device information, referring pages, and the date and time of your visit. This data is generated by our hosting provider's server logs and, subject to your consent, by our analytics tools (see Section 6).

3. Purposes and Legal Bases for Processing

• Responding to your inquiry and arranging a booking — legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Communicating with you about your reservation or questions — legal basis: our legitimate interest in responding to you and, where a booking is made, performance of a contract (Art. 6(1)(b) and 6(1)(f) GDPR).
• Legal obligations, including the mandatory registration of guests with the Croatian tourist information system (eVisitor) and the keeping of records required by tax and tourism legislation — legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Website analytics and statistics — legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Website security and integrity — legal basis: our legitimate interest in maintaining a secure website (Art. 6(1)(f) GDPR).

4. How We Use the Booking Form

The booking form on our website is used solely to send us your inquiry so that we can reply with availability and pricing. Submitting the form does not create a confirmed reservation. We use the information you provide only to respond to and administer your request. We do not use your contact details for marketing without your separate consent.

5. Recipients and Data Processors

We do not sell your personal data. We may share it with the following categories of recipients, only to the extent necessary:

• Hosting provider — stores the website and processes server logs on our behalf.
• Email provider — used to receive and reply to your inquiries.
• Property management and access-control providers — software tools and smart-lock infrastructure used strictly to generate secure access codes and manage check-in logistics based on your booking reference.
• Google (Google Ireland Limited / Google LLC) — provides website analytics (see Section 6), acting as our processor.
• Public authorities — such as the Croatian tourist board / eVisitor system and tax authorities, where required by law.

All processors act on our documented instructions under a data processing agreement, as required by Art. 28 GDPR.

6. Cookies and Google Analytics 4

Our website uses cookies and similar technologies. A cookie is a small text file stored on your device.

6.1 Essential cookies

These are necessary for the website to function and to remember your cookie preferences. They do not require consent.

6.2 Analytics cookies (Google Analytics 4)

Subject to your consent, we use Google Analytics 4, a web analytics service provided by Google, to understand how visitors use our website (for example, which pages are viewed and how visitors navigate the site). Google Analytics sets cookies and processes data such as your (truncated) IP address, device and browser information, and interaction events. IP anonymization is applied.

We only load Google Analytics after you give consent through our cookie banner. If you decline, no analytics cookies are set and no analytics data is collected. You can change your choice at any time by clearing your cookies or using the cookie settings link.

Google may process this data on servers located outside the European Economic Area. Where data is transferred internationally, it is protected by appropriate safeguards, including the European Commission's Standard Contractual Clauses. For more information see Google's Privacy Policy and Google Analytics Opt-out Browser Add-on.

7. Data Retention

• Booking inquiries and related correspondence are kept only for as long as necessary to handle your request and manage your stay.
• Inquiries that do not result in a booking are deleted once they are no longer needed, and no later than 12 months after our last contact.
• Accounting and tax records, such as invoices and issued receipts, are retained for 11 years, in accordance with the Croatian Accounting Act and applicable tax legislation.
• Guest registration data submitted to eVisitor is processed and retained in line with the rules of that system.
• Server logs are retained for a limited period for security purposes.
• Analytics data is retained according to the retention period configured in Google Analytics.

8. International Data Transfers

Where our service providers process data outside the European Economic Area, we ensure an adequate level of protection through appropriate safeguards under Chapter V of the GDPR, in particular the European Commission's Standard Contractual Clauses.

9. Your Rights

Under the GDPR, you have the right to:

• access your personal data and obtain a copy of it;
• request rectification of inaccurate or incomplete data;
• request erasure of your data ("right to be forgotten");
• request restriction of processing;
• object to processing based on our legitimate interests;
• data portability;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at apartmentsgrgic2@gmail.com or info@apartmentsgrgic.hr. We will respond within one month.

10. Right to Lodge a Complaint

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Croatian supervisory authority:

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website is served over an encrypted (HTTPS) connection.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the "Last updated" date shown at the top. We encourage you to review it periodically.