1. INTRODUCTION

This Privacy Policy explains how personal data is collected, used, stored and protected when users visit the website https://nareovillas.com, send inquiries, communicate with Nareo Villas or book accommodation in one of the villas presented under the Nareo Villas brand.

This Privacy Policy applies to the website, contact form, e-mail communication, booking process through Rentlio, payment processing and related communication channels.

2. CONTROLLER OF PERSONAL DATA

The controller of personal data is:

• Company: NAREO d.o.o.
• Address: Marinići 16, 51216 Marinići, Croatia
• OIB: 54807795060
• E-mail: [email protected]
• Phone / WhatsApp: +385 91 1507 497

NAREO d.o.o. is the controller of personal data for the website, inquiries, bookings, payments, invoices, guest communication, accommodation services, complaints and privacy requests.

3. CONTACT FOR PRIVACY REQUESTS

For all privacy-related questions, requests and complaints, users may contact:

• E-mail: [email protected]
• Phone / WhatsApp: +385 91 1507 497

4. PERSONAL DATA WE COLLECT

4.1. Contact form data

When a user sends an inquiry through the contact form, the following data may be collected:

• first name,
• last name,
• e-mail address,
• phone number,
• reason for message,
• check-in date,
• check-out date,
• number of adults,
• number of children,
• message content.

4.2. E-mail communication data

When a user contacts NAREO d.o.o. by e-mail, the following data may be processed:

• e-mail address,
• name and surname,
• phone number,
• message content,
• booking preferences,
• special requests provided by the user.

4.3. Booking data

Bookings are processed through Rentlio or another approved booking system. Rentlio may process data necessary for booking creation, guest communication, payment processing, guest records and accommodation management.

Such data may include:

• name and surname,
• contact details,
• address,
• booking dates,
• number of guests,
• villa selected,
• payment-related information,
• invoice-related information,
• stay-related information.

4.4. Payment data

Payments may be processed by bank transfer, card payment through Rentlio, Worldline or another authorised payment provider, or by another agreed payment method.

NAREO d.o.o. does not store full card numbers, card verification codes or other sensitive card data in the WordPress system of the website.

Payment providers may process payment data according to their own terms, privacy policies and security standards.

4.5. Technical data

When a user visits the website, technical data may be processed, including:

• IP address,
• browser type,
• device information,
• date and time of access,
• pages visited,
• technical logs,
• cookie identifiers,
• consent preferences.

4.6. Security and property-related data

If used in or around the villas, the following systems may process personal or technical data:

• video surveillance,
• smart locks,
• alarms,
• noise sensors,
• Wi-Fi logs,
• access logs,
• other safety or technical systems.

If video surveillance exists, it must be clearly indicated on location and must not record private interior areas intended for guests.

5. PURPOSES OF PROCESSING

Personal data may be processed for the following purposes:

• responding to inquiries,
• checking availability,
• creating and managing bookings,
• communicating before, during and after the stay,
• processing payments,
• issuing invoices,
• providing accommodation services,
• managing legally required guest records,
• registering guests in eVisitor where required,
• handling complaints,
• handling privacy requests,
• maintaining website security,
• preventing misuse and spam,
• improving website functionality,
• analytics,
• remarketing and advertising where consent is given,
• complying with legal obligations,
• protecting legal rights and interests.

6. LEGAL BASES

Depending on the context, personal data is processed on one or more of the following legal bases:

• steps taken at the request of the user before entering into a booking,
• performance of a booking or accommodation agreement,
• compliance with legal obligations,
• legitimate interest in communication, security, record keeping and protection of legal rights,
• consent for analytics and marketing cookies,
• consent for promotional communication where required.

7. CONTACT FORM

Data submitted through the contact form is stored in the WordPress database and sent to the official e-mail address [email protected].

Access to inquiries may be available to authorised persons involved in handling inquiries, including employees, authorised representatives and authorised service providers or partners.

8. RENTLIO BOOKING SYSTEM

When the user clicks the booking link, the user may be redirected to Rentlio.

Rentlio is used as an external booking system for creating and managing bookings. Rentlio may process data within its own system according to its own terms and privacy policy.

9. RECIPIENTS OF PERSONAL DATA

Personal data may be shared with or made available to:

• authorised persons handling inquiries and bookings,
• web agency and technical service providers,
• hosting provider,
• e-mail provider,
• Rentlio or another booking system provider,
• Worldline or another payment provider,
• banks and payment institutions,
• accountants,
• legal and business advisors,
• competent authorities where legally required,
• analytics and marketing service providers where applicable.

Personal data is not sold to third parties.

10. INTERNATIONAL TRANSFERS

Some third-party service providers, such as Google, Meta or other technical and marketing providers, may process data outside the European Economic Area.

Where applicable, such transfers are based on appropriate safeguards required by data protection law.

11. MARKETING AND PROMOTIONAL OFFERS

Remarketing may be carried out through tools such as Google Ads and Meta Ads, subject to cookie consent.

Promotional offers to former guests may be sent individually or through a dedicated sending system. If a sending system is used, users must be able to unsubscribe by clicking an unsubscribe link or by using another simple opt-out method.

12. DATA RETENTION

Personal data is retained as long as there is a purpose for processing, a legal obligation or a legitimate interest, or until the person submits a valid request for deletion.

Contact form submissions and e-mail communications are not automatically deleted, but may be manually deleted upon a valid request, unless there is a legal reason to retain them.

Booking, payment, invoice and legally required records are retained for the periods necessary to comply with contractual, accounting, tax and legal obligations.

Complaint records may be retained for the period required by law or for as long as needed to protect legal rights.

13. USER RIGHTS

Subject to applicable data protection law, users may request:

• access to personal data,
• correction of inaccurate data,
• deletion of data,
• restriction of processing,
• data portability,
• objection to processing,
• withdrawal of consent where processing is based on consent.

Requests can be sent to [email protected].

Additional information may be requested to verify the identity of the person submitting the request.

14. SECURITY

Reasonable technical and organisational measures are applied to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of online transmission or electronic storage is completely secure.

15. SUPERVISORY AUTHORITY

If a user believes that personal data has been processed unlawfully, the user has the right to lodge a complaint with a competent supervisory authority.

In Croatia, the competent authority is the Croatian Personal Data Protection Agency, known as AZOP.

16. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be updated from time to time.

The updated version applies from the date of publication on the website, unless stated otherwise.