01 Who is responsible for your data
The controller of your personal data is Sandra Skandul (OIB: 84343904146), a private accommodation provider operating Apartments Skandul, Slobode 59, 52221 Rabac, Croatia.
You can reach us by email at info@apartments-skandul.com.
02 Inquiries through the contact form or by email
When you send us an inquiry we process the details you give us: your name, email address, and – if you provide them – your phone number, preferred apartment, travel dates and your message.
We use them only to answer your inquiry and, if you wish, to prepare and confirm your stay. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract); for general questions not related to a stay, it is our legitimate interest in replying to you (Article 6(1)(f) GDPR).
The form does not store your inquiry on the website: it is delivered to our inbox as an email. Providing your details is voluntary, but without a name and an email address we cannot reply.
03 Spam protection
To protect the form against automated spam, we check when the form was opened and use a hidden field that people do not see. To limit repeated submissions, your IP address is kept in the server’s working memory for at most 15 minutes and is never written to a file or database. The legal basis is our legitimate interest in keeping the form usable and secure (Article 6(1)(f) GDPR).
04 Visiting the website
When you open a page, the web server necessarily processes technical data such as your IP address, the date and time, the page requested and your browser type, in order to deliver the page and keep the website secure (Article 6(1)(f) GDPR).
The website is hosted by DigitalOcean, LLC (New York, USA) on a server in Frankfurt, Germany, within the EU. DigitalOcean is certified under the EU–US Data Privacy Framework. Server logs are kept for 14 days.
Fonts and images are served from our own server. The website does not embed maps, videos or social media content; links to Google Maps or Facebook open those services only when you click them.
05 Website statistics (Google Analytics)
Only if you allow analytics cookies, we use Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors use the website (pages viewed, approximate location, device and browser). IP addresses are anonymised. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in the .
Google may process this data in the United States. Google LLC is certified under the EU–US Data Privacy Framework, on the basis of the European Commission’s adequacy decision.
06 Guests staying with us
If you stay with us, Croatian law requires us to register our guests with the authorities (the eVisitor system), using the details from your identity document. The legal basis is our legal obligation (Article 6(1)(c) GDPR).
07 Who receives your data
We do not sell your data or use it for advertising. It is only shared with service providers who process it on our behalf, and with authorities where the law requires it:
- Brevo (Sendinblue SAS, France) delivers contact form messages to our inbox by email.
- ImprovMX Incorporated (USA) forwards email sent to our address to our mailbox, which is provided by Google Ireland Limited (Gmail).
- Our hosting provider: DigitalOcean, LLC (USA), with the server in Frankfurt, Germany.
- Public authorities (for example the guest registration system), where we are legally obliged to.
08 How long we keep your data
- Inquiries: 2 years after our last contact, unless they lead to a booking.
- Booking and guest records: as long as Croatian tourism, tax and accounting laws require.
- IP addresses for spam protection: at most 15 minutes, in memory only.
- Your cookie choice: 6 months (see the cookie policy).
09 Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- restrict processing (Article 18);
- data portability (Article 20);
- object to processing based on our legitimate interests (Article 21);
- withdraw your consent at any time, without affecting earlier processing (Article 7(3)).
To use these rights, write to us at info@apartments-skandul.com. We will reply within one month.
You also have the right to lodge a complaint with the Croatian supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
10 Security and automated decisions
The website is served over an encrypted connection (HTTPS), and the contact form sends your inquiry directly to our inbox without storing it on the website. We do not make decisions about you based solely on automated processing, and we do not create profiles.
11 Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version.