1 Introduction

We are ADDL KAŠTELA Ltd., Đorđićeva 11, Zagreb, Personal Identity Number: 79026352500 (hereinafter: ADDL).

Under this Notice we would like to inform you on categories of personal data that we process and the rights you have with respect to their processing.

We collect and process personal data directly or through data processors. Key importance for our work has the data processor Marko Jurić, owner of DOMO, craft for services, Zvonimirova 75, Solin, Personal Identity Number: 28089972162, providing the overall operational support in rental of ADDL accommodation units. We also cooperate with other data processors who provide IT, accountancy and other services that are essential for our secure and lawful business operations.

2 Definitions important for you

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Data Controller means any legal entity which determines the purposes and means of the processing of personal data.

Data Processor means any legal entity which processes personal data on behalf of the data controller.

Data Protection Regulation means any personal data privacy regulation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), applicable to the processing of personal data.

Data Subject means any natural person who is directly or indirectly identifiable through the processing of personal data.

Personal Data means any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to name, identification number or other factors specific for that natural person.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3 Collecting and processing of your personal data

3.1 In relation to your stay in our objects

Your personal data are primarily collected in the moment you make a reservation of your accommodation in our objects. We enable you to make a reservation through booking service providers (e.g. Booking or Airbnb), thought our website or in direct contact with us.

When you make the reservation, the following personal data are collected: name and surname, country, e-mail, bank card and accommodation period. For the purpose of further execution of the accommodation agreeing relation, when you arrive to our object we collected further data related to your residence address and/or personal identity number.

We receive your personal data from booking service providers or directly from you personally, and we further on process them for the purpose of executing the contract on your accommodation in our objects. The collection of aforenoted personal data is a condition of your accommodation and their non-delivery entitles us to deprive you from our service. Personal data are processed until the end of your stay in our objects and fulfilment of related contractual obligations, or until cancelation of your reservation and fulfilment of related contractual obligations.

We may also process the collected data in order to comply with statutory obligations, including with decisions of public authorities binding us pursuant to law. In the latter case, personal data can be made available to public authorities and are stored pursuant to prescribed terms.

When you arrive to our object you will need to provide us with additional personal data.

We will kindly ask you to enable us to collect data from your identification document. We collect the following data: name and surname, place, country and date of birth, citizenship, type and number of the identification document, place of residence (temporary residence) and address, sex. We are also registering the date and time of your check-in and check-out and the eventual basis for exemption from paying the sojourn tax, i.e. for the reduction of the sojourn tax payment. The collection of these data is a condition for usage of our accommodation service.

It is our obligation to insert the noted personal data in the system of the recipient Croatian Tourist Board, information system eVisitor, through which these data are further processed from our side, as the accommodation service provider, the tourist boards and public authorities of the Republic of Croatia, based on following regulations and for following purposes:

1. monitoring the implementation of our obligation of registering visitor check-in and check-out pursuant to the Sojourn Tax Act and the Ordinance on the manner of keeping visitor registers and the form and content of the form of registration of visitors with the tourist board;
2. records, calculations and collection of sojourn tax pursuant to the Sojourn Tax Act and the Customs Services Act;
3. keeping a register or list of guests by us as the accommodation service provider and monitoring the implementation of the said obligation by the inspection authorities pursuant to the Hospitality and Catering Industry Act and Tourist Inspection Act;
4. registration of foreigners in the Ministry of the Interior and the monitoring of the implementation of the said obligation by the inspection authority pursuant to the Foreigners Act and Act on Police Affairs and Authorities;
5. keeping records of tourists by tourist boards and statistical processing and reporting pursuant to the Sojourn Tax Act and the Act on Tourist Boards and Promotion of Croatian Tourism;
6. supervision of business of accommodation service providers in the part related to the legality of providing registered services and compliance with taxation and other regulations on public contributions pursuant to the Customs Services Act, the General Tax Act and the Act on the Inspection of Road Transport and Roads.

Pursuant to the Ordinance on the manner of keeping visitor registers and the form and content of the form of registration of visitors with the tourist board, personal data are stored for the period of 10 years, while statistical analysis and information are stored permanently.

Pursuant to the noted Ordinance, information regarding the check-in and check-out of visitors is entered based on information listed in the identity card, that is, some other travel or other identity document. Therefore, you are obliged to present us such a document and provide any other information required for the data entry, not contained in such a document.

Furthermore, please be informed that our objects are under video surveillance due to our legitimate interest to secure protection of assets and persons located in the object. By accessing them, you agree to collection of your personal data under video surveillance. Otherwise, we are entitled to deny you further access to the objects.

The video surveillance covers common premises and outdoor areas of the objects. Collected data upon request can be made available to the Ministry of Interior or other public authorities based on whose mandate we are obliged to act pursuant to the law. Data are retained for a period of one month, except a longer term of their retention is imposed by law or collected data are used as proof in court, administrative, arbitration or other similar procedure. Data cannot be processed contrary to the purpose of their collection.

3.2 In relation to our mutual communication necessary for providing information

You have the possibility to contact us by telephone, post, e-mail or website. When we start our communication, you deliver to us data related to you name and surname and e-mail, telephone number or post address. We can process the received data only during the communication, what means until the moment you decide to end the communication or until the purpose of the communication has been fulfilled. The latter considers that we have delivered to you the requested information and that you brought the related decision, wherefore no further mutual communication is necessary. By delivering the aforenoted personal data to us, you give consent for their processing for the indicated purpose.

If you would like us to continuously inform you on ADDL group accommodation offers and news, you have the possibility to give us consent on processing of your personal data for the purpose of marketing, for which purpose you deliver to us data on your e-mail address. ADDL group consists of us and ADDL KAŠTELA Ltd., Trg Petra Svačića 6, Zagreb, OIB: 79026352500. In case of your consent, personal data are processed only by us and we process them until you withdraw the consent.

The consent can be given personally, by signature of the related written form during your presence in Villa Jolara or through this website. You are entitled to withdraw the given consent in any moment, without affecting the lawfulness of processing based on consent before its withdrawal. If you withdraw the consent or submit an objection on the personal data processing, we shall no longer process your personal data. You can withdraw the consent by sending us an e-mail to sestrice7@gmail.com or by clicking here.

We are not entitled to transfer the personal data to third parties, except when imposed by law or decisions of public authorities binding us pursuant to law. In the latter case, personal data can be made available to public authorities and are stored pursuant to prescribed terms.

3.3 In relation to “cookies” and web services

When you access our web site you receive information that we use cookies and web services for which we seek your consent for processing. Your consent if voluntary and can be withdrawn through our web site, without affecting the lawfulness of processing based on consent before its withdrawal.

Our website uses “cookies” (small files that are saved on the computer of the data subject when the data subject accesses websites to enable basic or additional functionality of the sites). Cookies, by themselves, cannot be used to reveal the personal identity of you as data subject. When accessing websites, such data is used by server to identify features of your browser but cannot identify you personally.

We use the following types of cookies:

• Necessary cookies, that are necessary to enable the basic website functionality. This means that the website cannot be opened or displayed without these cookies. These cookies are used for the purposes of communication transmission and enable basic website analysis with the aim of improving website functionalities by using completely anonymous data, that is, such cookies are not based on personal information or data that could be in any way linked with you personally. These cookies do not require consent.
• Functional cookies, that are used to perform a more advanced website analysis. These cookies are used to analyse user behaviours and based on received anonymous data help to conclude what website visitors prefer to see and browse, what is important for customizing the website and make its content and functionalities easier to use. For these cookies we seek for a consent.

We store cookies in a database and keep them for a period of two years or shorter if you delete them personally. You can always delete cookies stored on your computer, thereby disabling further processing of personal data through such technology.

Each web browser uses its own procedure for clearing cookies. Should you wish to change your cookie settings on our website, you can do so at any time by clicking here.

Since the purpose of cookies is to improve and enable the use of our website and its processes, keep in mind that by preventing or deleting cookies you may disable the functioning of those features, or cause them to function and appear differently in your browser.

Furthermore, sometimes we use web services that can result with data processing. We use Google Analytics and Google AdWords services.
Google Analytics provides us with insight into how many unique visitors there are to the site and preferences during its surfing. It works by means of tracking code that is added to the page of the website. Every user is registered with a unique ID, so that Google Analytics can track how many users return. Google Analytics can collect the following types of personal data: online identifiers including cookie identifiers, internet protocol addresses and device identifiers, client identifiers. All collected data are anonymous and cannot lead to identification of the data subject.
Data are processed based on your consent, until the end of the analytics or until the withdrawal of the consent. In event you disagree with Google Analytics, you can withdraw your consent here. After withdrawal of your consent you will be excluded from Google Analytics.
We use Google AdWords with the purpose of standard search advertising that targets keywords, not users. Personal data are not collected by that means, neither on anonymous level.

3.4 Other

With the purpose of entering into an agreeing relation and/or during the agreeing relation with different distributors of services of goods, as well as other clients, we collect personal data related to: name and surname, permanent or temporary residence, personal identification number / other tax number, e-mail address, telephone number and/or other contact data and/or data on bank account related to bank transfers. These data are collected for the purpose and as a condition of establishment and/or execution of a certain pre-agreeing or agreeing relation, with our authorization to deprive you from further contact or service in event you deny their collection.

Personal data are processed until fulfillment of all obligations related to the establishment and/or execution of certain pre-agreeing or agreeing relation. Personal data can additionally be processed for the purpose of complying with legal requirements, including with decisions of public authorities binding us pursuant to the law. In the latter case, we can make personal data available to public authorities and we are storing them pursuant to the prescribed terms.

4 Your personal data protection rights

We are informing you on following personal data protection rights:

• Right of access: you are entitled to obtain confirmation as to whether or not your personal data are being processed, and, where that is the case, access to the personal data and all connected information. The controller shall on your request provide a copy of your personal data undergoing processing.
• Right to rectification: you are entitled to obtain without undue delay the rectification of inaccurate personal data. You have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• Right to erasure (‘right to be forgotten’): you are entitled to obtain erasure of personal data without undue delay, especially where your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed or there is no legal basis for their further processing.
• Right to restriction of processing: you are entitled to obtain restriction of processing of your personal data where one of the following applies:
  – you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
  – the processing is unlawful, but you oppose the erasure of your personal data and request the restriction of their use instead;
  – the controller no longer needs your personal data for the purposes of the processing, but they are required by your side for the establishment, exercise or defense of legal claims;
  – you have objected to processing of personal data pending the verification whether the legitimate grounds of the controller override the grounds of you as data subject.
• Right to information: the data controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with previous clauses to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. On your request the controller is obliged to inform you about those recipients.
• Right to data portability: you are entitled to receive your personal data, which you provided to the controller in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. Where technically feasible, the personal data shall be transmitted directly from one controller to another controller.
• Right to object: you are entitled to object at any time on grounds relating to your particular situation to processing of your personal data. This applies when the processing is based on public interest or exercise of official authority vested in the controller or based on legitimate interests of the controller, especially in case of direct marketing.

5 How to exercise your personal data protection rights

If you are willing to excise your rights you can submit us a written request to ADDL KAŠTELA d.o.o., Personal Identity Number: 79026352500, by e-mail: sestrice7@gmail.com or this website.

Where we are not data controller with respect to the submitted request, we shall notify you on the person of the data controller. Where there are reasonable doubts concerning your identity, we may request the provision of additional information necessary to confirm your identity.

We shall provide information on action taken on your request without undue delay and in any event within one month of receipt of the request. Information shall be provided by electronic means, unless you otherwise request. If we do not take action on your request, we shall inform you without delay and at the latest within one month of receipt of your request of the reasons for not taking action and on the possibility on lodging a complaint with a supervisory authority, Croatian Personal Data Protection Agency and seeking a judicial remedy.

You are entitled to lodge a complaint before the supervisory authority, Croatian Personal Data Protection Agency, if you consider that the processing of personal data relating to you infringes the data protection regulation.

6 Amendments

We reserve the right to amend this Notice at any time in order to provide you with new relevant information and therefore we recommend that you periodically check for updates on this web page.

7 Comments and suggestions

We will be happy to receive your comments and suggestions in connection with this Notice, as well as other comments and suggestions. You can contact us by e-mail sestrice7@gmail.com or this website.