Sunny Day Orebić respects visitors’ privacy and processes personal data only when needed for communication, inquiry handling and the provision of accommodation services.
1. Data controller
The controller is the accommodation provider operating under the name Sunny Day Orebić, Orebić, Croatia. For privacy questions, please use the contact details published on the Contact page.
2. Data we collect
When you submit an inquiry, we may process your name, email address, phone number, arrival and departure dates, number of guests, message content and technical data required for the security and operation of the website.
3. Purposes and legal bases
- responding to inquiries and checking availability — steps taken at your request before entering into a contract;
- communication related to a reservation and stay — performance of a contract;
- compliance with legal obligations applicable to accommodation providers;
- website security and technical operation — legitimate interests where applicable;
- analytics or marketing — only on the basis of prior consent if such technologies are introduced later.
4. Recipients
We do not sell personal data. Where necessary, data may be processed by technical service providers supporting the website, hosting or form delivery. The website is intended to be hosted on Cloudflare Pages, and the inquiry form may later be connected to Web3Forms or another selected provider. The Location page may display a map through OpenStreetMap, whose service may receive technical data such as your IP address. If you contact us through WhatsApp, data is also processed within WhatsApp/Meta under their privacy terms.
5. Transfers outside the EEA
Some technical service providers may process data outside the European Economic Area. Where applicable, transfers should rely on an appropriate GDPR safeguard, such as an adequacy decision or Standard Contractual Clauses.
6. Retention
Inquiry data is retained only for as long as necessary for communication, reservation handling and compliance with legal obligations. Data that is no longer required is deleted or anonymised unless a longer retention period is required by law.
7. Your rights
You may request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent where processing is based on consent. See the GDPR rights page for details.
8. Cookies and local storage
The current version of the website does not load analytics or marketing cookies. Browser local storage is used only to remember your privacy choice. If optional technologies are added later, they will not be activated before the required consent is obtained.
9. Security
We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss or misuse.
10. Changes
This policy may be updated from time to time due to changes in website functionality, service providers or legal requirements. The last-updated date appears at the top of this page.