Imanje Brodara TomeLegal
Privacy policy
How we handle the details you give us when you ask about dates or write to us.
Last updated: 28 October 2026
This English text is a translation for your convenience. Only the Croatian version is legally binding.
This policy explains what personal data we collect when you send us a booking request or contact us, why we collect it, who we pass it on to, how long we keep it and what rights you have.
We act in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, 'GDPR') and the Croatian Act implementing the GDPR.
1. Who processes your data
The data controller is Matija Dvorneković, OIB (Croatian personal ID number) 18855356068, Kolodvorska 33, Velika Gorica, host of the holiday home Imanje Brodara Tome.
For any question about how your data is processed, write to [email protected] or call +385 98 934 2058.
We have not appointed a data protection officer, because the conditions in Article 37 GDPR are not met.
2. What data we collect
| Data | When we receive it |
|---|---|
| Full name, email address, phone number, dates of stay, number of guests and the content of your message | When you send a booking request through the form on this website |
| The content of your messages and our replies | When you write to us by email or message |
| IP address, time of the request, browser type and page address | Automatically, in the server logs, for security and to detect misuse |
| Full name, date of birth, sex, nationality, type and number of identity document, place of residence, dates of arrival and departure | On arrival, for all guests, because of the legal obligation to register guests in the eVisitor system |
We do not ask for or collect special categories of data, such as data about health or religious or political beliefs. We do not make automated decisions and do not carry out profiling.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Checking dates, answering your request and arranging your stay | Steps taken at your request before entering into a contract, Article 6(1)(b) GDPR |
| Carrying out the agreed stay and communicating with you during it | Performance of a contract, Article 6(1)(b) GDPR |
| Registering guests in the eVisitor system and calculating the tourist tax | Legal obligation, Article 6(1)(c) GDPR |
| Issuing receipts and keeping business accounts | Legal obligation, Article 6(1)(c) GDPR |
| Protecting the website from spam, misuse and attacks | Our legitimate interest, Article 6(1)(f) GDPR |
| Measuring visits and showing the map with our location | Your consent, Article 6(1)(a) GDPR |
We need the data from the form to be able to answer your request at all. If you don't provide it, we cannot process the request.
4. Who we pass data on to
Some of the processing is done by service providers who work on our instructions and with whom we have a processing agreement under Article 28 GDPR:
| Provider | What it does |
|---|---|
| Railway Corporation | The server the website and the database run on |
| Resend (Plus Five Five, Inc.) | Sending emails about your request, confirmation and reminder |
| Cloudflare, Inc. | Delivering the website, protecting it from attacks and measuring visits |
| Google Ireland Limited | Measuring visits (Google Analytics) and ads (Google Ads), only with your consent |
Because the law requires it, we also pass data to the tourist board through the eVisitor system, to the competent tax authorities and, if we engage one, to an accounting service that keeps the record of transactions.
If you booked through Booking.com or Airbnb, that platform is a separate data controller for the data you gave it and applies its own privacy policy.
We do not sell personal data or pass it to third parties for their marketing.
5. Transfers outside the European Economic Area
Some of the providers listed above are based in the United States. When data is transferred outside the European Economic Area, the transfer is based on the European Commission's standard contractual clauses or on a Commission adequacy decision. On request we can give you more information about the safeguards applied.
6. How long we keep data
| Data | Retention period |
|---|---|
| Requests that did not lead to a stay, or were declined | 12 months from the last message |
| Receipts and accounting records | 11 years from the end of the financial year |
| Guest list and data from identity documents | 2 years |
| Server logs | No more than 30 days |
| Data registered in the eVisitor system | According to that system's rules, which we have no control over |
When the period ends, we delete the data or anonymise it permanently.
7. Cookies
The website sets the necessary cookies it cannot work without, and anything else only after you consent. The list of cookies, how long they last and how to withdraw your consent are on the Cookies page.
8. Your rights
With regard to your data, you have the right to:
- ask for access to your data and a copy of what we hold about you
- ask for inaccurate data to be corrected or incomplete data to be completed
- ask for erasure, except where the law requires us to keep the data
- ask for processing to be restricted
- ask for your data to be transferred to another controller, in a machine-readable format
- object to processing based on our legitimate interest
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before then
Send your request to [email protected]. We reply within one month of receiving it at the latest. If the request is complex, this period can be extended by up to two months, and we will let you know within the first month.
9. Complaints to the supervisory authority
If you believe we are processing your data in breach of the law, you can lodge a complaint with the supervisory authority:
Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, 10000 Zagreb, Croatia
[email protected]
azop.hr
10. Data security
The website works only over an encrypted connection (HTTPS). Only the host can access data about requests and bookings, through a password-protected interface. Passwords are not stored in readable form. Traffic to the website passes through protection against attacks and spam.
11. Data about children
Booking requests are sent by an adult. We process data about children only as far as needed for the stay and for registering guests, based on the data a parent or guardian gives us.
12. Changes to this policy
We may change this policy when the way the website works or the law changes. The date of the last change is shown at the top. We point out significant changes on this page.