01Controller and contact
Full service, obrt za održavanje vila, owner and authorised representative: Danijela Tabula, Bana Ivana Mazuranića 31, 22000 Šibenik, Hrvatska. Email: pmdalmatia@gmail.com. Telephone: +385 99 468 1362. You may use these details for privacy requests as well.
02Website delivery and security
Cloudflare, Inc., USA, delivers this website. Requests involve your IP address, time, requested address, browser and connection details and, where applicable, the referring page. These data are needed to deliver the site and protect it against attacks and technical errors. The basis is our legitimate interest in a secure, available website under Article 6(1)(f) GDPR.
Cloudflare operates a worldwide network; processing is not restricted to the EU. We do not maintain an additional permanent archive of individual website visits. Technical connection and security data are retained for operation, troubleshooting and responding to actual attacks and deleted when no longer needed, subject to legal retention grounds. Cloudflare’s privacy information explains its processing. Website and embedded-demo fonts are served locally.
03Contact form, email and callbacks
When you contact us, we process your name and email address or phone number. You may also provide your villa location, a message, contact preference and callback time. The form additionally submits the language, page path and a technical enquiry identifier. We use these details to answer your enquiry and prepare a possible offer. We cannot reply without a contact method.
Article 6(1)(b) GDPR applies to steps towards a contract with you. For business representatives and other general correspondence, Article 6(1)(f) GDPR applies to our legitimate interest in handling business communications. Acknowledging this notice is not marketing consent. The form does not conclude a contract.
Unsubmitted form entries and callback choices remain in the open page’s memory. Only explicit submission transmits the enquiry. We do not create a persistent contact profile in your browser.
04Recipients, database and email delivery
Danijela and Toni handle enquiries in the business mailbox pmdalmatia@gmail.com. Our technical service provider in Germany administers hosting and the form system and may access technical data and enquiries as needed for operation, support and troubleshooting. The provider is to use these data solely for the assigned work and under our instructions.
The form uses Supabase Pte. Ltd., Singapore, for server-side processing and storage. The enquiry database is in eu-west-1, Ireland. The demo also obtains house information and media from Supabase EU regions. An EU database does not exclude international platform or support access. Enquiry records are not publicly readable from the database.
To deliver your enquiry to our mailbox, its content and the necessary sender details are passed to Resend (Plus Five Five, Inc., USA). Resend states a standard email and log retention period of 30 days. These delivery records are separate from our business correspondence.
Our current mailbox is a regular Gmail account. Google’s terms and privacy policy apply, including Google Ireland Limited in the EEA; processing in other countries, including the USA, is possible. Google does not act as our contractual processor for free consumer Gmail. We therefore do not describe this mailbox as Google Workspace processing under a data-processing agreement.
05Abuse prevention and technical logs
The enquiry system uses a technical enquiry identifier, an IP-derived hash, a contact identifier and enquiry/delivery status. These limit excessive requests and recognise accidental duplicate submissions. The IP hash is a pseudonymous safeguard, not anonymous information. The basis is Article 6(1)(f) GDPR.
Our own safeguards are deleted with the enquiry record unless removed earlier. Evidence needed for a specific abuse or security incident may be retained until the incident is resolved and, where necessary, to establish or defend claims. Supabase makes technical logs available for seven days on our current Pro plan. This does not mean all provider operational data have the same retention period.
06Optional guest-app demo
The interactive demo starts only when you select “Start demo”. Before that, only local preview files load. Your permission allows external demo content and its technical browser storage to load. The basis for this optional integration is consent under Article 6(1)(a) GDPR. The rest of the website and contact options work without the demo.
After starting, the demo retrieves house information, recommendations and media from Supabase. Weather is requested through app.sibenikinsider.com, a service operated by the technical provider on Vercel infrastructure. The map view loads CARTO / CartoDB Inc. tiles from basemaps.cartocdn.com. These services receive your IP address, browser and request information. Map and weather requests concern the displayed example region. External links open only when selected.
The guest name, stay and conversation are fictional examples. Test messages and check-in entries remain in the demo screen’s memory. They are not sent as real messages, stored as guest registrations or used to submit eVisitor registrations. Please use fictional details. The demo does not record individual guest usage events.
Permission is held only in memory for the open demo. Reloading or closing the view ends permission for further requests. Previously loaded data and browser caches are not erased retroactively; you can remove them through browser settings. Withdrawal does not affect the lawfulness of earlier processing.
07Language choice and local storage
The website does not automatically redirect based on browser language. It may suggest a supported language when it differs from the open version. An explicit language choice is recognised for 90 days; dismissing the notice applies only to the current browser tab. These entries serve the language function you choose, not advertising or audience measurement. “Cookies & local storage” lists keys, purposes and durations.
Google Analytics, advertising pixels, newsletter signup and the optional Plausible measurement are not enabled on this website.
08Retention and deletion
Completed enquiries that do not result in a contract are deleted from the database and mailbox no later than six months after the last contact. If handling is ongoing, we retain necessary correspondence until it is finished. Where a contract results, necessary documents are handled separately as contract records. Legal retention duties and specific legal claims may require us to retain relevant records longer; they are deleted afterwards.
Implementation includes reviewing both the enquiry database and mailbox. The website does not automatically detect subsequent email correspondence. Six months is our chosen deletion rule, not a general statutory retention period.
Deleted records can remain in backups until scheduled rotation. Our current Supabase Pro plan provides seven days of daily database backups; Resend also states a seven-day backup period. Backups are used for recovery rather than as an active enquiry archive. Previously requested deletions must be reapplied after a restoration. Provider operational and statutory retention are distinct.
09Written consumer complaints
We process contact details and information about the service and written complaint to acknowledge receipt, investigate and reply. The basis is Article 6(1)(c) GDPR together with Article 10 of the Croatian Consumer Protection Act. Legally required complaint records are retained for one year from receipt. Other statutory retention duties remain unaffected.
10International processing
The named providers may process data or provide support outside the EEA. Cloudflare, Supabase and Resend provide EU Standard Contractual Clauses in their processing terms for relevant international transfers. Google describes adequacy mechanisms, including the EU-US Data Privacy Framework, and Standard Contractual Clauses in its transfer information. Choosing an EU data centre does not replace these safeguards.
The linked provider information describes their recipients, subprocessors and transfer mechanisms. You may also ask our privacy contact for information about safeguards applicable to our processing.
11Your rights and complaints
Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent for the future at any time. Where we rely on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. Please use the contact details above.
You may complain to a supervisory authority, particularly where you habitually live, work or believe an infringement occurred. In Croatia this is Agencija za zaštitu osobnih podataka (AZOP); current contact information is linked below. We do not make solely automated decisions with legal or similarly significant effects in the described website and enquiry process.