Privacy policy

Note for review: this is a draft aligned with the General Data Protection Regulation (GDPR). It should be reviewed by legal counsel and the details marked in square brackets completed before publication.

Last updated: 28 October 2026

1. Who processes your data

The controller of your personal data is Famose hotels d.o.o., sub-lessee and operator of Rivalmare Boutique Hotel, Rivarela 19, HR-52466 Novigrad, Croatia.

• Company ID (OIB): [to be completed]
• Registered office: [to be completed]
• E-mail: info@rivalmare.hr
• Telephone: +385 52 555 600

For any question about the processing of personal data you may contact us at the e-mail address above. [If a data protection officer has been appointed, their contact details go here.]

2. What we collect and why

We collect personal data only when you provide it to us, or when it is necessary to deliver the service and to meet our legal obligations.

2.1. Reservation and stay

When you book accommodation we collect your name, contact details, the dates and type of accommodation, and the data needed for payment. Reservations are processed through the Phobs online booking system; payment data is handled by the payment service provider and is not fully available to us.

• Purpose: conclusion and performance of the accommodation contract
• Legal basis: Article 6(1)(b) GDPR — performance of a contract

2.2. Statutory guest registration

As an accommodation provider we are legally required to register guests in the Croatian eVisitor system and to keep the prescribed records. For this purpose we collect data from your identity document to the extent required by law.

• Purpose: fulfilment of the statutory obligation to register stays and account for the tourist tax
• Legal basis: Article 6(1)(c) GDPR — legal obligation

2.3. E-mail enquiries

When you write to us we process your e-mail address and the content of your message in order to reply.

• Purpose: communication with guests and answering enquiries
• Legal basis: Article 6(1)(b) or (f) GDPR — performance of a contract or legitimate interest

2.4. Website analytics

With your consent we measure website traffic in order to improve the site. Details are in the cookies section below.

• Purpose: usage statistics and improvement of the website
• Legal basis: Article 6(1)(a) GDPR — consent

3. Cookies and Google Analytics

This website uses strictly necessary cookies, without which it cannot function properly, and analytics cookies, which are set only with your consent.

For traffic measurement we use Google Analytics 4 (measurement ID G-5HJQXSZR43), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

• The Google Analytics script is not loaded until you accept analytics cookies. Until then no data is sent to Google and none of its cookies are set.
• If you accept, a _ga cookie is set to distinguish visitors. The data processed includes a truncated IP address, browser and device information, and the pages viewed.
• IP anonymisation is enabled and personalised advertising is switched off.
• You can withdraw your consent at any time through the "Cookie settings" link in the footer of every page.

Google may also process data outside the European Economic Area. Such transfers are based on the European Commission's standard contractual clauses and the provider's additional safeguards.

You can also delete and block cookies in your browser settings.

4. Who we share data with

We do not sell your data and do not pass it to third parties for marketing purposes. We share it only where necessary:

• the booking system provider (Phobs) — as a processor
• payment service providers — for payment
• the competent authorities through the eVisitor system — as a legal obligation
• our accounting service — for statutory bookkeeping
• Google — solely for analytics and only with your consent

Data processing agreements are in place with all processors, binding them to an equivalent level of protection. [Confirm that agreements exist for all of the above.]

5. How long we keep data

• Reservation and stay data: [period to be completed] after the end of the stay
• Accounting records: 11 years, in line with Croatian tax legislation
• Guest registration records: for the periods prescribed by law
• E-mail enquiries: [period to be completed]
• Analytics data: according to the retention setting in Google Analytics [to be completed: default is 2 or 14 months]

Once the period expires we delete or anonymise the data.

6. Your rights

In relation to your personal data you have the right to:

• access the data and obtain a copy of the data we process about you
• rectification of inaccurate data or completion of incomplete data
• erasure ("right to be forgotten") where there is no longer a basis for processing
• restriction of processing
• data portability in a machine-readable format
• object to processing based on legitimate interest
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

Requests can be sent to info@rivalmare.hr. We will respond within one month of receiving the request.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr.

7. Data security

We apply technical and organisational measures appropriate to the risk — among them an encrypted connection (HTTPS) across the whole site, access limited to authorised persons only, and regular system maintenance.

8. Children's data

The website is not intended for children and we do not knowingly collect children's personal data without the consent of a parent or guardian. Data of children staying at the hotel is processed solely within the reservation and the statutory registration of the stay, and is provided by a parent or guardian.

9. Obligation to provide data

Providing the data required for the reservation and the statutory registration of the stay is a precondition for concluding the accommodation contract — without it we cannot deliver the service. Consent to analytics is voluntary and refusing it does not affect your use of the website or the service in any way.

10. Automated decision-making

We do not carry out automated decision-making or profiling that would produce legal effects concerning you.

11. Changes to this policy

We may update this privacy policy from time to time. The current version is always published on this page, with the date of the last update shown at the top.