Privacy Policy

Data controller

The controller is JANEJA d.o.o. za ugostiteljstvo i turizam, Bankovac 12A, Vabriga, Municipality of Tar-Vabriga – Torre-Abrega, Croatia, OIB: 89194571495, MBS: 130154774 (Velora or we). For questions about personal data or to exercise your rights, email reservations@apartmentvelora.com.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Croatian law, particularly the Act on the Implementation of the General Data Protection Regulation.

Data we collect

When you contact us through the form or by email, we process information you provide:

• —first and last name,
• —email address,
• —message content and any other information you choose to include.

Purpose and legal basis

We use enquiry data only to answer your question, communicate with you and, where your enquiry concerns a stay, take steps before a possible booking. The legal basis is Article 6(1)(b) GDPR. For general questions, it is our legitimate interest in effective visitor communication under Article 6(1)(f) GDPR.

Providing data is voluntary, but we cannot answer without the required information. We do not use contact-form data for advertising or newsletters.

Retention

We retain enquiries and related communication for no more than two years after the last contact, unless longer retention is required for a booking, legal claims or statutory obligations. We then delete or anonymise the data.

Who may receive data

We do not sell personal data. Access is limited to people who need it to handle an enquiry and trusted providers of hosting, technical maintenance or email services. They may process data only for agreed purposes with appropriate safeguards.

We may disclose data to competent authorities when required by law. Transfers outside the European Economic Area must use a valid safeguard such as an adequacy decision or European Commission standard contractual clauses.

Technical data and cookies

Our hosting provider may process standard server-log data such as IP address, request date and time, requested page, browser type and device data. This supports secure, reliable operation and abuse prevention under our legitimate interest in Article 6(1)(f) GDPR. Logs are retained only as long as necessary for security and troubleshooting.

We use Cloudflare Turnstile on the contact form to distinguish people from bots, prevent automated abuse and keep the form secure. When the contact page loads or the form is used, Cloudflare may process security signals including the client IP address, TLS fingerprint, User-Agent header, sitekey and associated origin. Our legal basis is our legitimate interest in protecting the website and its users under Article 6(1)(f) GDPR. Cloudflare acts as our processor when providing this protection and may also process signals under its own responsibility to improve bot detection. Turnstile may use cookies or comparable storage only where technically necessary for this security function, not for analytics or advertising. More information is available in the Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/.

The website currently uses no analytics or advertising cookies and does not track visitors for marketing. If such services are introduced, this policy will be updated and non-essential cookies will not be placed without your prior choice where required by law.

External links and bookings

Bookings are made through Booking.com and Airbnb. When you open an external link, the selected platform processes data under its own privacy policy. Velora does not control how those platforms process data you provide directly.

The same applies to other third-party websites linked from this site.

Your rights

Depending on the circumstances, the GDPR gives you rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests. If processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send requests to reservations@apartmentvelora.com. We normally respond within one month and may reasonably verify your identity before acting.

Complaint to a supervisory authority

If you believe we have mishandled your personal data, contact the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop@azop.hr, or visit www.azop.hr. We would appreciate the opportunity to address your concern directly first.

Security, automated decisions and changes

We use reasonable technical and organisational safeguards against loss, misuse, unauthorised access or disclosure. We do not use personal data for automated decision-making or profiling that has legal or similarly significant effects.

We may update this policy when the website, our processing or the law changes. The current version and its update date are always published here.