Privacy notice

Controller and contact

Dick-Mair d.o.o., Valentići 32, 52464 Kaštelir, Croatia, is responsible for the personal data described here. Our named contact is Claudia Dick-Mair. Contact us about privacy or your booking at info@villa-claudia.eu or by post at that address.

This notice covers villa-claudia.eu, documents.villa-claudia.eu, direct bookings and related guest communication. It was updated on 15 October 2026.

Enquiries, bookings and your stay

We receive guest information from you or the person making the booking. We process the contact and billing details provided, arrival and departure dates, guest numbers, booking and payment references, and messages needed to arrange and administer your stay. We send booking information and necessary reminders. We use information necessary to take steps at your request before a contract and perform your accommodation contract under GDPR Article 6(1)(b). For necessary communication with accompanying guests who are not contracting parties, our basis is the legitimate interest in organising the booked stay under Article 6(1)(f).

Required fields identify the information needed to process your request or booking. Without it, we may be unable to respond, complete the reservation or provide the relevant service. Please avoid sending unnecessary identity documents, payment-card details or health information in messages.

Payments

Stripe processes the payment methods offered at checkout. It receives payment, transaction, device and connection information needed to process and authenticate payments and prevent fraud. We receive transaction references, payment status and limited payment-method information. Card details are entered through Stripe's payment functions, not the guest-registration form.

Our payment processing supports the accommodation contract under Article 6(1)(b). Related accounting is based on legal obligations under Article 6(1)(c), and protecting transactions against fraud is our legitimate interest under Article 6(1)(f). Stripe acts as a processor for some services and as an independent controller for activities such as legal compliance and fraud prevention. Its EEA services involve Stripe Payments Europe, Limited and Stripe Technology Europe, Limited in Ireland. See Stripe's Privacy Policy and Privacy Center.

Stripe and payment providers use automated authentication and risk checks which can affect whether a payment succeeds. If your payment is refused, contact us to review the booking and available payment options. We do not use guest information to build advertising profiles.

Statutory guest registration

Croatian accommodation providers must register and deregister overnight guests through eVisitor. We process the required identity and stay information for that obligation under Article 6(1)(c), in particular Article 22 of the Croatian Tourist Tax Act and the eVisitor Regulation, NN 43/2020. Depending on the required entry, this includes name, birth information, nationality, identity-document type and number, residence and address, sex, stay dates and any applicable tourist-tax exemption category.

We use the information for the statutory register, tourist-tax administration and associated legal reporting. Necessary data is made available through eVisitor to the Croatian National Tourist Board, the competent local tourist board and public authorities with statutory access. The local board for the property is the Tourist Board of Kaštelir-Labinci. A receipt from our website does not itself confirm official registration.

Please bring the original identity document for inspection at arrival. We do not routinely require advance passport or identity-card copies. If you do not provide legally required guest information, we cannot complete the statutory registration and may be unable to provide the stay.

Only in an objectively justified exceptional case, recorded by the operator, may we offer temporary private submission of an identity-document copy to complete registration. The operator records the specific reason. We explain the temporary registration purpose and expiry before collection. This requires your separate optional consent under Article 6(1)(a). You may refuse or withdraw consent and use original-document inspection instead, without losing that alternative. Withdrawal does not affect earlier lawful processing or the separate legal duty to register the necessary guest data.

The exception portal accepts only the lead adult guest's own document. It does not accept other adults' or children's copies on the booker's consent. Access is limited to authorized registration staff. Copies are held in a restricted server temporary directory outside the website content directories. They are not sent as email attachments or forwarded to another recipient. They are deleted when registration is marked complete or you withdraw consent. Access ends at the recorded expiry, and automatic cleanup removes expired copies within the 24-hour registration window. The expiry is set from the actual arrival time and falls before the end of that window. Use the withdrawal-and-delete action in your private portal, or contact info@villa-claudia.eu, to withdraw consent. A portal copy is not itself an eVisitor registration.

If you provide details for fellow travelers, give them this notice and ensure the information is accurate. We also remain responsible for our information obligations. Data about children is limited to what the stay and statutory registration require.

Website operation and security

When you use either site, the hosting systems process technical information such as your IP address, request time, requested resource and browser or device information. We use this to deliver pages, maintain booking sessions, investigate errors and prevent misuse. Our legitimate interests in operating and protecting the service are the basis under Article 6(1)(f).

We use HTTPS, restricted administration access and private booking links. Keep your private link confidential. Booking data is accessible only to people who need it to administer the stay and to service providers carrying out the relevant tasks.

Cookies and external content

We have disabled optional analytics and marketing tracking on these sites. Website fonts are served locally. The guest-registration site does not set its own visitor cookies or use browser storage for guest information. You can remove cookies left by earlier visits through your browser settings.

The WordPress booking and checkout functions use the following technical storage:

• WP_SESSION_COOKIE identifies a booking session and expires after about 30 minutes.
• WooCommerce uses localStorage entries such as wc_cart_hash_*, storeApiCartHash, storeApiNonce and storeApiCartData to cache cart and checkout state. Checkout cache can include entered contact, billing and shipping address details. SessionStorage entries such as wc_fragments_*, wc_cart_hash_* and wc_cart_created support the current tab's cart display. SessionStorage ends with the tab session. The checkout cache entries storeApiCartData, storeApiCartHash and storeApiNonce are cleared on the valid paid order-received page. An unfinished checkout can retain localStorage until it is replaced or cleared by the application or your browser; localStorage has no built-in expiry.
• Stripe resources load for checkout payments and fraud prevention. Observed cookies include __stripe_mid and __stripe_sid. Stripe lists their durations as one year and 30 minutes. Its m fraud-prevention cookie is listed as up to two years; browsers can impose shorter limits. Stripe publishes the current details in its cookie information.

You can clear or block browser storage and cookies in browser settings. Booking or payment functions may then fail. We use these booking and payment functions to provide the service you request and protect the transaction, not for optional marketing tracking.

Google Maps does not load automatically. If you follow the external directions link, you leave our site and Google processes information under its own Privacy Policy. Restaurant and social-media links similarly open external services only when selected.

Service providers and international transfers

We use Hostinger for hosting and email. Hostinger processes hosted customer data on our instructions under its Data Processing Addendum. Its EU terms identify Hostinger International Limited in Cyprus. Hosting, email and support can involve group companies and subprocessors in other countries. We do not promise that all processing is restricted to one country.

Stripe, banks and other payment providers process information needed for payments. Authorized people administering the property and professional accounting or legal advisers receive information only where needed for their tasks. Public authorities receive information where a legal duty or other valid basis applies.

Providers may process information outside the European Economic Area, including in the United States. Hostinger's processing terms incorporate the European Commission's standard contractual clauses for relevant transfers. Stripe describes the applicable use of adequacy decisions, the EU-US Data Privacy Framework and standard contractual clauses in its Data Transfers Addendum. The safeguard depends on the recipient and transfer. You may ask us for further information or a copy of the relevant safeguards, subject to protecting other people's rights and confidential information.

How long information is kept

We apply different periods to different records. A private link expiring does not mean that statutory booking or accounting records have been deleted.

• Enquiries that do not lead to a booking are kept until the enquiry and necessary follow-up are resolved. We then remove information that is no longer needed, unless a specific dispute or legal duty requires it.
• Booking records and relevant correspondence are kept while we perform the contract and for the period needed to establish, exercise or defend related claims. The relevant limitation period, its starting point, any interruption and an active dispute determine that period. Only necessary evidence is retained for that purpose.
• Accounting documents used for the business books are generally subject to at least 11 years' retention from the end of the relevant financial year under the Croatian Accounting Act. Where the Fiscalisation Act's specific rule applies to fiscalised electronic invoices, the period is six years from the end of the issue year. The rule applicable to the actual document determines retention.
• Temporary identity-document copies for a documented exceptional case follow the short deletion rule above. They are not accounting records and are not retained for the statutory register's ten-year period. A limited record of the exception, consent and closure remains as necessary to demonstrate the process and handle related claims. Its retention follows the relevant booking-evidence criteria, without retaining the image or document-number fields.
• Official eVisitor tourist-register data is retained in that system for the statutory ten-year period.
• Technical logs are kept only while needed to identify and resolve errors, abuse or security incidents, or to meet a specific legal duty. Necessary evidence of an incident may be retained until it is resolved and related claims are dealt with.
• Restricted backups are used for recovery. Removed information can remain in a backup until that backup is replaced or expires in the provider's backup cycle. It is not used for ordinary business processing. If a backup is restored, relevant deletion and restriction instructions must be applied again.

Where more than one purpose applies, we restrict the remaining record to the information needed for the continuing purpose. These rules include manual review and deletion; they are not a claim that every record is automatically erased.

Your rights

Subject to the GDPR's conditions, you may request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it for the future without affecting earlier lawful processing.

Contact info@villa-claudia.eu to exercise your rights. We may ask for proportionate information to verify your identity when necessary. We generally respond within one month. If a permitted extension is necessary because of the complexity or number of requests, we will explain it within that month. Erasure is subject to legal retention duties and other applicable exceptions.

You may complain to the Croatian Personal Data Protection Agency, AZOP, Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr. You may also contact the competent authority in the country of your habitual residence, workplace or alleged infringement.