Last updated: 31 August 2026
This Privacy Policy explains how personal data is processed when you visit the Vila Vanda website or send a booking request.
Privacy Policy
Controller
Danijel KelavaVila Vanda
Ulica Mirka Miočića 227D
23248 Rtina
Kroatien
E-Mail: vilavanda.croatia@gmail.com
Hosting and Booking Requests
World4You hosts this website and may process technical server data, such as IP address, browser information and access time, to provide and secure the website. The legal basis is our legitimate interest under Article 6(1)(f) GDPR.
If you send a booking request, we process your name, contact details, travel dates, selected accommodation, number of guests and message to answer your enquiry and prepare a possible booking. The legal basis is Article 6(1)(b) GDPR.
Web3Forms
Our booking form uses Web3Forms, operated by Web3Creative, to send your request to us. Web3Forms may process form data and technical metadata outside the European Economic Area, including in India. Web3Forms states that Standard Contractual Clauses are used where required and that submissions may be technically retained for up to three years. More information is available in the Web3Forms Privacy Policy.
Google Maps and External Links
Google Maps is loaded only after you agree to display the map. Google may then process your IP address, device information and usage data and may transfer data outside the European Economic Area. The legal basis is your consent under Article 6(1)(a) GDPR. Links to Instagram, Airbnb and Renting.hr are governed by the privacy policies of those services after you open them.
Storage and Your Rights
We keep personal data only for as long as necessary to process your enquiry or booking, comply with legal obligations and handle possible legal claims. You may request access, correction, deletion, restriction or portability of your data and may object to certain processing. Consent may be withdrawn at any time for the future.
Contact villavandacroatia@gmail.com to exercise your rights. You may also lodge a complaint with a competent data protection supervisory authority. We do not use automated decision-making or profiling.