Effective date: July 17, 2026
1. Data controller
Sándor Tóth
Obala 34, 51511 Malinska, Croatia
Email: obala.apartments@gmail.com
2. Data we process
Depending on how you use the website, we may process the following categories of data:
- Website and security data: IP address, date and time of access, requested page, browser, device and operating-system information, and technical logs needed to deliver and protect the website.
- Analytics data, only after consent: cookie identifiers, page views, sessions, approximate location, and browser and device information collected through Google Analytics.
- Cookie-consent data: consent ID, consent status, date and time, and proof of consent recorded by CookieYes.
- Contact and booking data: your name, email address, the content of your message, requested dates, number of guests, and other details you choose to provide when contacting us or arranging a stay.
- Map data: Google Maps is loaded only after you click the “Load Google Map” button. When loaded, Google may receive your IP address and browser/device information.
We do not knowingly collect special-category data, sell personal data, or use personal data for targeted advertising.
3. Purposes and legal bases
- Operating and securing the website: our legitimate interest in providing a reliable and secure website and preventing misuse.
- Responding to enquiries and arranging bookings: steps taken at your request before entering into a contract and performance of the accommodation contract.
- Google Analytics: your consent. Analytics remains disabled if you reject non-essential cookies.
- Recording cookie choices: compliance with legal obligations and our legitimate interest in demonstrating and respecting your consent choices.
- Legal and administrative records: compliance with applicable accommodation, tax, accounting and other legal obligations, and the establishment, exercise or defence of legal claims.
4. Service providers and recipients
We use service providers that may process data on our behalf:
- Netlify — website hosting, delivery and security logs.
- Google — Google Analytics after consent, Google Maps after you choose to load it, and Gmail for email correspondence.
- CookieYes — cookie-banner operation and consent records.
The website also links to Booking.com. If you follow that link or make a booking there, Booking.com processes your data under its own privacy policy as an independent controller.
5. International transfers
Some service providers operate globally, so personal data may be processed outside the European Economic Area. Where required, transfers are covered by an adequacy decision, the EU–US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses.
6. Retention
- Google Analytics user-level and event-level data is retained for no longer than the period configured in Analytics, up to 14 months.
- Cookie consent records are retained for as long as reasonably necessary to demonstrate and manage consent, subject to the CookieYes account and retention settings.
- Unsuccessful enquiry correspondence is normally retained for up to 12 months.
- Booking correspondence and legally required accommodation, tax or accounting records are retained for the period required by applicable law and for as long as reasonably necessary to handle disputes or legal claims.
- Technical hosting and security logs are retained according to the hosting provider’s security and service-retention settings.
7. Your rights
Subject to the conditions of the GDPR, you may request access to, correction or deletion of your data; restriction of processing; data portability; or object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing carried out before withdrawal.
You can change your cookie preferences at any time using the cookie-settings icon displayed on the website. To exercise other rights, contact obala.apartments@gmail.com.
You also have the right to lodge a complaint with a competent data-protection supervisory authority, including the Croatian Personal Data Protection Agency (AZOP), or the authority in the EU/EEA country where you live or work.
8. Automated decision-making and children
We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects. The website is not directed at children under 16, and we do not knowingly collect their personal data.
9. External links
This website may contain links to third-party services. Their processing is governed by their own privacy policies. We recommend reviewing those policies before submitting personal data.
10. Changes
We may update this Privacy Policy when the website, service providers or legal requirements change. The effective date shown above indicates the latest version.
For information about cookies, see our Cookie Policy.