Data protection notice
Here we explain which personal data we process when you use StayBravo, why, on what basis, for how long and what rights you have. In short: we use no tracking cookies, we do not sell data and we use no ad networks or third-party analytics. We collect data when you give it to us (an enquiry, an account, a suggestion) and, minimally, for security and counting visits.
Who is the controller
Absolute BAT društvo s ograničenom odgovornošću za usluge (Absolute BAT d.o.o.), Lipa 36/B, 51000 Rijeka, Hrvatska, OIB 66641696241. Send all data protection questions to [email protected].
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Forwarding an enquiry to the host | name, email address (stored encrypted), message, dates, number of guests | performance of the enquiry service you request (Art. 6(1)(b) GDPR) | 12 months, then anonymised |
| Protecting forms from abuse (spam, automated enquiries) | daily pseudonymous fingerprint of IP address and browser | legitimate interest in protecting the service (point f) | 30 days |
| Host account | email, property data and photos, record of accepted terms | contract (b) | while the account exists, then statutory periods |
| Suggestions, photos and content reports | name, email, text, photo | legitimate interest in keeping content accurate and legal obligation to handle reports (f, c) | up to 24 months after the case is closed |
| Counting visits (statistics) | pages viewed, country, device type, referral source and a daily rotating pseudonymous hash to count unique visits; no cookies | legitimate interest in understanding how the portal is used (f) | individual events 30 days, then totals only |
| Security and technical server logs | IP address, browser, time and address of the request | legitimate interest in security and fixing faults (f) | a short period, only as long as needed |
| Log of sent e-mail | masked recipient address, message type, delivery status (no content) | legitimate interest in security, fixing faults and protecting the sender reputation (point f) | 90 days |
| Unsubscribing from messages | hash of the email address | legal obligation and legitimate interest (c, f) | as long as needed to honour the opt-out |
Enquiries and hosts
When you send an enquiry we are the controller for receiving it, forwarding it to the host and sending you a confirmation. The host who receives it is a separate controller for further communication with you and is responsible for it. Do not send us data that is not needed for the enquiry (such as card numbers).
Statistics without cookies
We count page views with our own system. Bots are not counted. To count unique visits we use a hash that changes every day and cannot be linked to previous days, and if your browser sends a Global Privacy Control or Do Not Track signal we do not record even that. Individual events are deleted after 30 days.
Cookies and local storage
We set no cookies while you browse. The “pv” cookie is set only when you vote on an attraction, solely to prevent repeated voting (90 days). Signed-in hosts have a session cookie needed for login.
Who receives data
We do not sell data. Only these receive it:
- the host you send an enquiry to (as a separate controller);
- Cloudflare (network, attack protection, email routing), Amazon Web Services (sending email and backups, EU Frankfurt region), mailbox providers and a server in Croatia that we run (as processors);
- competent authorities where the law requires.
Transfers outside the EEA
Cloudflare may process data in the USA on the basis of standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. Other processing takes place in the EEA.
Content and sources
AI tools assist in preparing some texts about places and sights; these tools are not used to process visitors’ personal data. We carry out no automated decision-making or profiling with legal or similar effect, and content ranking is not personalised.
Security
Traffic is encrypted (HTTPS), guests’ email addresses and secrets are stored encrypted, access is restricted, and backups are kept for about 35 days at most.
Children
The service is not intended for people under 16 and we do not knowingly collect their data.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest. Send your request to [email protected]; we reply without delay and within one month at the latest. To protect your data we may ask you to confirm your identity. You may also complain to the Croatian Personal Data Protection Agency (azop.hr).
Partners and acceptance records
To evidence the contract we retain partner/user IDs, encrypted name and email, owner authority, version, SHA-256, exact terms text and acceptance time. No IP or user-agent is stored in that record. A Croatian partner’s private tax/VAT ID is collected for identification and ZPUT compliance preparation on legitimate-interest grounds, not DAC7 or public display in the free pilot. The profile is retained during the relationship, then only for documented legal or evidential purposes. Data export can be requested while active and 30 days after closure. The Privacy Notice is not consent.
Last updated: 2026-10-03