Operation: DUE VILLAS, Put Dobriča 51A, Dobropoljana, the island of Pašman, Republic of Croatia, which provides accommodation services to its clients (from now on referred to as “Villa”).

The operator of DUE VILLAS and the website www.duevillas.com is IMMO MARE, d.o.o., registered office: Šetalište 150. brigade Hrvatske vojske 8, 10000 Zagreb, Republic of Croatia, Identification Number (MBS): 080611837, Identification Number (OIB): 36952420888 (from now on referred to as the “Operator “).

For these Terms and Conditions, a client is any natural person who concludes a contract with the operator on the provision of the operator’s accommodation services in the Villa and, together with them, all persons registered for accommodation in the Villa (from now on referred to as “client/clients”).

These Terms and Conditions regulate information regarding the processing and protection of personal data of Clients by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons in the processing of personal data and the free movement of such data, which repeals the directive 95/46/EC (from now on referred to as “GDPR”) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/2018, referred to as “the Act”).

The operator has taken appropriate technical, organizational, and personnel measures by the GDPR, the law, and other relevant legal regulations of the Republic of Croatia to ensure the protection of the personal data of clients against illegal forms of processing:

The operator of the Villa collects, obtains, and processes the personal data of clients for subsequent activities (purpose of processing):

Personal data means the client’s first and last name, OP or travel document number, visa number, nationality, address of permanent residence, date of birth, length of stay, account number, e-mail, telephone number, and names and surnames of co-resident children.

– the right to correct (Article 16 GDPR) those personal data that are however inaccurate incomplete or erroneous. This right is followed by the right to be informed regarding the correction or deletion of personal data or the restriction of their processing: the operator is obliged to inform individual recipients to whom personal data have been made available about the correction or deletion of personal data or the restriction of processing, except cases when this proves to be impossible or it requires disproportionate effort,

– the right to erasure (Article 17 GDPR), which is also referred to as the so-called “right to be forgotten”. This right includes the right to limit processing if personal data are no longer necessary for the stated purpose, or if the operator no longer has a legal obligation or reason to further process (especially archive) personal data, including cases where the client would not further consent to further processing. The right to erasure does not apply if the processing of personal data is necessary to fulfill legal obligations, for the application, exercise, or defense of legal claims and other cases specified in the GDPR Regulation.

– the right to limit processing (Article 18 GDPR), includes the right for the operator to limit the processing of the client’s data if: a) the client denies the accuracy of the personal data, for the time necessary for the operator to verify the accuracy of the data, b) the processing is illegal and instead of erasing personal data, you request the restriction of their use, c) the operator no longer needs the personal data for processing, but you require them for the determination, exercise or defense of a legal claim, d) the client has objected to the processing, for a period unless it is verified whether the legitimate interests of the operator prevail over the legitimate interests of the client.

– the right to portability (Article 20 GDPR), includes the right to transfer automatically processed personal data obtained based on consent from the operator to another entity when the operator transfers the client’s data in a commonly used format. The transfer of personal data must be technically possible.

– the right to object to the processing (Article 21 GDPR) of personal data, if the client sends commercial notices or evaluates purchase preferences. Based on the exercise of this right, the operator will immediately stop processing personal data for this purpose.

– the right to withdraw consent: if the operator processes personal data based on the consent granted, at any time by sending a written objection to the processing of personal data.

– the right to file a complaint, if the client believes that the operator does not lawfully process his personal data, to the Croatian Agency for Personal Data Protection, Selska cesta 136, HR – 10 000 Zagreb, e-mail: azop@azop.hr, fax: 01/ 46-090-99.

The operator may use personal data in the form of cookies stored in the client’s internet browser to improve the provided accommodation services or to analyze the results. Cookies of the operator or third parties do not contain any personal data and only collect anonymous data associated with the user ID. This is data on which pages the client viewed or what content he searched for. This data is never linked to the client’s data.

The client has the option to stop the use of cookies and thus the option to cancel their sending to the server in the event of a repeat request from the server. The operator places great emphasis on the safe use of the Internet and electronic media used for data transmission. The operator urges clients to strive for the highest possible security on their part, namely by using the current version of the Internet browser, concealing the security elements used to access the account, and caution when transferring data via electronic media and the Internet.

The website of the operator uses analytical tools to measure performance and traffic, mainly the Google Analytics tool, the web analysis service of Google Inc. This tool uses Cookies, which are stored in the memory of the client’s website. This information is usually transferred to a Google server, where it is stored in memory. Google does not associate the user’s IP address with their data. The data is anonymous.

User data is stored on the Google server for 26 months. You can find more detailed information about the storage of personal data used for the analysis of website traffic on the pages of Google – Google Analytics data storage. The Google Analytics tool may store client demographic data such as gender, age, location, etc. The data is anonymous. The Google Analytics tool can be linked to the Google Search Console tool, which is used to analyze searches through the full-text Google search engine and the client’s access to websites.

Part of this analysis may include the transfer of the client’s demographic and other personal data. The data is anonymous. The Google Analytics tool can be linked to the Google Search AdWords tool, which serves to display Internet advertising (in the form of text and graphic banners) and to target advertising to the right audience. Part of this analysis may include the transfer of the user’s demographic and other personal data. The data is anonymous.

Third-party plugins (applications) are connected to the operator’s website, such as Facebook, Google Plus, YouTube, etc. These applications are stored and run on third-party servers. The operator does not influence ensuring the protection of personal data when using third-party applications. The website of the operator uses third-party plugins that allow users to share, comment, and rate the content of the website on social networks, or register through a third-party account. In such a case, the internet browser creates a direct connection between the user and the third party, during which cookies are used and the client’s data is transferred between the website, the user’s browser, and the third-party server. As a rule, the data is not linked to the user’s data. The operator uses fundamentally reliable sources of plugins and add-ons on its pages. The operator cannot guarantee the functionality or reliability of third-party plugins.

In the case of user actions on the operator’s website via social plugins, these actions may be displayed on third-party sites depending on the user’s account settings (e.g. Facebook Like, Google Plus, Sharing on social networks, etc.).

The website of the operator may display advertisements that include third-party advertisements and may be used to display advertisements on third-party websites. The advertising system can use PPC technology or PPI and remarketing. These technologies are used on the site to provide the user with the most relevant offer, even on third-party websites. Through personalized advertising focused on the user’s interests, the operator provides a more interesting display of advertising to which the user has a personal relationship.

Advertisements are displayed on the website of the operator and the websites of third parties with the help of cookie technology and analysis of user behavior on the Internet. This website uses the Google AdWords and Facebook Ads advertising system.

The operator may not send news to natural persons until the data subject agrees. Clients give the operator permission to send electronic news to their email address, which they provided during registration for ordering news (on the website, via email or in printed form). By providing their address, clients agree to sending promotional materials to their address.

The operator is obliged to store personal data on a special list, separate from the data provided to the operator for other purposes. This list must be available only to authorized persons of the operator and data processors. The operator must not disclose the list or data to any third party and/or unauthorized parties and must take all security measures to prevent unauthorized persons from accessing them.

The purpose of managing data related to the sending of news is to provide comprehensive, general and client-oriented information to the addressees regarding the operator’s latest offers. Clients can unsubscribe from receiving news at any time by sending an e-mail to the operator.

The operator checks the list of subscribers of news every five years and requests confirmation of consent to subscribe to news after five years. Within 30 (thirty) days after sending such e-mails, the operator must delete from the list all data subjects who have not confirmed their consent to receive news.

Clients can opt-in to auto-subscribe from facebook by clicking “like” and also opt-out by clicking “dislike” and/or delete unwanted auto-connect from their wall via the wall settings.

The website of the operator may contain maps using the Google Maps service. This service may store the user’s personal data related to his location.

Users of the operator’s websites can contribute their content in the form of comments, ratings, etc., either directly on the website or on social networks or on their own pages on social networks in the form of sharing and rating. Any content, information or other forms of data and communication that have been published on the site by users on websites or shared through social networks and other applications and on third-party websites are not considered confidential and are not subject to trade secret protection.

The operator does not take responsibility for user contributions, information and communication. At the same time, it is expressly forbidden to publish or transmit to the website any illegal, threatening, defamatory, obscene materials or other materials insulting human dignity or of any discriminatory nature.

When filling in the personal data of the client and all the guests staying with him and sending the completed order for booking a stay in the Villa, the client acknowledges that his personal data will be processed in accordance with the purpose of processing in the manner specified in these Terms and Conditions.

Every person older than 16 years of age must present a valid identity document (OP or PAS) upon arrival. For persons under the age of 16, personal data is reported by parents or authorized adults. If, for any reason, the client refuses to show a valid identity card or passport, he cannot be provided with accommodation in the Villa by the operator.

The operator will process personal data without the need to request the client’s consent, while the legal basis for processing your personal data is Art. 6 par. 1 letter b) of the GDPR Regulation: fulfillment of the contract and measures prior to the conclusion of the contract (based on Recital 44 of the GDPR Regulation).

The operator stores the client’s personal data for the period necessary to exercise the rights and obligations arising from the contractual relationship on the provision of accommodation services (for the period established by the relevant legal regulation, in the sense of the need to preserve tax and accounting documents, which is usually 10 years). After the expiration of the personal data storage period, the operator deletes the client’s personal data.