Privacy policy

Who processes your data

The controller is NOVAS GROUP d.o.o. (puni naziv: NOVAS GROUP društvo s ograničenom odgovornošću za poslovanje nekretninama i razvoj projekata), Veslarska 2, 51000 Rijeka. OIB 86205148028, MBS 040496025. The registered seat is in Rijeka; the properties we let are in Crikvenica.

What we collect

We collect only what we need to answer your enquiry, host you and meet our legal obligations:

• From the enquiry form: name, e-mail address, phone, property, arrival and departure dates, number of guests and the message text.
• On arrival: identity document details for every guest, as far as registration in eVisitor requires.
• Technical: visit logs kept by the hosting provider, and a counter of enquiry-form submissions in which your IP address is stored as a hash.

Why we process it, and on what basis

Each type of data has its own purpose and its own legal basis under Article 6 GDPR:

• Answering the enquiry and preparing the booking — steps taken at your request before entering into a contract (Art. 6(1)(b)).
• Booking and stay — performance of the accommodation contract (Art. 6(1)(b)).
• Guest registration in eVisitor and issuing invoices — legal obligation (Art. 6(1)(c)).
• The counter of enquiry-form submissions — our legitimate interest in keeping bots from flooding the form (Art. 6(1)(f)).

Cookies and visit measurement

We use no visit-measurement tool at all: no Google Analytics, no social network pixels, no third-party scripts.

The only cookie the site sets is pll_language, with which Polylang remembers the language you chose. It is necessary for the site to work and does not track you. The cookie notice sets no cookie; it remembers your choice in the browser’s local storage, from where you can clear it together with the site data.

Who we share it with

For booking we pass data to Rentlio — see the next section. Other recipients are eVisitor, the hosting provider on whose servers the site runs, and the bookkeeping service for issued invoices. We do not sell data and do not pass it on for advertising.

Prices and booking (Rentlio)

Booking runs through Rentlio d.o.o., Put Nina 214, 23000 Zadar, Croatia, OIB 27842617105, as a processor acting on our instructions. Their privacy policy is at rentl.io/izjava-o-privatnosti. A data processing agreement under Article 28 GDPR is in place with Rentlio.

Prices

The prices you see on the cards and on the property pages come from Rentlio. Our server asks for them at most once every six hours, and that request carries none of your details — no name, no IP address, none of the dates you typed in.

Your browser does not talk to Rentlio in this step. There is no Rentlio script and no third-party cookie on our pages, and Rentlio sees a call from our server, not your IP address.

Rentlio’s answer stays with us in a cache for at most six hours. All it holds is the lowest nightly price and the currency — nothing that relates to you.

We process none of your personal data for this step, so it needs no legal basis under Article 6 GDPR.

Booking

A booking is not completed on this site. When you fill in the dates and the number of guests in the panel and confirm, our server redirects you to the Rentlio Booking Engine, on a Rentlio subdomain of the form book.rentl.io. The address carries the dates, the number of adults, the number of units and the language, and nothing else. Your name and contact details do not go with it, because at that step you have not entered them yet.

You enter your name, your contact details and your payment details there, on Rentlio’s site, and at that step Rentlio’s terms and privacy policy apply. Payment details do not pass through our site or our server.

For a property that is not set up in Rentlio, the same button leads to our enquiry form with the dates already filled in, and what you send in the form comes to us.

The legal basis for passing the booking on is performance of the contract (Art. 6(1)(b)). As a processor, Rentlio keeps the data for as long as our contract with them runs and deletes it once that ends, in line with their own privacy policy.

How long we keep it

• Enquiries that do not lead to a booking — one year, then we delete them.
• Booking data and issued invoices — 11 years, as Croatian accounting law requires.
• Guest registrations — for the periods eVisitor prescribes.
• Technical visit logs — briefly, under the hosting provider’s rules. Prices from Rentlio stay in the cache for at most six hours and hold none of your details; the form-submission counter lasts an hour.

Your rights

At any time you can ask for access to your data, for it to be corrected or erased, for processing to be restricted, for portability, and you can object to the processing. Where processing rests on consent, you can withdraw it, which does not affect the lawfulness of processing before withdrawal.

Send requests to info@novasgroup.hr; we reply within one month. If you believe we are processing data unlawfully, you can complain to the Croatian supervisory authority: Agencija za zaštitu osobnih podataka, Selska cesta 136, 10000 Zagreb.

Privacy contact

Send requests to info@novasgroup.hr. We respond within the deadlines set by the GDPR.