PRIVACY POLICY

1. General information

This notice explains how Dante Hospitality d.o.o., Dubrovnik, Branitelja Dubrovnika 12, OIB: 45291201948, as the data controller, processes your personal data.

This Privacy Policy applies to the processing of personal data collected through our website, during the reservation process, during your stay at the hotel, at reception/check-in, through payment processing, and through video surveillance in designated areas of the hotel. This Privacy Policy applies to hotel guests, persons making or managing reservations, members of a guest’s travel party, website visitors, persons communicating with us, visitors to the hotel premises, and persons captured by video surveillance in designated monitored areas.

We are commited to processing your personal data strictly in line with the applicable data protection law, including the Regulation (EU) 2016/679 (General Data Protection Regulation).

We may update this Privacy Policy occasionally and the most recent version will be published on this webpage.

2. What personal data we collect about you

We only collect personal data about you when we need to and this may include:

· First and last name;

· Identification document data required for guest registration and legal compliance;

· Contact details such as e-mail address, phone number, and home address;

· Payment and billing data, such as payment method, transaction details, invoice details, and limited card/payment information processed through payment service providers

· Technical data, such as IP address, website visits and interactions with communications sent by us (e.g. email opens and clicks);

· Other data, such as age of children (e.g. for baby cot preparation), whether the group consists of young persons (where relevant for the property owner), check-in and check-out data, including arrival and departure dates, room/stay details, booking history and information necessary for guest administration, or other details you voluntary share with us for the purposes of your stay;

· CCTV footage/images on the premises / entrance of the hotel, where video surveillance is in place for security purposes.

We will collect this information directly from you or those travelling in your party. Where data is required by law (e.g. eVisitor registration), failure to provide it may result in us being unable to accommodate your stay. Therefore, we may request an identification document at check-in for the

purpose of verifying identity and collecting the information required for guest registration and legal compliance. We only record the information necessary for these purposes, unless copying or retaining a document is specifically required or permitted by applicable law or necessary for the establishment, exercise or defence of legal claims.

We generally do not process special categories of personal data. However, we may do so where it is necessary for the purposes of your booking, for example to identify accommodation that meets your requirements or for insurance purposes, and only where a valid legal basis applies.

3. Why we use your personal data and on what basis

We only use your personal data where we have a lawful basis under the Regulation (EU) 2016/679 (General Data Protection Regulation), and other applicable laws. This includes:

· performance of a contract (processing reservations and providing accommodation services);

· compliance with legal obligations (for example reporting guest data through the Croatian eVisitor system);

· legitimate interests in operating and improving our services;

· consent (for example when you agree to receive marketing communications);

· to comply with a legal obligation.

We process your personal data for a range of purposes to deliver and improve our services. This includes, but is not limited to:

· managing bookings, processing payments, and handling related customer service enquiries;

· sending marketing communications and personalised content (with your consent where required);

· improving our website, services, and customer experience through feedback

· running promotions, competitions, and collecting reviews;

· preventing fraud, ensuring security, and complying with legal obligations;

· enforcing our terms and conditions and protecting our rights and interests.

· registering guests and fulfilling our statutory obligations under Croatian tourism, hospitality, tax and related regulations, including registration through the eVisitor system;

· verifying guest identity at check-in, administering the stay, issuing invoices, processing payments and handling deposits, refunds, chargebacks or payment disputes;

· protecting the safety and security of guests, staff, visitors and hotel property through video surveillance in designated areas;

· preventing, detecting and documenting fraud, misuse, incidents, damage, unlawful conduct or security events;

· establishing, exercising or defending legal claims.

When we process your personal data based on our legitimate interests, these include operating and improving our business, delivering high-quality customer service, maintaining the security and functionality of our services, promoting our products effectively, and protecting our rights as well as those of our customers, partners, and the public.

For guest registration and statutory reporting, we process your personal data because this is necessary to comply with our legal obligations. For accommodation services, billing and payment administration, we process your data where necessary for the performance of a contract and/or compliance with legal obligations. For video surveillance, we rely on our legitimate interest in protecting persons and property, unless applicable law requires another legal basis.

If we process special categories of personal data, we must have additional justification to do so and only use it where we have your explicit consent, you have made the information public, in relation to legal claims or it is necessary for reasons of substantial public interest.

4. Video surveillance

We use video surveillance in designated areas of the hotel, such as the lobby, entrance, reception and other common areas, for the purpose of protecting the safety and security of guests, visitors, staff and property, preventing and investigating incidents, and protecting our legal interests.

Video surveillance does not cover private areas such as guest rooms, bathrooms, changing areas or other areas where guests reasonably expect privacy.

Video surveillance footage is accessed only by authorised persons and, where necessary, may be shared with competent authorities, courts, insurers, legal advisers or other authorised recipients in connection with security incidents, legal obligations or legal claims. Footage is retained only for as long as necessary for the above purposes and, in any case, no longer than the maximum period permitted by applicable law (six months), unless the footage is required as evidence in legal, administrative, court or other equivalent proceedings.

5. How long we keep your data

We have retention periods in place to ensure that your information is only stored whilst it is required for the relevant purposes, in line with relevant industry standards or to meet legal requirements. Where your information is no longer required, we will ensure it is disposed of or deleted in a secure manner or anonymised so it can no longer be attributed to you.

Guest registration, billing, accounting and tax-related data are retained for the periods required under applicable Croatian laws and regulations.

Payment-related data is retained for as long as necessary to process the payment, handle refunds, chargebacks, accounting, tax and legal obligations, and protect our rights. We do not store full payment card data unless this is strictly necessary and permitted by applicable payment security rules. Card data is generally processed by our payment service providers.

6. Third parties we share your data with

We may share your personal data with trusted third parties where necessary to provide our services, fulfil our contractual obligations, comply with legal requirements, or pursue our legitimate interests. These third parties may include service providers who support our operations (such as payment service providers, IT and marketing services), business partners involved in delivering your bookings, analytics and advertising partners (where consent has been given), and legal or regulatory authorities when required.

Depending on the purpose of processing, recipients of personal data may include the Croatian Tourist Board/eVisitor system, competent public authorities, police or inspection authorities where legally required, payment service providers, banks, accounting and tax advisers, IT and PMS/booking system providers, insurers, legal advisers, security service providers and other service providers necessary for hotel operations.

Third parties are required to process your personal information in line with data protection legislation. Where a third party is acting on our behalf, we do not allow them to use your information for their own purposes and we ensure they have appropriate security measures in place to protect your information.

7. International transfers of data

We generally do not transfer your personal data to countries outside the European Economic Area (EEA). However, in certain cases such transfers may occur. In such situations, we ensure that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection laws.

These safeguards may include the use of standard contractual clauses approved by the European Commission, adequacy decisions for certain countries, or ensuring that recipients are certified under approved data protection frameworks. You may contact us for further information on the specific safeguards in place for any international transfer of your personal data.

8. Automated decision-making

We do not use your personal data for automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.

9. Your rights

You have the right to:

· request access to your personal information, including providing you with a copy of the personal data you are entitled to;

· request that we correct any inaccuracies in your personal data or add relevant details where the personal data we hold is incomplete;

· request the erasure of your personal data, where we have no good reason to keep it;

· object to way we use your personal data, where we rely on legitimate interests or use it for direct marketing;

· request that we limit that way we use your personal data;

· request we send you or a third party a copy of the personal data we hold about you in a commonly used format;

· withdraw your consent where rely on it to process your data.

In addition to the above, you have the right to lodge a complaint with the authorized data protection authority (if you are based in Croatia – Croatian Personal Data Protection Agency, Fra Grge Martića 14, Zagreb https://azop.hr/naslovna-english/)

If you wish to exercise any of these rights, please get in touch (see our contact details in section 10).

10. Contact us

If you have any questions relating to our use of your personal data or wish to exercise any of your rights, please contact us at: info@heritagehotellucia.com

Notice on cookies

Cookies are small text files that are placed on your device. We use cookies to enhance your visit, evaluate and measure website usage and interactions with our emails and develop our services. Cookies are also used by us and by third parties to display personalised advertisements to you.

We use the following categories of cookies:

“Strictly necessary” cookies for the functionality of this website. These cookies are essential to enable users to move around this website and use its features.

“Performance” cookies which collect information about how users navigate this website, for instance which pages users access most frequently. They identify how users interact with our website, find out which pages seem to hold people up, which pages are not used often, which pages take a long time to load, what pages users tend to visit and in what order. All of this helps us to refine and develop our website to try and make them more usable when a user visits us again in future.

“Functionality” cookies which allow this website to remember choices you make. For example, what language you prefer and location you are in. A mix of first-party and third-party cookies are used.

“Targeting or advertising” cookies collect information about your visit to our website, such as content viewed, links followed and information about your browser, device, and IP address to display personalised advertisements. Sometimes we share limited aspects of this data with third parties for advertising purposes, so when you visit another website, you may see advertising based on your browsing patterns on our website.

By clicking ‘accept’ you consent to our use of cookies. You may at any time block specific or all cookies completely by changing the browser settings on your device. The location of these settings will depend on the browser you use. The duration of each cookie can also be found in your browser settings. However, you should be aware that if you block some cookies, there may be functions and services that you will be unable to use on the website.

For more general information about cookies and how to disable them through your browser, visit allaboutcookies.org. Contact us (see Section 10) if you have questions about the cookies used on this website.