Last Updated: April 27, 2026
Privacy Policy
This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Croatian law.
1. Data Controller
The Data Controller responsible for the processing of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), as well as the Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/18), is: DVIJE SUZE ROŠKI SLAP J.D.O.O., Zagrebačka ulica 48, 49243 Oroslavje, OIB: 13346448063, email: dvijesuze.roskislap@gmail.com, phone: +385 98 425 717 (hereinafter: the Data Controller or "we").
2. What Personal Data We Collect and For What Purposes
2.1. Contact form communication
When you contact us via the contact form available on the website, we collect and process the following categories: name and surname, email address, phone number (only if voluntarily provided), and the content of the inquiry. This personal data is processed solely for the purpose of responding to your inquiry and is not used for any other purposes nor shared with third parties without a legal basis. The legal basis is the legitimate interest of the Data Controller under Article 6(1)(f) GDPR.
2.2. Accommodation reservations
As an accommodation service provider, we collect and process guests' personal data during the accommodation reservation process via the Rentlio system: name and surname, email address, phone number, and payment details. For check-in purposes, identification data from an ID card or passport is also processed, including: name and surname, document number, date of birth, nationality, and residence address. The legal basis is the performance of the accommodation reservation contract (Article 6(1)(b) GDPR) and compliance with the legal obligation to register tourists in the national eVisitor system (Article 6(1)(c) GDPR).
2.3. Other processing of personal data
If we process personal data for purposes not listed above, such processing will only take place on the basis of one of the lawful grounds defined in Article 6(1) GDPR, including: performance of a contract, compliance with a legal obligation, protection of vital interests, public interest tasks, legitimate interest, or your explicit consent. We do not process personal data for purposes that are incompatible with the original purpose of collection. If a new purpose requires a different legal basis, we will inform you in advance in accordance with Articles 13 and 14 GDPR.
3. Data Retention
We retain personal data only for as long as necessary to fulfill the purpose for which it was collected or as required by applicable law. Once the purpose of processing no longer exists or the legally required retention period expires, personal data will be permanently deleted. In certain cases, data may be retained for a longer period if necessary for legal proceedings or the establishment, exercise, or defense of legal claims, in accordance with Article 17(3)(e) GDPR.
4. Sharing Personal Data with Third Parties
We do not share personal data with third parties unless necessary and in compliance with the GDPR. Personal data is never sold, rented, or used for commercial distribution. Personal data may be shared with the following recipients when necessary: Rentlio — reservation system provider and data processor, on the basis of an agreement concluded under Article 28 GDPR; payment service providers (WSPay, Stripe, or other authorized providers) — data processors handling payment transactions on the basis of an agreement under Article 28 GDPR; eVisitor (Ministry of Tourism and Sports of the Republic of Croatia) — the authority to which guest data is transmitted solely for the purpose of fulfilling the legal obligation of tourist registration.
5. Your Rights
Under the GDPR, you have the following rights regarding your personal data: right of access (Article 15 GDPR) — to obtain confirmation that we process your personal data and access to those data and information about the processing; right to rectification (Article 16 GDPR) — to correct inaccurate or incomplete data; right to erasure, "right to be forgotten" (Article 17 GDPR) — to request deletion when data is no longer necessary, except where processing is required to comply with a legal obligation or for the establishment, exercise, or defense of legal claims; right to restriction of processing (Article 18 GDPR); right to data portability (Article 20 GDPR) — to receive your data in a structured, commonly used, and machine-readable format; right to object (Article 21 GDPR) to processing based on legitimate interest. Requests related to your personal data may be sent to dvijesuze.roskislap@gmail.com. We will respond within the legally required timeframe.
6. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, if you believe that the processing of your personal data has been carried out in breach of the GDPR, you have the right to lodge a complaint with the competent supervisory authority: Agency for Personal Data Protection (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, www.azop.hr, azop@azop.hr, +385 1 4609 000.
7. Cookies
Our website uses cookies to ensure proper technical functionality of the website and to improve user experience. Functional cookies are technically necessary for the proper functioning of the Rentlio reservation system; without them, the reservation process cannot be carried out.
8. Contact
If you have any questions, comments, or requests regarding the processing of your personal data, please contact us in writing at: dvijesuze.roskislap@gmail.com.