In short (TL;DR)
We don't sell your data to anyone.
We don't use Google Analytics, Meta Pixel, or any tracking pixels.
We use your data only for bookings, contact, and — with your consent — the newsletter.
You can request access, correction, or deletion any time — write to info@second-home.hr.
Who controls your data
The data controller under GDPR is the private host operating the Second-Home villa in Ražanj. The exact identification details are at the bottom of this page in the Contact section.
What data we collect
We collect only what we actually need to answer your question or process a booking.
Contact form and chat — Name, e-mail, phone (if you enter one), message, arrival and departure dates, number of guests. For the on-site chat also the conversation itself. Plus IP address and user-agent to keep spam out.
Booking and payment — The details from your enquiry, the booking code, the amount, method and status of payment and the provider's reference. We never receive your card details — you enter them with the provider Stripe. The invoice carries the payer's name and address.
Newsletter — E-mail, name (if you enter one) and language. Sign-up is double opt-in. In every mailing we measure whether it was opened and whether a link was clicked, which tells us what is useful. Measurement stops when you unsubscribe.
Guest reviews — Rating, title, text, name and country. We publish only a shortened name (for example "Ana N.") and the country — never your e-mail or booking details. Every review is checked by the owner before it appears.
Visit statistics — A random browser identifier, the pages viewed, approximate location at country and city level, device type, browser and language. All first-party, no Google Analytics. We do not follow you across other websites.
Cookie consent — Your choice of categories, the text version, the language and a hashed IP address and user-agent. We keep this as proof that consent was given, as the GDPR requires.
Delivery log — Which message went to which address and whether it was delivered, opened or rejected. Without it we would not know that your booking confirmation never reached you.
Technical data and admin sign-ins — IP, user-agent and request time in the server logs, for up to 30 days. Admin sign-in attempts are recorded with a hashed IP address to guard against break-ins.
Why we collect this data
Reply and booking — Without contact details we cannot reply, and without payment details we cannot complete the booking. Legal basis: contract and pre-contractual steps (Art. 6/1/b GDPR).
Site security — Preventing abuse (spam, password guessing, scraping). Legal basis: legitimate interest (Art. 6/1/f GDPR).
Newsletter and measurement — Sending occasional notices and measuring opens and clicks so we know what is useful. Legal basis: consent (Art. 6/1/a GDPR), withdrawable at any time via the link in every mailing.
Guest reviews — Publishing reviews for future guests. Legal basis: the consent you give when submitting (Art. 6/1/a GDPR). You may withdraw publication at any time.
Visit statistics — Knowing which pages are useful and where visitors stop. Legal basis: consent from the cookie banner (Art. 6/1/a GDPR).
Legal obligations — Keeping accounting records, issuing invoices and reporting guests to the eVisitor system. Legal basis: legal obligation (Art. 6/1/c GDPR).
Who we share data with
We use a few trusted services that process data on our behalf. All operate under GDPR-compliant data processing agreements.
Supabase (EU) — PostgreSQL database and storage for apartment photos. Your bookings and messages live here, EU region.
Vercel (EU/USA) — Hosting and CDN. Sees your IP and User-Agent in order to serve the page.
Resend (EU/USA) — Sending transactional emails (contact confirmation, newsletter). Sees email address and message body.
Google Maps (EU/USA) — Embedded map on apartment detail pages. Google can see your IP only when the map loads.
Stripe (EU/USA) — Card payment processing. Sees the amount, the booking code and the card details you enter on their secure page — we neither see nor store them.
Anthropic (EU/USA) — Translating site content and drafting newsletters. Receives only text written by the owner — none of your personal data.
Transfers outside the EU
Resend and Vercel may process data in the USA, but only under the European Commission's Standard Contractual Clauses (SCC). Your bookings and the database remain in the EU region (Supabase).
How long we keep data
Contact messages: 24 months — Deleted or anonymised
Newsletter: Until you unsubscribe — Link in every e-mail
Mailing measurement: 6 months — Then totals only
Bookings: 36 months — After the stay ends
Reviews: Until withdrawn — Published with your consent
Accounting: 11 years — Legal obligation
Consents: 12 months — Proof of consent
Statistics: 6 months — Then anonymous aggregation
Server logs: 30 days — Security and debugging
Your rights
Under GDPR you have the following rights. To exercise any, email info@second-home.hr — we reply within 30 days, free of charge.
Access — A copy of all data we hold about you.
Rectification — Incorrect data must be corrected.
Erasure — Deletion when no longer needed.
Restriction — Restriction of processing.
Portability — In a machine-readable format.
Objection — Object to processing.
Withdraw — Withdraw consent any time.
Complaint — Complaint to supervisory authority.
Complaint to the regulator
If you believe we mishandle your data, you may lodge a complaint with the Croatian Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, email: azop@azop.hr. Visitors from other EU countries may also contact their national DPA.
Agencija za zaštitu osobnih podataka (AZOP)
Security
Passwords are stored using Argon2 hashing, sessions are transmitted via HttpOnly cookies, all communication runs over HTTPS. Database access is restricted to the back-end server — your browser never reads directly from the database.
Minors
This site is not intended for persons under 16. We do not knowingly collect data about children. If you become aware that a child has shared data with us, please write — we will delete it.
Changes to this policy
If we materially change how we process data, we will update this page and the date above. Material changes are also announced in the newsletter (if you are subscribed).
Contact
Questions about this policy? Write or give us a call. The service address is in Section 1 above.