1. Who processes your data (controller)
Dinka Boban, private household accommodation provider (iznajmljivačica u domaćinstvu), Mala Duba 89, 21329 Živogošće, Croatia · info@maladuba.com
2. What data, why, on what legal basis and for how long
| When | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Booking enquiry | first and last name, e-mail, dates, number of guests, apartment; optionally country, telephone, message; website language | reply and offer; keeping the correspondence after we reply | steps prior to entering into a contract – Art. 6(1)(b) GDPR; after we reply, legitimate interest – point (f) (replying to a repeat enquiry, as many guests return; evidence of correspondence) | 2 years if no booking is made, then automatic deletion; otherwise as for a booking |
| Contact form | name, e-mail, subject, message | reply to the message | question about accommodation: steps prior to entering into a contract – point (b); other questions: our legitimate interest in replying – point (f) | 2 years |
| Booking and stay | booking details, correspondence, payment of the deposit (payer’s name, IBAN) | performance of the contract, payment, invoices | performance of the contract – point (b); invoices and records – legal obligation, point (c) | for the duration of the contract, and the correspondence until the limitation period for claims under the contract expires (legitimate interest – point (f)); business documents and records 10 years from the start of the limitation period (General Tax Act, Art. 66(18)) |
| Guest registration (eVisitor) | first and last name, place, country and date of birth, nationality, type and number of identity document, residence and address, sex, date and time of arrival and departure – for all guests | statutory registration of the stay within 24 hours; providing the data is a legal obligation | legal obligation – point (c) (Tourist Tax Act, Art. 22; Ordinance on the eVisitor system, Art. 4; Hospitality Industry Act (ZUD), Art. 32(1)(5)) | we do not keep them outside eVisitor – we make no copies of documents and return the document immediately after entering the data; in the eVisitor system the data are kept by the Croatian National Tourist Board in accordance with the regulations |
| Bookings via Booking.com and Airbnb | data the platform forwards to us | performance of the contract | point (b) | as for a booking |
| Complaints | name, contact details, content of the complaint and our reply | handling complaints, statutory records | legal obligation – point (c) (Consumer Protection Act (ZZP), Art. 10) | 1 year from receipt |
| Website security and protection of forms against spam | technical data of the browser and device, IP address (Cloudflare, Cloudflare Turnstile) | security, preventing abuse | legitimate interest – point (f) | only as long as needed for the security check: Cloudflare keeps the data while it is needed for that purpose or for legal obligations and then deletes it or, if deletion is technically not possible, protects it; Cloudflare does not publish an exact number of days (for Cloudflare’s own use, see “Other recipients”) |
| Aggregate traffic statistics, without a script (Cloudflare) | IP address and request data (time, page, browser) from which Cloudflare produces aggregate figures (requests, visitors, countries); nothing is stored on or read from your device | how much the website is used | legitimate interest – point (f) | we see only the aggregate figures; Cloudflare keeps request data while it is needed to provide the service or for legal obligations and then deletes it or, if deletion is technically not possible, protects it; Cloudflare does not publish an exact number of days |
| Statistics with cookies (Google Analytics 4) | data on use of the website, identifier from the cookie; Google states that it does not log or store IP addresses in GA4 | analysis of visits | consent – point (a) (cookie banner) | cookies up to 2 years; data in GA4 up to 14 months after your last visit |
| Record of your cookie choice | time, categories selected, version of the banner text, language – without IP address and without any identifier | evidence that consent was given or refused | the record contains no data by which you could be identified; if it were regarded as personal data: legitimate interest in proving consent – point (f) (GDPR Art. 5(2), Art. 7(1)) | 2 years |
We need the data from the forms so that we can reply to you; without them we cannot send an offer. We do not take automated decisions and do not create profiles. We do not sell the data and do not use them for advertising.
3. Who else has access (processors)
- Raidboxes GmbH (Germany) – web hosting,
- Cloudflare, Inc. – network, protection and statistics without cookies,
- Microsoft (Microsoft 365) – e-mail,
- Hostify.com, Inc. (USA) – reservation and calendar system,
- Google (Google Analytics) – only with your consent.
Cloudflare, Microsoft and Google transfer data to the USA on the basis of the EU–US Data Privacy Framework (European Commission adequacy decision) and, in addition, standard contractual clauses. Hostify.com, Inc. is based in the USA, so booking data may be transferred to and processed in the USA; according to Hostify’s privacy policy, this is done with appropriate safeguards, which may include the European Commission’s standard contractual clauses. You can request a copy of the standard contractual clauses at info@maladuba.com.
Other recipients: Cloudflare also uses the signals from the form protection (Turnstile) independently, to improve bot detection – see Cloudflare’s privacy notice for Turnstile (https://www.cloudflare.com/turnstile-privacy-policy/). Data on guests’ stay are reported to the eVisitor system (the Croatian National Tourist Board and the tourist boards) and are available to the competent state authorities as provided by law; the deposit payment is processed by your bank and ours.
Booking.com and Airbnb are independent controllers of the data you enter on their websites; their privacy policies apply.
Data not obtained from you: if you book through Booking.com or Airbnb, the platform forwards to us (via the Hostify system) your name, contact details, dates, number of guests, price and messages. We use them only for your stay, as described above.
4. Your rights
You have the right of access and the rights to rectification, erasure, restriction of processing and data portability.
Right to object: you may object at any time to processing based on legitimate interest (website security, statistics without cookies, replies to general questions).
You can withdraw your consent to cookies at any time via the “Cookie settings” link in the footer; withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Send your request to info@maladuba.com; we reply without undue delay and at the latest within one month.
5. Complaint
If you believe that the processing is unlawful, you can contact the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, azop.hr.
The original text is Croatian.
Last updated: 18 October 2026