Privacy policy

Last updated: 15 October 2026

With this Privacy Policy, Rozarija Bartulović, Stomarica 34, 21322 Brela, Croatia (the "Host"), as the provider of Villa Arija holiday accommodation, informs website visitors and guests which personal data are collected, for what purpose and how they are protected, in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR (OG 42/2018).

1. Data controller

Rozarija Bartulović
Stomarica 34, 21322 Brela, Croatia
Email: info@brelaonline.com
Phone / WhatsApp: +385 98 804 072

2. What personal data we collect

Personal data means any information relating to an identified or identifiable natural person. We only collect data that you give us yourself or that we are legally required to collect:

• Enquiries via the contact form: full name, email, phone number (optional), preferred arrival and departure dates, number of guests and children, and the content of your message.
• Communication by email, phone or WhatsApp: the data you send us in your message.
• Booking and stay: data needed to confirm the booking, take payment and issue an invoice, and identity document details that we, as a host, are legally obliged to register in the Croatian tourist registration system (eVisitor).
• Technical data: the server hosting the website automatically logs your IP address, time of access, pages requested and browser type (log files). These data are used solely for security and the proper functioning of the website.

We do not collect personal data for marketing purposes, do not create visitor profiles and do not send newsletters.

3. Purpose and legal basis of processing

• Replying to your enquiry and preparing an offer – steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Performing the booking and stay – performance of a contract (Art. 6(1)(b) GDPR).
• Guest registration, tourist tax, invoices and tax records – legal obligation (Art. 6(1)(c) GDPR).
• Security and proper operation of the website (log files) – legitimate interest (Art. 6(1)(f) GDPR).
• Displaying the Google map – your consent, given by clicking the "Show map" button (Art. 6(1)(a) GDPR).

4. How long we keep your data

• Enquiries that did not lead to a booking: no longer than 12 months after the last communication.
• Booking data, invoices and guest registration data: as long as required by tax, accounting and tourism regulations.
• Server log files: for a short period, according to the hosting provider's settings.

After these periods, the data are deleted or permanently anonymised.

5. Recipients and processors

We do not sell your data or disclose it to unauthorised third parties. Your data may only be accessible to:

• our web hosting and email provider, which processes the data solely on our behalf and according to our instructions,
• our bookkeeping service, to the extent necessary for keeping business records,
• competent authorities (eVisitor system, tourist board, Tax Administration) where required by law.

If you contact us via WhatsApp, messages pass through the service of Meta Platforms Ireland Ltd. under its terms; this is a channel you choose yourself.

6. Cookies and external content

This website does not use cookies, analytics tools (e.g. Google Analytics) or advertising pixels. Fonts are hosted on our own server, so no requests are sent to Google when you visit.

The Google map on the Contact page is only displayed if you click the "Show map" button. Only then is content loaded from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may process your IP address and set its own cookies; data may also be transferred to the USA under the EU-US Data Privacy Framework. More information: policies.google.com/privacy. If you prefer not to load the map, you can open the location directly in the Google Maps app.

The link to our Facebook page is a plain link; data is only transferred to Meta if you click it.

7. Security

We take appropriate technical and organisational measures to protect your data against loss, destruction, unauthorised access, alteration or disclosure. The website is served over an encrypted connection (HTTPS).

8. Your rights

Under the GDPR you have the following rights, which you can exercise by writing to info@brelaonline.com or by post to the address above. We will respond within one month.

• Right of access – confirmation of whether we process your data and a copy of that data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"), except where we must keep the data by law.
• Right to restriction of processing.
• Right to data portability in a structured, commonly used format.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with a supervisory authority – in Croatia this is the Personal Data Protection Agency (AZOP), Zagreb, azop.hr, email azop@azop.hr, tel. +385 1 4609 000. You may also complain to the supervisory authority in the country where you live or work.

9. Changes to this Privacy Policy

We may update this Policy from time to time. The current version is always published on this page, with the date of the last change.