Privacy policy

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:
Iva Carić Kovačić
Klest 9a, Orešje
10434 Strmec Samoborski
Croatia
Email: deerhavencroatia@gmail.com · Phone: +385 91 390 0109

2. When you visit this website

Every time a page is opened, the web server automatically records your IP address, the date and time, the page or file requested, the status code and amount of data sent, the page you came from (referrer), and your browser and operating system (user agent).

We need this to deliver the website and to keep it stable and secure, for example to detect attacks. The legal basis is our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR). The log files, including error logs, are deleted automatically after 15 days at the latest. We do not use them to find out who you are.

3. Hosting

The website runs on a server that our web service provider operates for us, in a data centre of IONOS SE in Spain. The server is located in the EU. Both providers process the data only on our behalf.

4. Availability calendar

The calendar loads a list of booked dates from our own server. It is updated automatically from our reservation system and contains only dates, no guest data.

5. When you contact us

The contact form does not send anything through this website: it opens your own email program with the message prefilled. You can also write to us by email, call us or send a WhatsApp message.

We use what you send us (for example your name, email address, phone number, travel dates and message) to answer your enquiry and, if you book, to prepare your stay. The legal basis is Art. 6(1)(b) GDPR (steps before a contract and the contract itself); for general questions it is our legitimate interest in answering you (Art. 6(1)(f) GDPR).

Our mailbox is provided by Google (Gmail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google may also process data in the USA; Google LLC is certified under the EU–US Data Privacy Framework. If you write to us on WhatsApp, WhatsApp Ireland Limited processes the message under its own terms (WhatsApp privacy policy).

We delete enquiries once they have been dealt with, unless you book with us.

6. Bookings and your stay

We manage all bookings, whether they are made through our booking page, by email or through a booking portal such as Booking.com, in our reservation system Rentlio (Rentlio d.o.o., Zadar, Croatia), which processes the data on our behalf. If you book through a portal, we receive your booking details from that portal.

We use your booking data (for example name, contact details, travel dates, number of guests and price) to handle your booking and your stay (Art. 6(1)(b) GDPR).

Croatian law requires us to register every guest in the national eVisitor system within 24 hours of arrival (Art. 22 of the Tourist Tax Act, Zakon o turističkoj pristojbi). For this we need the details from your identity document (name, date and place of birth, nationality, type and number of the document, place of residence and address, sex) and your dates of arrival and departure. Without these details we cannot accommodate you. We also issue invoices and keep the tax records required by law. The legal basis for both is Art. 6(1)(c) GDPR.

The eVisitor data is received by the Croatian National Tourist Board and the local tourist boards. Other authorities, for example the police or the tax administration, receive data only where the law provides for it.

We keep invoices and tax records for as long as Croatian tax law requires, usually ten years. The Croatian National Tourist Board keeps eVisitor data for ten years. We delete the other booking data once your stay has been fully dealt with and we no longer need it for possible claims.

7. Links to other websites

Links to Instagram and Facebook (Meta Platforms Ireland Limited), WhatsApp, Google Maps, the Gorski kotar tourist board and our web designer only open when you click them. That website then receives your IP address and browser details, as with any visit, and the information that you came from our site. From that point on, the privacy policy of that website applies.

8. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18) and to receive it in a portable format (Art. 20). A short email to us is enough.

Right to object: where we process your data on the basis of our legitimate interest (sections 2 and 5), you can object to this at any time for reasons arising from your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a supervisory authority. In Croatia this is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop.hr. You can also contact the authority in the EU country where you live.

9. Other

You do not have to give us any data to visit this website or to ask a question, but without your contact details we cannot answer. For a stay, the identity details listed in section 6 are required by law. We do not use automated decision-making or profiling. If this website changes, we will update this policy.