Legal information & Privacy policy

INTRODUCTORY PROVISIONS
Kruc d.o.o., Marka Marulića 14, 23250 Pag, Croatia, PIN: 83389050184 (hereinafter: Kruc d.o.o.), respects your privacy and the security of your personal data. The collection, use and processing of your personal data is conducted in accordance with this Privacy Policy and applicable legislation, including Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR. This Policy is designed to provide clear and complete information to individuals about what personal data is collected, the extent and purpose of processing, and your rights regarding that data. It applies to use of Kruc d.o.o.’s websites, mobile applications, and other online services.

PERSONAL DATA
Personal data refers to any information that can identify you directly or indirectly. Kruc d.o.o. may collect:

• Name, surname, address, date of birth, gender, PIN, identification documents, nationality, e-mail, phone number
• Accommodation details: date of arrival and departure, location, services used, preferences
• Data related to newsletter subscriptions, loyalty programs, surveys, support
• Information received from third parties (e.g. travel agencies)
  
  

LEGAL BASIS FOR PROCESSING
Personal data is processed when:

1. Consent is given – e.g. subscribing to a newsletter
2.  Necessary for contract execution – e.g. online booking
3. Required by law – e.g. guest registration to Croatian eVisitor system
4. Legitimate interests – e.g. notifications about changes in services
5. Other lawful grounds, such as vital interests
   
   

TYPES OF DATA COLLECTED

1. When booking: name, surname, address, email, phone number, PIN, services booked
2. When visiting the portal/app: browsing data, clicks, IP address, device info
3. Inquiries, support, surveys: personal data submitted, email content, complaint details
4. Newsletter sign-up: demographic info, preferences, date of birth
5. Loyalty program: full contact details, interests, password

Kruc d.o.o. may also collect personal data from public registries or business partners.

PURPOSE OF USE
Kruc d.o.o. uses your data to:

• Deliver requested services (e.g. accommodation)
• Provide requested information
• Simplify use of online services (e.g. autofill)
• Offer personalized content and service notifications
• Send newsletters and promotional content (with your consent)
• Prevent fraud and maintain service integrity
• Comply with legal obligations
  
  

SHARING DATA WITH THIRD PARTIES
Your personal data is not sold or leased. It may be shared only with:

• Authorized service providers (IT, marketing, payment processors)
• Government authorities as legally required

All third parties must ensure adequate protection and confidentiality.

YOUR RIGHTS
You have the right to:

• Access, correct, or delete your personal data
• Restrict or object to processing
• Withdraw consent

Requests must be submitted with identity verification. Kruc d.o.o. reserves the right to request additional details for clarification.
If you are unsatisfied with our response, you may contact the Croatian Data Protection Agency.

DATA SECURITY
Kruc d.o.o. protects your data with appropriate technical and organizational measures, including:

• Pseudonymization and minimization
• Access control and monitoring
• Confidentiality obligations for employees and partners
• Secure IT systems and regular testing

You are also responsible for keeping your credentials safe and logging out after use.

DATA RETENTION
Personal data is kept only for as long as necessary to fulfill the intended purpose. Once that period expires, data is deleted or anonymized, unless retention is required for statistical, legal, or archival reasons.

COOKIES AND ANALYTICS
Kruc d.o.o. uses cookies and analytical tools to understand user behavior and improve services. You may disable cookies in your browser settings, but this may affect functionality.

VIDEO SURVEILLANCE
Video surveillance is used to protect people and property (legitimate interest), and where required by law (e.g. currency exchange). Recordings are stored for 15 days on a secure server, with restricted access, unless longer retention is legally required.

LINKS TO OTHER SITES
Our website may contain links to other websites with separate privacy policies. Kruc d.o.o. is not responsible for the privacy practices of these external sites.

SOCIAL NETWORKS
Certain social media features (Facebook, Instagram, etc.) are subject to the privacy policies of those platforms. Please review them before sharing any personal data.

CHANGES TO THIS POLICY
This Privacy Policy replaces all previous versions.
Last updated: April 2023
Kruc d.o.o. reserves the right to change or amend this Policy at any time. Any significant changes will be clearly communicated on the website.