Privacy policy

01Data controller

The controller of your personal data is the accommodation provider named below. Any request about your data may be sent to the same contacts.

• Ivan Bradić
• OIB: 27199275293
• Apatovec, Carine 64, 48260 Križevci
• +385 99 600 3048
• grandisvilla@gmail.com

02What we collect

Through the booking and contact forms we collect your name, email address, telephone number, number of guests, requested dates, and the content of your message including any special requests. If you pay the deposit by bank transfer you may also leave your account number — solely so that we know where to return the deposit if you cancel; that field is optional. We never see or store card details — card payments are handled entirely by Stripe. If you allow analytics, Google Analytics also records details of your visit: the pages you open, the page you came from, your type of device and browser, and your approximate location.

03Why we process it

To process and confirm your booking, to communicate about your stay, to issue invoices, and to meet the statutory guest registration obligations. Details of your visit are used for analytics only with your consent.

04Legal basis

Processing is based on performance of the accommodation contract, on the provider's legal obligations, and — for optional analytics cookies — on your consent.

05How long we keep it

Booking records are kept for as long as tax and hospitality legislation requires. Messages sent through the contact form are deleted once the enquiry is no longer current. Analytics data in Google Analytics is deleted automatically after 14 months at the latest.

06Who we share it with

With the service providers that process data on our behalf: Vercel (site hosting), Supabase (the reservation database), Resend (transactional email), Stripe (card payment processing) and, only with your consent, Google (Google Analytics, site analytics), and where applicable a calendar synchronisation service. We are also required to report guest details to eVisitor, the Croatian guest registration system run by the tourist boards and the Ministry of the Interior. We do not sell your data or pass it to third parties for marketing.

07WhatsApp and Google Maps

Two services are not our processors but decide on the processing themselves, so they are named separately. If you write to us on WhatsApp, you send the message from your own account and the conversation is subject to Meta's terms and privacy policy; we take part in it only as the recipient. The map on the contact page is Google Maps and does not load on its own — until you ask for it, no request reaches Google, and once you open it, Google receives your IP address and may set its own cookies.

08Transfers outside the European Economic Area

Some of those service providers process data on servers outside the European Economic Area, principally in the United States. Those transfers rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework, in accordance with Chapter V of the General Data Protection Regulation.

09Your rights

You have the right to access your data, and to its rectification, erasure, restriction of processing, portability, and to object. You may withdraw consent at any time. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency.

10Data protection contact

Requests concerning personal data should be sent to the contact address published in the imprint.

• +385 99 600 3048
• grandisvilla@gmail.com