Privacy Policy

This Privacy Policy explains how Croatia Travel Agency ("we", "us", "our") collects, uses, stores and protects your personal data when you use our website croatiatravelagency.com or contact us about our services. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Croatian data protection law.

1. Who We Are

Croatia Travel Agency is the data controller for personal data collected through our website and booking processes.

Contact for data matters: info@croatiatravelagency.com

2. Data We Collect

We collect the following categories of personal data:

• Identity data: first name, last name
• Contact data: email address, phone number (including WhatsApp)
• Booking data: tour/activity type, travel dates, group size, special requests, health information relevant to activity participation
• Payment data: billing information (processed securely through our payment provider — we do not store full card details)
• Communication data: emails, WhatsApp messages and enquiries sent to us
• Technical data: IP address, browser type, pages visited, time on site (collected via cookies — see Section 8)

We do not knowingly collect data from children under 13 without parental consent.

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and confirm your booking or enquiry
• To communicate with you about your tour, activity or transfer
• To provide our services safely (including health and safety assessments where relevant)
• To send booking confirmations, reminders and post-tour follow-ups
• To respond to your enquiries and provide customer support
• To send you marketing communications (only with your consent — see Section 4)
• To improve our website and services through analytics
• To comply with legal obligations

4. Legal Basis for Processing

Under GDPR, we process your personal data on the following legal bases:

• Contract performance: to fulfil the booking you have made with us
• Legitimate interests: to run our business, communicate with customers, and improve our services
• Legal obligation: to comply with Croatian law, tax requirements, or safety regulations
• Consent: for marketing emails or newsletters — you may withdraw consent at any time by contacting us

5. Sharing Your Data

We do not sell your personal data. We may share your data with:

• Our guides and local partners: to coordinate and deliver your booked experience
• Payment processors: to process transactions securely
• IT and software providers: who help us operate our website and communications (under GDPR-compliant data processing agreements)
• Legal authorities: where required by law

We require all third parties to treat your data with the same level of care and only use it for the specified purpose.

6. Data Retention

We retain personal data only for as long as necessary. As a general guide:

• Booking and customer data: 7 years (for accounting and legal compliance)
• Marketing consent records: until you withdraw consent
• Website analytics (cookies): see our cookie policy in Section 8
• WhatsApp / email enquiries that did not result in a booking: up to 12 months

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

To exercise any of these rights, please contact us at info@croatiatravelagency.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

8. Cookies

Our website uses cookies — small text files stored on your device — to improve your experience. We use the following types:

• Essential cookies: necessary for the website to function (e.g., form submissions). Cannot be disabled.
• Analytics cookies: help us understand how visitors use our site (e.g., Google Analytics). We anonymise IP addresses. You can opt out via your browser settings or Google's opt-out tool.
• Marketing cookies: used to show relevant advertisements. Only set with your explicit consent.

You can manage cookie preferences through your browser settings at any time. Disabling certain cookies may affect website functionality.

9. Data Security

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration. These include SSL encryption on our website, secure email protocols, and restricted access to personal data within our team.

However, no internet transmission is 100% secure. If you suspect a data security incident involving your personal data, please contact us immediately.

10. Contact Us

For any questions, data requests, or concerns about this Privacy Policy, please contact us: