Privacy Policy

1. Data controller

The controller of your personal data is Play Digital d.o.o., OIB (Croatian company ID) 53367690460, Zagrebačka 6A, 52000 Pazin. For any privacy question and to exercise your rights, write to info@apartmanica.com.

The same company develops Apartmanica, the system hosts use to manage their accommodation, prices, calendar and bookings. Listings on HeyCroatia come from Apartmanica, and your inquiries, bookings and messages reach the host through it and are stored in it.

We are the controller for the operation of the portal. For your stay, the host is a separate controller. Data from inquiries, bookings and messages stored in Apartmanica in the host's account is also processed by us as a processor on behalf of that host, under our contract with them.

2. What data we collect

For inquiries and bookings: your first and last name, email address, phone number, country, your message to the host, the dates of your stay and the number of guests.

For verification: the email address or phone number we send a one-time code to, a cryptographic hash of the code, the number of attempts and the time of verification. If you sign in with Google (Google Identity Services), we only use your email address, name and account identifier from Google. We do not access your contacts, files or any other data in your Google account.

In the inbox and on your account page: the messages you exchange with the host, price offers and counter-offers, and the list of your inquiries and bookings. We do not use passwords: access is granted by a verified email address. If you are signed in with a verified email address, we also keep the list of your saved listings (favorites) with it.

Technical data: IP address, browser type, referring page and time of access, in server logs. When you click a button or link on a listing, we record the type of click, the page, the language, the time, your IP address, browser and referring page (click statistics).

With your consent (analytics and marketing cookies): data about how you use the portal, collected by Google tools, for example which pages you open, your device and browser type, approximate location and which ad or site you came from.

For hosts: the data the host entered in Apartmanica and that is shown in the listing, such as the host's name or business name, details of the accommodation and its location on the map, photos, descriptions, prices, the availability calendar, rental terms and languages spoken.

3. Why we use it and on what legal basis

We use the data from your inquiry or booking to forward it to the host and to let you exchange messages with them. This is necessary to take steps before entering into, and to perform, the accommodation contract (Art. 6(1)(b) GDPR). We store the list of saved listings with your email address only if you sign in, so that you see it on every device. You turn this feature on yourself by signing in, so the legal basis is the performance of the service you requested (Art. 6(1)(b) GDPR).

We use email or phone verification, technical logs and click statistics to keep the portal secure, prevent fake inquiries, unauthorized data collection and other abuse, compile listing statistics and improve the service, and to establish, exercise and defend legal claims. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

We show host data on the basis of our contract with the host (HeyCroatia package or Apartmanica) and our legitimate interest in offering guests the accommodation of Apartmanica users. A host with a published website in Apartmanica can switch off the display on the portal at any time in the Apartmanica settings.

Some data must be kept to meet legal obligations (Art. 6(1)(c) GDPR). We do not sell your data.

We use analytics (visit statistics) and marketing (measuring and showing ads) only with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time; this does not affect processing before the withdrawal.

We do not make decisions based solely on automated processing, including profiling, that would produce legal or similarly significant effects for you.

4. Who we share data with

The host of the accommodation you chose, through Apartmanica. For your stay, the host is a separate controller: they use your data for the booking, guest registration, payment and invoicing under their own rules and legal obligations.

Service providers working for us as processors, only for the service they provide to us: server hosting and photo storage (DigitalOcean), email delivery, delivery of SMS verification codes through Apartmanica and, when the portal's traffic runs through it, Cloudflare for attack protection and content delivery.

Google: if you choose to sign in with your Google account, and for analytics and marketing only if you consent to them (Google Tag Manager, Google Analytics and Google advertising tools).

Public authorities and courts when the law explicitly requires it or when needed to defend our rights, and our legal and tax advisers, who are bound by confidentiality. We disclose host details to a rights holder who reports an infringement only when required by law or ordered by a court or other competent authority.

If the company or the portal changes ownership, the data passes to the legal successor, who may use it only for the same purposes.

5. Cookies and browser storage

Essential cookies are always on because the portal does not work without them. The session cookie and the XSRF-TOKEN cookie keep you signed in and protect forms against abuse (CSRF); they last while your session is active. The hc_consent cookie remembers your cookie choice for 180 days. We set the hc_guest cookie when you verify your email address with a code or your Google account: it contains only a marker that you are signed in, no data about you, lasts one day at most and is deleted when you sign out. It tells your browser whether to merge your saved listings with your list on our server.

Until the portal opens to the public, the hc_preview cookie (up to 30 days) remembers that a member of our team has entered the preview password, and a host who opens the preview of their listing from Apartmanica receives a similar essential cookie that is valid only for their own listing.

Analytics and marketing cookies are set by Google Analytics and Google advertising tools, which we load through Google Tag Manager, and only if you consent in the cookie notice. Analytics cookies (e.g. _ga, up to 2 years) show us how the portal is used; marketing cookies (e.g. _gcl_au) are used to measure and show ads.

Google Tag Manager loads on every page, but until you consent, neither it nor the Google tools set or read these cookies (Google Consent Mode). Google may then receive only basic data without cookies, for example that a page was opened, which it uses for aggregate statistics.

You can change or withdraw your choice at any time with the Cookie settings link in the footer. When you withdraw consent, we delete the Google cookies set by the portal from your browser.

While you are not signed in, saved listings (favorites) are stored only in your browser (localStorage) and are not sent to us. When you sign in with a verified email address (with a code or your Google account), we merge the list from your browser with the list stored with that address on our server, so it is there on every device. Google's sign-in script is loaded only on pages with the Google sign-in button, and Google then acts under its own privacy policy.

6. How long we keep data

• A verification code is valid for 10 minutes, and a verified email address stays signed in in your browser for one day at most.
• We keep a signed-in guest's saved listings until you remove them, and delete the whole list when you have not used the portal as a signed-in guest for 12 months. At your request we delete it sooner.
• Application logs are kept for 14 days.
• Records of email or phone verification and click statistics are kept as long as they are needed for portal security, abuse prevention and listing statistics. At your request we delete them earlier, unless we need them because of a specific case of abuse or a dispute.
• Inquiries, bookings, messages and offers are kept in Apartmanica as long as the host keeps them in their account and as long as needed for legal obligations and possible disputes.
• Your cookie consent is remembered for 180 days, after which we ask again.
• A listing is removed from the portal when the host switches it off or the conditions for showing it are no longer met, and the resized copies of photos made by the portal are deleted within about four months.

Data received by the host is kept by the host under their own rules and the regulations that apply to renting accommodation.

7. Data security

The portal works only over an encrypted connection (HTTPS). We do not store verification codes in readable form, the number of attempts and requests is limited, and data is accessed only by authorized persons who need it for their work. No system is completely secure, but if a data breach is likely to put you at high risk, we will notify you and the supervisory authority as the GDPR requires.

8. Transfers outside the EU

We aim to process data within the European Economic Area. Some service providers (for example Google, Cloudflare and DigitalOcean) are based in the USA or may process data outside the EEA. Such transfers take place only with the safeguards required by the GDPR, such as a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses.

9. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest, and you can withdraw any consent you gave at any time. Send your request to info@apartmanica.com; we reply within one month at the latest.

To avoid disclosing data to the wrong person, we may ask you to confirm that the email address or number is yours before we reply, for example with a code we send to it. Data from inquiries and bookings that the host received for a stay is erased or corrected in agreement with the host, because the host may be required to keep it under their own legal obligations.

If you believe your data protection rights have been violated, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or the supervisory authority in your country.

10. Minors

Only adults may send inquiries, bookings and messages on the portal. We do not knowingly collect data from children. Data about children travelling with you (for example for guest registration) is collected by the host under the host's own obligations.

11. Changes

We may update this policy when the portal or the regulations change. The current version is always on this page, with the date of the last update.