1. Data Controller

The controller responsible for processing your personal data is:

Villa Abba
Gradina 2b
HR-20270 Vela Luka
Korčula Island, Republic of Croatia
Email: villa_abba@yahoo.com
Telephone: +385 95 532 4082

2. Personal Data We Collect

Depending on how you interact with us, we may collect:

• identity and contact details, such as your name, address, email address and telephone number;
• booking information, including arrival and departure dates, number of guests, accommodation preferences and messages you send to us;
• payment and transaction information, such as payment status, amounts paid and bank transfer references. We do not request or store complete payment-card details through this website;
• guest registration information and identification details required by Croatian tourism, accommodation, tax or other applicable laws;
• communications exchanged with us by email, telephone, WhatsApp or other agreed channels;
• technical information generated when you visit the website, such as IP address, browser type, device information, requested pages, timestamps and server security logs.

Please do not send sensitive personal data unless it is necessary for your booking or required by law.

3. How We Use Personal Data and Our Legal Bases

We process personal data only where we have a lawful basis to do so. We may use your data:

• to respond to enquiries and take steps at your request before entering into an accommodation contract;
• to confirm, administer and perform your booking and stay;
• to process payments, deposits, cancellations and refunds;
• to register guests and comply with Croatian tourism, accounting, tax, safety and other legal obligations;
• to communicate practical information relating to arrival, departure, the property and your stay;
• to establish, exercise or defend legal claims;
• to maintain the security, availability and proper functioning of the website based on our legitimate interests;
• for another specific purpose where you have given consent. You may withdraw consent at any time without affecting processing carried out before withdrawal.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. How We Receive Personal Data

We usually receive personal data directly from you when you contact us or make a booking. We may also receive data from a person booking on behalf of a group, a booking platform or travel intermediary, a payment provider, or competent Croatian authorities where permitted by law. If you provide information about another guest, you should ensure that the person is aware of this Privacy Policy.

5. Sharing Personal Data

We do not sell personal data. Where necessary for the purposes described above, data may be shared with:

• competent Croatian tourism, tax, law-enforcement or other public authorities where required by law;
• website hosting, IT support, email, communications and security service providers acting on our behalf;
• banks, payment service providers, accountants, legal advisers and insurers where necessary;
• booking platforms or travel intermediaries when your booking was made through them;
• maintenance or service providers where access to limited booking or contact information is necessary to assist you during your stay;
• other recipients where you instruct us to share the information or where disclosure is legally required.

Service providers are permitted to use personal data only for the agreed purpose and must protect it appropriately.

6. External Services and Links

The website provides optional links for contacting or following Villa Abba through services such as WhatsApp and Instagram. If you choose to use an external service, that provider processes data under its own privacy terms. The website may also load fonts supplied by Google Fonts, which may involve transmission of technical information such as your IP address to Google.

External services may process data outside the European Economic Area. Where GDPR applies, such transfers must rely on an appropriate legal mechanism, such as an adequacy decision or approved contractual safeguards. We encourage you to review the privacy information of each external service before using it.

7. Cookies and Similar Technologies

The website may use cookies or similar local-storage technologies that are necessary for core functions, security, language preferences and proper display of the website. At the date stated above, we do not knowingly use advertising cookies or Google Analytics on this website.

If analytics, advertising or other non-essential technologies are introduced later, this Privacy Policy and the website's consent mechanism should be updated before those technologies are activated.

You can control cookies through your browser settings. Blocking necessary cookies may affect some website functions.

8. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected:

• enquiry correspondence that does not lead to a booking is generally kept for up to 12 months after the last communication, unless a longer period is reasonably necessary;
• booking, payment, invoice, guest registration and tax records are retained for the periods required by Croatian law;
• communications connected with a booking may be retained while necessary to perform the contract and afterwards for applicable limitation periods or legal claims;
• technical and security logs are generally kept for a limited period unless longer retention is necessary to investigate abuse, fraud or a security incident.

Data may be deleted earlier when it is no longer needed, or retained longer where required by law or necessary for legal proceedings.

9. Data Security

We apply reasonable technical and organisational measures designed to protect personal data from accidental loss, misuse, unauthorised access, alteration or disclosure. However, no internet transmission or storage system can be guaranteed to be completely secure.

10. Your Rights

Subject to the conditions and limitations of applicable law, you may have the right to:

• request access to your personal data and receive a copy;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a structured, commonly used and machine-readable format and request data portability;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a supervisory authority.

To exercise your rights, contact us at villa_abba@yahoo.com. We may need to verify your identity before acting on a request.

You may also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, HR-10000 Zagreb, Croatia, through azop.hr, or with another competent supervisory authority.

11. Children's Privacy

The website is not intended for children to make bookings independently. Information about children may be processed only where provided by a parent, guardian or responsible adult and where necessary for a booking, guest registration, safety or compliance with law.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our services, website technologies or legal obligations. The current version will be published on this page with an updated revision date.

13. Contact

For questions about this Privacy Policy or the processing of your personal data, contact:

Villa Abba
Gradina 2b, HR-20270 Vela Luka, Korčula Island, Croatia
Email: villa_abba@yahoo.com
Telephone: +385 95 532 4082