PRIVACY POLICY
Lovely Istria d.o.o.
Tourist Agency
Bunarska cesta 102, 52100 Pula, Croatia
OIB: 01645881428
E-mail: info@lovelyistria.com
Web: www.lovelyistria.com
Version: 15.9.2026.
1. GENERAL
1.1. Lovely Istria d.o.o. (hereinafter: “Lovely Istria”, “we”, “us” or “the Agency”) respects the privacy of its guests, website users, property owners, business partners and other persons whose personal data we process.
1.2. This Privacy Policy explains:
which personal data we collect
for which purposes we process it
the legal basis for processing
to whom the data may be disclosed
how long the data is retained
how we protect it
which rights data subjects have
1.3. We process personal data in accordance with the General Data Protection Regulation (GDPR), the Croatian Act on the Implementation of the General Data Protection Regulation and other applicable Croatian and European Union legislation.
2. DATA CONTROLLER
The controller of personal data is:
Lovely Istria d.o.o.
Bunarska cesta 102
52100 Pula
Croatia
OIB: 01645881428
E-mail for data protection matters:
For any questions concerning the processing of your personal data or the exercise of your rights, you may contact us at the above e-mail address.
3. WHOSE PERSONAL DATA WE PROCESS
Depending on our relationship with you, we may process personal data relating to:
persons making a booking
all registered guests staying at an accommodation property
persons sending us enquiries
users of our website
owners and co-owners of accommodation properties
authorised representatives of property owners
business partners and suppliers
persons subscribing to our newsletter or other marketing communications
persons contacting us via e-mail, telephone, WhatsApp, social media or booking platforms
4. PERSONAL DATA WE MAY COLLECT
Depending on the purpose of processing, we may collect the following categories of personal data.
4.1. Identification data
This may include:
first and last name
date of birth
gender, where required for statutory guest registration
nationality
country and place of residence
address
type and number of identification document
information required for statutory guest registration
4.2. Contact details
This may include:
e-mail address
telephone number
mobile phone number
WhatsApp contact
residential or temporary address
4.3. Booking data
This may include:
name of the booked property
arrival and departure dates
number of adults, children and babies
number and type of pets
special requests relating to the booking
additional services
booking price
booking status
booking number
booking channel
4.4. Payment data
We may process information such as:
payment amount
payment date
payment method
transaction status
information required for issuing invoices or other accounting documents
Lovely Istria generally does not store full credit card details where payment is processed by an authorised payment service provider. Such information is processed by the relevant payment provider in accordance with its own privacy rules and security standards.
4.5. Communications
We may retain communications conducted with you via:
e-mail
telephone
WhatsApp
contact forms
booking platforms
social media
other communication channels
This may include the content of enquiries, requests, complaints and responses.
4.6. Technical data
When using our website, depending on website and cookie settings, the following may be processed:
IP address
device type
browser type
operating system
approximate location derived from the IP address
date and time of access
pages visited
website interaction data
data stored through cookies and similar technologies
Further details are provided in our separate Cookie Policy.
5. HOW WE COLLECT PERSONAL DATA
We may obtain personal data:
5.1. Directly from you
For example when you:
send an enquiry
make a booking
contact us
complete an online form
provide information required for guest registration
report an issue or submit a complaint
subscribe to a newsletter
5.2. From the person making the booking
If one person makes a booking for several guests, we may receive the personal data of the other members of the group from the lead guest.
The person providing us with the personal data of other persons should be authorised to do so and, where applicable, inform those persons about the way their data will be processed.
5.3. From booking platforms and partners
We may receive personal data through platforms and business partners such as:
Airbnb
Vrbo
HomeToGo
other tourism and booking partners through which an enquiry or booking has been made
The data we receive depends on the rules and settings of the individual platform.
5.4. From property owners
In certain cases, the Owner or the Owner’s contact person may provide us with information required to manage the booking, communicate with the guest, resolve issues or perform other agreed services.
6. PURPOSES AND LEGAL BASES FOR PROCESSING
We process personal data only where an appropriate legal basis exists.
7. ENQUIRIES AND COMMUNICATION BEFORE BOOKING
When you send us an enquiry about accommodation, we process your data in order to:
respond to the enquiry
check availability
prepare an offer
answer questions about the property
take steps necessary prior to entering into a contractual relationship
Legal basis: taking steps at the request of the data subject prior to entering into a contract and, where applicable, our legitimate interest in responding to business enquiries.
8. PROCESSING THE BOOKING
We process data in order to:
record the booking
send a booking confirmation and voucher
record payments
coordinate the booking with the Owner
send arrival information
facilitate check-in
organise additional services
communicate before, during and after the stay
Legal basis: performance of a contract or taking steps necessary for the performance of the booking.
9. GUEST REGISTRATION AND LEGAL OBLIGATIONS
Certain guest information must be processed in order to comply with statutory obligations relating to guest registration and record keeping.
Such information may be provided to competent state or tourism systems and authorities, including tourist registration systems, where required by law.
Legal basis: compliance with a legal obligation.
Information legally required for guest registration must be provided. Without the required information, it may not be possible to lawfully provide accommodation.
10. PAYMENTS, INVOICES AND ACCOUNTING
We process data in order to:
record payments
process refunds where required
issue invoices
maintain accounting records
comply with tax and financial obligations
document completed transactions
Legal basis: performance of a contract and compliance with legal obligations.
11. COMMUNICATION WITH THE PROPERTY OWNER
In order to perform the booking, certain guest information may be provided to the Owner or the Owner’s authorised contact person.
This may include:
name of the lead guest
number of guests
dates of stay
contact telephone number
expected arrival time
special requests relevant to the stay
information necessary for organising check-in and the stay
We provide the Owner only with data that is necessary for the performance of the booking and provision of accommodation.
12. CUSTOMER SUPPORT, COMPLAINTS AND CLAIMS
We may process data and communications in order to:
answer guest questions
resolve issues during the stay
communicate with the Owner or technicians
handle complaints
establish facts in the event of a dispute
protect and exercise legal claims
Legal basis: performance of a contract, compliance with legal obligations and our legitimate interest in effectively handling complaints, protecting our rights and documenting facts.
In the event of a complaint, we may retain relevant communications, photographs, videos or other evidence provided to us or reasonably required to establish the facts.
13. PREVENTION OF MISUSE AND PROTECTION OF RIGHTS
Where necessary and proportionate, we may process data for:
fraud prevention
prevention of misuse of our services
protection of the safety of guests, Owners and our company
establishment, exercise or defence of legal claims
documenting damage or breaches of booking terms
Legal basis: our legitimate interest in protecting our business, property, rights and safety, while respecting the rights and freedoms of data subjects.
14. MARKETING AND NEWSLETTER
If you subscribe to our newsletter or other marketing communications, we may use your e-mail address and other relevant contact details to send:
offers
accommodation information
promotional campaigns
Lovely Istria news
other marketing content
Where consent is required under applicable law, such communication is sent on the basis of your consent.
Where direct marketing is permitted on another legal basis, we may conduct it within the limits permitted by law.
You may unsubscribe from marketing communications at any time, for example by using the unsubscribe link in the e-mail or by contacting info@lovelyistria.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
15. WEBSITE AND ANALYTICS
We may use technical tools on our website that are necessary for:
correct website operation
security
remembering user preferences
measuring website use
analytics
improving user experience
marketing, where the required consent has been obtained
Further information on cookies and similar technologies is provided in our separate Cookie Policy.
16. WHO WE MAY SHARE PERSONAL DATA WITH
Personal data is not sold to third parties.
Where necessary and lawful, we may share personal data with the following categories of recipients:
16.1. Property owners
To the extent necessary for the performance of the booking and accommodation service.
16.2. State and public authorities
Where required by law, for example for guest registration, tax, accounting or other statutory obligations.
16.3. Payment service providers
Where necessary to process payments or refunds.
16.4. IT and hosting providers
Providing services relating to:
website hosting
business systems
e-mail
booking systems
backups
cloud services
16.5. Accountants and professional advisers
Such as:
accountants
lawyers
tax advisers
auditors
where required for lawful business operations or the protection of our rights.
16.6. Booking and tourism partners
Where a booking has been made through their platform or where data exchange is necessary for the performance of a booking.
16.7. Technicians and other service providers
Only where specific information is necessary for the provision of a service related to a particular booking.
For example, a technician will generally not need to receive the guest’s identification document details, but only information necessary to organise the intervention.
17. PROCESSORS
For certain business activities we use external service providers who may process personal data on our behalf.
Where such providers act as processors, we require them to provide appropriate protection of personal data and to process personal data in accordance with our instructions and applicable legislation.
18. INTERNATIONAL DATA TRANSFERS
Certain technology, booking, communication or other service providers may operate outside the European Economic Area or use infrastructure involving international data transfers.
Where personal data is transferred outside the European Economic Area, we apply or rely on an appropriate legal mechanism under the GDPR, such as:
an adequacy decision of the European Commission
European Commission Standard Contractual Clauses
other appropriate safeguards permitted under the GDPR
where such safeguards are required.
19. HOW LONG WE RETAIN PERSONAL DATA
We do not retain personal data longer than necessary for the purpose for which it was collected.
Retention periods depend on the type of data and purpose of processing.
19.1. Booking data
Retained for the period necessary to perform the booking and afterwards for the period required to deal with possible enquiries, complaints, legal claims and statutory obligations.
19.2. Accounting and financial data
Retained for the period prescribed by applicable accounting, tax and other legislation.
19.3. Guest registration data
Retained or processed for the period required under legislation governing guest registration and records.
19.4. Business communications
Retained for as long as reasonably necessary for business purposes, evidence of communication, handling possible complaints and protecting legal interests.
19.5. Data processed on the basis of consent
Retained until consent is withdrawn or until the purpose of processing no longer exists, unless another legal basis applies.
19.6. Data relating to legal claims or disputes
May be retained until final resolution of the dispute or expiry of applicable limitation periods.
After expiry of the relevant retention period, data is deleted, anonymised or otherwise removed from active use unless there is a lawful basis for further retention.
20. DATA SECURITY
We apply appropriate technical and organisational measures to protect personal data against:
unauthorised access
unauthorised alteration
loss
destruction
unauthorised disclosure
other forms of unlawful processing
Measures are determined taking into account:
type of data
scope of processing
purpose of processing
available technology
risks to the rights and freedoms of individuals
Access to personal data is limited to persons who need such data for the performance of their duties.
21. CHILDREN’S DATA
In connection with bookings, we may process personal data of children and babies where such data is necessary for:
the booking
determining the number of guests
statutory guest registration
compliance with other contractual or legal obligations
Such data is not used for unrelated purposes unless an appropriate legal basis exists.
22. AUTOMATED DECISION-MAKING
Lovely Istria generally does not make decisions producing legal effects for individuals solely by automated processing of personal data, including profiling, unless such automated processing is lawfully introduced and the user has been appropriately informed in advance.
23. YOUR RIGHTS
Depending on the circumstances and legal basis of processing, you have the right to:
23.1. Right of access
You may request confirmation as to whether we process your personal data and obtain access to such data.
23.2. Right to rectification
You may request correction of inaccurate or completion of incomplete personal data.
23.3. Right to erasure
In circumstances provided for by the GDPR, you may request deletion of your personal data.
The right to erasure is not absolute.
We cannot delete data where we are legally required to retain it or where it is necessary for the establishment, exercise or defence of legal claims.
23.4. Right to restriction of processing
Where provided for by the GDPR, you may request restriction of processing.
23.5. Right to data portability
Where the conditions of the GDPR are met, you may have the right to receive certain data in a structured, commonly used and machine-readable format.
23.6. Right to object
Where processing is based on legitimate interests, you have the right to object on grounds relating to your particular situation.
You may object to direct marketing at any time.
23.7. Right to withdraw consent
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
24. HOW TO EXERCISE YOUR RIGHTS
You may submit a request to:
Please provide sufficient information to allow us to identify:
the data concerned
the right you wish to exercise
your identity
Where there are reasonable doubts regarding the identity of the person submitting the request, we may request additional information necessary to verify identity.
We will not request more data than reasonably necessary for this purpose.
We respond to requests within the time limits prescribed by the GDPR.
25. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
If you believe that the processing of your personal data is not in compliance with data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.
In Croatia, the competent authority is:
Croatian Personal Data Protection Agency (AZOP)
Information on how to lodge a complaint is available on the official AZOP website.
You are also welcome to contact us first so that we may attempt to resolve the matter directly.
26. EXTERNAL LINKS
Our website may contain links to websites or services operated by third parties.
Lovely Istria does not control the privacy practices of such third parties.
We recommend that you review the privacy policies of any external service before providing personal data.
27. SOCIAL MEDIA AND COMMUNICATION PLATFORMS
If you contact us through:
WhatsApp
Facebook
Instagram
other social media or communication platforms
certain personal data is also processed by the provider of that platform under its own privacy rules.
Lovely Istria does not have full control over the way such platforms process data within their own services.
28. BOOKING PLATFORMS
If you make a booking through an external booking platform such as Airbnb, Booking.com, Vrbo, HomeToGo or another partner, that platform may act independently as a controller for certain processing activities.
Processing carried out independently by such a platform is governed by its own privacy policy.
Lovely Istria is responsible for the processing of personal data carried out as part of its own business activities.
29. MANDATORY AND VOLUNTARY PROVISION OF DATA
Certain personal data is required:
to perform a booking
to enter into or perform a contractual relationship
for statutory guest registration
for accounting or tax obligations
If such information is not provided, we may not be able to complete the booking or provide certain services.
Data that is not necessary for these purposes is provided voluntarily unless clearly stated otherwise.
30. CHANGES TO THIS PRIVACY POLICY
We may amend this Privacy Policy from time to time due to:
changes in our business
introduction of new services
changes in technological solutions
changes in legal obligations
improvements to data protection
The currently valid version will always be published on our website.
Where significant changes are made, we may provide additional notice if required or appropriate.
31. CONTACT
For any questions concerning this Privacy Policy or the processing of personal data, please contact:
Lovely Istria d.o.o.
Bunarska cesta 102
52100 Pula
Croatia
OIB: 01645881428
E-mail: info@lovelyistria.com
Web: www.lovelyistria.com
32. FINAL PROVISION
This Privacy Policy applies to personal data processed by Lovely Istria in connection with its business activities, website, booking process, communications with guests and property owners and related activities.
Lovely Istria aims to process only personal data necessary for a specific and lawful purpose, retain it only for as long as necessary and protect it through appropriate technical and organisational measures.