Privacy Policy - Legal information

1. Who we are

UTO M.B. TORCIDA (obrt), owner: Franko Dujić, OIB 16785523575
Šibenska 2, 22243 Murter, Croatia · E: info@mbtorcida-izleti.hr · T: 00385 98 167 87 30
We are the controller for this website and our on-site services. Supervisory authority: AZOP.

2. Definitions

• “Website” means all pages under the www.mbtorcida-izleti.hr and www.visitkornati.com domain.
• “User” means anyone accessing/using the Website.
• “Guest” means a person who books boat tour with us.
• "We/Us" means UTO M.B. TORCIDA (craft) as set out above.

3. Data we collect & legal bases

Website enquiries & bookings

Contact details, dates, party size, message, and channel metadata — for pre-contract steps and performing the contract (Art. 6(1)(b)), compliance with consumer/accounting law (Art. 6(1)(c)), and service quality (Art. 6(1)(f)).

Guest ID document

In Croatia, as regulated by law, persons prove their identity with an ID card or passport.

Payments

Payer identifiers, masked card/transaction references (via POS), sums and receipts — contract and legal obligation (Art. 6(1)(b)(c)).

Cookies & similar tech

We use a consent banner (CookieYes). Non-essential tools are blocked until you consent: GA4 (via GTM), YouTube embeds, Google Maps, and reCAPTCHA. Legal basis: consent (Art. 6(1)(a)). See Cookie Policy.

4. Sources

Data comes directly from you (forms, email, OTA reservations forwarded to us) and from your lawful use of our site. OTAs act as independent controllers — see each OTA’s privacy policy.

5. Where we store/process data

Hosting is provided by Plus Hosting Grupa d.o.o. (Croatia/EU). If you consent to Google services (e.g., GA4/Maps/YouTube/reCAPTCHA), data may be processed outside the EEA (e.g., USA) under appropriate safeguards (see International transfers).

6. Recipients/Processors

• Hosting: Plus Hosting Grupa d.o.o. (processor)
• Website/email maintenance: Ego Media (processor)
• Bookkeeping service: NAZIV OVDJE (processor)
• POS acquirer & terminal brand(s): Zagrebačka Banka d.d. POS 1(processor)
• PMS/Channel manager: ReMaris PMS (processor) — Booking.com - CM (processor)
• Cookie consent CMP: CookieYes (processor)
• Independent controllers: OTAs; NAZIV AGENCIJE when contacted directly; Google (for GA4/Maps/YouTube/reCAPTCHA if you consent).

7. International transfers

Where Google services are enabled by your consent, data may be transferred outside the EEA (e.g., USA). Transfers rely on adequacy (e.g., EU-U.S. DPF) or Standard Contractual Clauses, as applicable. See Google’s privacy documentation for details.

8. Security measures

We apply organisational, physical and technical safeguards (access controls, encryption in transit, hardened hosting, staff confidentiality, processor contracts. Despite safeguards, no Internet service can be 100% secure.

9. Retention

• Enquiries not resulting in a booked tour: normally up to 12 months.
• Guest/booking and invoice/accounting records: 11 years (statutory).
• Cookie consent logs: typically 12–24 months (CMP setting).

10. Your rights

Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and withdrawal of consent (without affecting prior processing). You can lodge a complaint with AZOP.

11. Children

We do not knowingly contract online with children under 16 without parental authorisation.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date shows the current version. Material changes will be signposted on the site.

13. Contact

Privacy requests: info@mbtorcida-izleti.hr.

Last updated: 05 February 2026