Privacy Policy
NOTICE ON THE PROCESSING OF PERSONAL DATA / PRIVACY POLICY
1 INTRODUCTION
Data Controller:
LIBURNIA RIVIERA HOTELI d.d.
Maršala Tita 198
51410 Opatija
Republic of Croatia
OIB (PIN): 15573308024
Phone: +385 (0)51 710 444
Contact details of the Data Protection Officer:
dpo@liburnia.hr or by post to the registered address marked for the attention of the Data Protection Officer
Competent supervisory authority:
Croatian Personal Data Protection Agency (AZOP), azop@azop.hr, www.azop.hr
Scope:
This Privacy Policy describes how Liburnia Riviera Hotels (hereinafter: LRH) collects, uses, stores, shares and otherwise processes the data of guests, website visitors and other persons whose personal data it collects for the purpose of providing accommodation services.
This Privacy Policy applies to all LRH accommodation facilities, including:
- Hotel Admiral
- Hotel Ambasador
- Hotel Kvarner
- Hotel Imperial
- Hotel Bellevue
- Hotel Admiral
- Hotel Kristal
- Hotel Istra
- Hotel Lungomare Opatija
- Hotel Marina
- Hotel Mediteran
- Villa Abbazia
- Villa Amalia
- Campsite & Holiday Resort Medveja
- Apartments Belvedere
- Hotel Ičići
2 CATEGORIES OF PERSONAL DATA
LRH processes personal data that are appropriate, relevant and necessary for achieving each specific purpose of processing. The type of personal data being processed depends on the nature of the service provided, the manner in which the business relationship is established, and the legal obligations to which LRH is subject. Depending on the circumstances of each specific case, the following categories of personal data may be processed:
- Identification data: first and last name, date of birth, citizenship, gender, number and type of identification document (identity card or passport), residential address;
- Contact data: email address, telephone/mobile number;
- Booking and stay data: arrival and departure dates, number of guests (including children), type and number of room/apartment/camping pitch, information on special requests and services used, history of previous stays;
- Financial and payment data: data on the payment method and completed payments, data required for issuing invoices, data on payments made, data contained in invoices, data required for any refund, payment card data in protected form;
- Special categories of personal data (with explicit consent): data concerning health, allergies, dietary restrictions, and similar information, only when voluntarily provided by the guest for the purpose of customizing the service;
- Communication data: the content of enquiries and further communication;
- Website usage data: data collected through cookies and similar technologies (IP address, device and browser type, website usage data);
- Video recordings: recordings from video surveillance systems;
- Audio recordings: recordings of calls to the reservation centre.
3 PURPOSES OF PERSONAL DATA PROCESSING
3.1 Receiving, Processing and Managing Reservations
LRH collects and processes personal data necessary for booking accommodation and other hotel services, from receipt to its fulfilment or cancellation.
This includes checking the availability of accommodation capacities and contracted services, communicating with the guest before arrival, sending booking confirmations and organizing the stay in accordance with the guest’s stated requests and preferences. Personal data are also used to record and administer changes to, or cancellations of, bookings.
Legal basis for processing: performance of a contract or taking steps prior to entering into a contract.
3.2 Provision of Accommodation Services
LRH processes personal data necessary for organizing and providing contracted accommodation and other services related to a guest’s stay. This processing includes guest check-in and check-out, allocation of accommodation units, management of accommodation during the stay, and enabling the use of all contracted and requested services.
Depending on the services used by the guest, LRH processes personal data such as first and last name, room number, information on the services and facilities used (e.g. wellness, room service, entertainment and recreational facilities), the date and time of use of the service, related costs, payment method, and any special requests or notes necessary for providing the requested service, including any adjustments relating to the guest’s health condition, dietary restrictions or other special requirements.
Legal basis for processing: performance of a contract or taking steps prior to entering into a contract, data subject’s consent (for special categories of personal data).
3.3 Submission of Data to Competent Authorities
In accordance with specific national regulations (Tourist Tax Act and Ordinance on the eVisitor System), LRH is required to register and deregister each guest through the eVisitor information system.
For this purpose, LRH processes personal data prescribed by those regulations, including the guest’s first and last name, date of birth, citizenship, place and country of birth, gender, type and number of identification document, and data on arrival, departure, and duration of stay.
Legal basis for processing: legal obligation of the controller.
3.4 Payment for Services and Processing Payment Transactions
LRH processes personal data for the purposes of charging for booked and used services, processing online payments, pre-authorizing payment cards, issuing invoices, fiscalization, and keeping accounting and other records prescribed by law.
For these purposes, LRH processes identification data, data on bookings and services used, payment and transaction data, data required for issuing invoices, and other necessary data in accordance with applicable regulations.
Payment transactions are carried out through authorized and secure payment service providers that apply appropriate technical and organizational protection measures and security standards for the processing of card transactions.
Legal basis for processing: legal obligation of the controller; performance of a contract or taking steps prior to entering into a contract.
3.5 Processing Enquiries, Complaints, Compliments and Claims
LRH processes personal data for the purpose of receiving, recording and resolving enquiries, compliments, complaints, claims and other requests from guests.
For this purpose, LRH may process identification and contact data, booking and stay data, the content of communications, documentation submitted with the request and other data necessary to establish all relevant circumstances and resolve the specific request.
Legal basis for processing: taking pre-contractual actions and performance of a contract; compliance with a legal obligation of the controller.
3.6 Marketing Activities
LRH uses guests’ contact details, including the email address collected when making a booking or registering a stay, to send notifications about its own services, special offers, benefits, promotions, events and other content that may be of interest to guests. This processing is based on LRH’s legitimate interest.
Message recipients have the right at any time to object to the processing of their personal data for marketing purposes or to unsubscribe from the recipient list by using the unsubscribe link provided in each electronic message.
Personal data are also processed for marketing purposes on the basis of consent, for example, when the data subject personally subscribes to the newsletter mailing list via the LRH website.
Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
LRH manages official social media profiles, including Facebook, Instagram, LinkedIn, X, and YouTube, for the purpose of informing the public, communicating with users and promoting its own services.
When social media users leave a comment, send a message, react to a post or otherwise interact with official LRH profiles, personal data arising from such communication and interaction are processed.
Social media service providers also process users’ personal data for their own purposes, in accordance with their own privacy policies. Depending on the specific service, they may act as separate controllers or joint controllers with LRH.
Legal basis for processing: legitimate interest of the controller; data subject’s consent.
3.7 Recording Phone Calls
LRH may record telephone conversations with the reservation centre and customer service for the purposes of ensuring and improving service quality, employee training, verifying the accuracy of bookings received and other instructions, resolving complaints and claims, protecting rights and interests, and proving the content of communication in the event of a dispute.
Before each conversation begins, callers are informed by an automated voice message that the call is being recorded.
Legal basis for processing: legitimate interest of the controller.
3.8 Video Surveillance
For the purpose of protecting persons and property in LRH accommodation facilities, a video surveillance system has been established. Video surveillance covers only areas where its use is justified, such as entrances and exits, reception areas, corridors, car parks, outdoor areas, and other common areas.
Appropriate notices are displayed at all locations covered by video surveillance, informing data subjects in advance about the recording and providing basic information on the processing of personal data.
Legal basis for processing: legitimate interest of the controller.
3.9 Website and Cookies
The website uses cookies and similar tools that enable it to function properly and allow analysis of website traffic and usage
Detailed information about the types of cookies, the purposes for which they are used, the storage period, the legal basis for processing, and the options for managing cookie settings is available in the cookie settings management tool (Cookiebot).
Legal basis for processing: data subject’s consent.
4 SOURCES OF PERSONAL DATA
Personal data are collected directly from data subjects when they book accommodation, check in and check out, use hotel services, communicate with LRH by telephone, email or via the website, submit enquiries, requests, complaints or claims, and sign up to receive newsletters or other notifications.
Where necessary for the performance of a contract, the provision of a contracted service or compliance with legal obligations, personal data may also be collected from other sources. Such sources include online accommodation booking platforms, travel agencies, tour operators, business partners who book accommodation for their clients, employees or other persons, persons who make a booking on behalf of a guest, and publicly available registers and official records, when their use is permitted or prescribed by specific regulations.
5 PERSONAL DATA RETENTION PERIOD
The period for which personal data are retained is determined depending on the purpose of processing, statutory obligations to retain specific data, and the need to protect LRH’s rights and legal interests.
Data on guest bookings and stays, including check-in and check-out data, are retained for at least two years from the guest’s check-out date, in accordance with the regulations governing the keeping of guest books and guest lists.
After the expiry of that period, the data may be retained for a maximum of five years from the end of the calendar year in which the most recent stay took place, where this is necessary to protect LRH’s legal interests, resolve complaints, exercise or defend legal claims, and maintain business records.
Invoices, accounting records and other accounting documentation are retained for 11 years from the end of the financial year to which they relate, in accordance with accounting and tax regulations.
Payment card data in protected form are processed for the period necessary to execute the payment transaction and any pre-authorization, or until the final settlement of all outstanding amounts, and for no longer than 30 days, unless applicable regulations or the rules of the authorized payment service provider require otherwise.
Data contained in enquiries and correspondence are retained for 12 months from the end of the communication or from the end of the year in which the guest used the service, as applicable.
Data relating to complaints and claims are retained for 12 months from the end of the year in which the complaint was received, in accordance with consumer protection regulations, unless longer retention is necessary for the purposes of pursuing or defending legal claims.
Personal data processed on the basis of consent are retained until consent is withdrawn, unless there is another legal basis for their further processing.
Video surveillance recordings are retained for a maximum of 10 days, unless they need to be preserved as evidence in judicial, administrative or other proceedings.
Recordings of telephone conversations with the reservation centre are retained for a maximum of two years.
6 CONSEQUENCES OF NOT PROVIDING PERSONAL DATA
The provision of certain personal data constitutes a legal or contractual obligation, or a prerequisite for entering into and performing a contract for the provision of hotel and other related services.
If personal data required for making a booking, registering a stay, providing contracted services or complying with legal obligations are not provided or are incomplete, LRH will not be able to provide the relevant service or comply with its legal obligations.
Failure to provide personal data processed on the basis of consent will not have negative consequences for the use of hotel services. In such cases, however, LRH may be unable to fulfil the specific request or provide the benefit for which consent was given.
7 CATEGORIES OF PERSONAL DATA RECIPIENTS
LRH uses the services of external service providers who process personal data to the extent necessary to provide the contracted service or maintain information systems.
Depending on the purpose of processing, personal data may be made available to the providers of the following services:
- hotel operations, reservation and guest stay management system;
- online reservation and booking channel management system;
- payment transaction processing and service billing system;
- information system maintenance, technical support and hosting services;
- website maintenance and administration services;
- newsletter and other electronic marketing communication services;
- smart room function management system.
LRH’s relationship with the above partners is governed by personal data processing agreements, under which the partners are required to maintain confidentiality, apply appropriate technical and organizational protection measures, and process personal data solely in accordance with documented instructions.
Where required by law and/or on the basis of an official request, personal data are provided to competent state authorities and public bodies, including the tourist board, police, courts, the State Attorney’s Office, tax authorities and other authorities authorized under applicable regulations to request the provision of personal data.
8 DATA TRANSFERS TO THIRD COUNTRIES
For sending newsletters, LRH uses Mailchimp, a service operated by Intuit Inc. based in the United States of America. Since the use of this service may involve the transfer of personal data to the United States of America, such transfer is carried out in accordance with the General Data Protection Regulation (GDPR). Intuit Inc. is certified under the EU–US Data Privacy Framework, for which the European Commission has issued an Adequacy Decision pursuant to Article 45 of the GDPR, thereby ensuring an adequate level of personal data protection.
For any other data transfers to third countries, LRH applies appropriate safeguards in accordance with Article 46 of the GDPR, including the European Commission’s Standard Contractual Clauses available at the following link: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj
9 PERSONAL DATA PROTECTION
LRH implements appropriate technical and organizational measures to ensure the confidentiality, integrity and availability of personal data and the resilience of processing systems, taking into account the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of data subjects.
Protection measures include access controls for personal data, the application of appropriate security measures in information systems, protection of communication channels and data during transmission, keeping access records where applicable, regular maintenance and monitoring of information systems, data backups, security incident management procedures, and the continuous improvement of organizational and technical protection measures.
Access to personal data is granted only to persons who require such access to perform their duties and who are required to maintain the confidentiality of the data. Where processors are engaged for the processing of personal data, LRH selects only service providers that provide sufficient guarantees for the implementation of technical and organizational protection measures in accordance with the requirements of the GDPR.
Protection measures are regularly reviewed and, where necessary, adapted to technological development, changes in the processing of personal data and identified security risks.
10 RIGHTS OF DATA SUBJECTS
Depending on the legal basis and purpose of the processing of personal data, data subjects have the following rights:
- Right of access – the right to obtain confirmation as to whether personal data are being processed, access to the personal data and information on the purpose, scope and manner of processing, and the right to receive a copy of the data;
- Right to rectification – the right to request the correction of inaccurate personal data or the completion of incomplete personal data;
- Right to erasure (“right to be forgotten”) – the right to request the erasure of personal data that are no longer necessary for the purpose of processing, or where there is no other legal basis for their processing and retention;
- Right to withdraw consent – where processing is based on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before consent was withdrawn.
Where applicable, depending on the circumstances of the specific processing and the legal basis, data subjects also have the following rights:
- Right to restriction of processing – for example, where the accuracy of personal data is contested or where the data are required for the establishment, exercise or defence of legal claims;
- Right to data portability – the right to receive personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller, where processing is based on consent or a contract and is carried out solely by automated means;
- Right to object – the right to object at any time to the processing of personal data based on the controller’s legitimate interest, including processing for direct marketing purposes;
- Right not to be subject to automated decision-making – the right not to be subject to a decision based solely on automated processing, including profiling, where such a decision produces legal effects or similarly significantly affects the data subject.
* LRH does not make decisions based solely on automated processing of personal data, including profiling, which produce legal effects or similarly significantly affect data subjects.
11 CONTACT
A request to exercise your rights can be submitted by email to the Data Protection Officer at dpo@liburnia.hr or by mail to a registered address.
Before acting on a request, LRH may request additional information or documentation necessary to verify the identity of the applicant, where this is necessary to protect personal data and prevent unauthorized disclosure of data.
The request will be responded to without undue delay, and no later than one month from the date of receipt. Exceptionally, in accordance with the GDPR, this period may be extended by a further two months.
July 2026