Privacy notice

1. Controller and contact

The controller for the processing described here is Villa Emmaus · Put Gospojice 41, Stari Grad, Hvar, Croatia · hello@villaemmaus.com. Use the email address above for privacy questions or to exercise your rights.

2. Enquiries and bookings

When you send an enquiry, we collect your name, email address, requested dates, number of guests, enquiry type, how you found us, and the information in your message.

We use it to answer, check availability, prepare an offer, and take steps you request before a possible booking. The legal basis is Article 6(1)(b) GDPR. If a booking follows, we also process data to perform the contract and meet accounting, tax, tourism, and other legal duties.

Enquiries that do not lead to a booking are normally deleted or anonymised within 24 months after the last meaningful contact. Booking and accounting records are kept for periods required by Croatian law.

3. Website operation and security

Hosting and infrastructure providers may process IP address, request time, requested URL, browser information, and security diagnostics to deliver, protect, and troubleshoot the site.

This is based on our legitimate interest in a secure and reliable website under Article 6(1)(f) GDPR. Technical logs are normally retained for no longer than 30 days unless a security incident requires longer preservation.

4. Optional PostHog analytics

Only after you accept analytics, PostHog measures page visits and selected interactions such as navigation, enquiry-type changes, and successful or failed form submissions. Autocapture and session replay are disabled. We do not send your name, email address, requested dates, or enquiry message to PostHog.

The legal basis is consent under Article 6(1)(a) GDPR. Reject or withdraw it at any time through “Cookie settings” in the footer. PostHog uses its EU endpoint and local browser storage. Analytics events should not be retained for this site for longer than 24 months.

5. Recipients and transfers

Providers of hosting, database and object storage, email, security, and technical support may process necessary data for us. Optional analytics data is processed by PostHog, Inc. Providers receive only data needed for their service and are contractually bound where required.

We prefer EEA services and storage. Access or transfers outside the EEA must rely on an adequacy decision or safeguards such as the European Commission Standard Contractual Clauses, with supplementary measures where required. We may disclose data to authorities when the law requires it or to establish, exercise, or defend legal claims.

6. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, or portability, and object to processing based on legitimate interests. You may withdraw consent at any time.

Send requests to hello@villaemmaus.com. We may verify your identity and normally respond within one month. You may complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr, or your local supervisory authority.

7. Required data, security, and changes

The form marks details needed for an answer. Without them we may be unable to respond or prepare an offer. We do not make solely automated decisions with legal or similarly significant effects.

We use proportionate safeguards including access controls and encrypted transport, but no internet service can guarantee absolute security. We may update this notice when services, providers, or legal obligations change.