Privacy and cookie policy

1. Data controller and contact

2. Essential technical data

When you open the site, the hosting provider processes technical logs needed to deliver, secure and operate the site reliably. These logs may contain:

• the source IP address;
• the date, time and time zone of the request;
• the HTTP method;
• the requested URL, including its path and query parameters;
• the HTTP response status and amount of data transferred;
• browser and device information in the User-Agent field;
• the previous-page address in the Referrer field, when sent by the browser.

These data are used to deliver the site securely and correctly, prevent misuse, and identify and resolve technical problems. The legal basis is the controller’s legitimate interest in the secure, stable and correct operation of the website.

Hosting is provided by Cyber_Folks. According to the provider, the hosting servers and data are located in Zagreb, Croatia, access is available to their administrators and the authorised hosting-account user, and web logs are retained for one year.

3. Optional usage analytics

Google Analytics 4 loads only if you choose “Allow all optional content”. If you choose “Necessary only”, Google Analytics does not load and Google 360, Google Maps and YouTube do not load automatically.

Analytics helps us understand which pages and links are useful and improve the content and user experience. It may record:

• page views;
• language selection;
• opening apartment pages, categories and Local Guide articles;
• clicks to check availability and book directly;
• clicks on WhatsApp, telephone and email;
• clicks on parking, maps, arrival directions, the gallery, virtual tours, external sources and content sharing.

We deliberately do not include a guest’s name, message text, PIN or other access information, booking dates, contact values or payment details in custom analytics events. Query parameters and fragments of destination URLs are not sent in those custom events.

Google may nevertheless process technical device and network data under its own rules. Google advertising storage, ad personalisation and Google signals are disabled in our implementation.

4. Cookies and settings

Optional analytics and external-content choice

The site uses the incenterAnalyticsConsent cookie to remember whether you allowed or rejected optional analytics and automatic loading of Google 360, Google Maps and YouTube.

• purpose: remembering your choice;
• duration: up to 180 days;
• type: essential interface setting;
• protection: SameSite=Lax, with Secure when the site is used over HTTPS.

Earlier consent values that covered fewer optional services are not reused for this wider choice. The site asks again before automatic loading.

Google Analytics cookies

If you allow analytics, Google Analytics may set cookies whose names begin with _ga. Some Google Analytics cookies may last up to two years, depending on Google’s current configuration and policies.

If you later select necessary cookies only, the site withdraws analytics consent and attempts to remove available _ga* cookies for its domain.

5. Managing your choice

On your first visit you can:

• allow optional usage analytics and automatic loading of Google 360, Google Maps and YouTube; or
• choose necessary cookies only.

You can change your choice later using the “Cookie settings” button. Refusing does not prevent basic use of the site; each external item can still be loaded individually with its displayed button.

6. Google Maps, Google 360° and YouTube

Google 360, Google Maps and YouTube load automatically only after you choose “Allow all optional content”. If you choose “Necessary only” or have not yet made a choice, local placeholders and individual load buttons are shown instead.

Your browser connects to Google or YouTube only after that combined consent or after you select an individual “Load map”, “Load 360 view” or “Load video” button. The provider may then receive technical data such as your IP address, browser details and Referrer under its own rules.

Loading one item with its button does not turn on Google Analytics or change your stored choice. You may use the offered external link instead of the embedded view.

YouTube content uses the youtube-nocookie.com domain, which is privacy-enhanced mode, but YouTube remains an external service.

7. Other external services and links

The site contains links to external services, including:

• Rentlio for availability checks and direct booking;
• WhatsApp for communication;
• Google services;
• official tourism, transport, parking and hospitality sources.

An external service opens only when you select its link or request that embedded content be loaded. From that moment, the relevant provider’s privacy rules and terms apply.

If you contact us by telephone, email or WhatsApp, the data you send are processed to answer your enquiry and communicate about accommodation or a booking.

8. Recipients and data transfers

Data may be processed by:

• Cyber_Folks as hosting provider;
• Google and YouTube, only after you allow all optional content or individually request Google or YouTube content;
• providers of services that you choose to open, such as Rentlio or WhatsApp.

Some providers may process data outside Croatia or the European Economic Area. Such processing and possible transfers are governed by their current policies, contractual terms and applicable safeguards.

Provider information is available, among other places, at:

• Google Privacy Policy
• Cyber_Folks terms of use

9. Retention periods

• optional-content choice: up to 180 days;
• Google Analytics event- and user-level data: 14 months; resetting the period on new user activity is enabled;
• hosting web logs: one year;
• data sent to an external booking system, WhatsApp, telephone or email: according to the purpose of the communication and the rules and retention periods of the relevant channel.

10. Your rights

Depending on applicable law, you may request access to personal data, rectification, erasure, restriction of processing or data portability, and you may object. You may withdraw analytics consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact incenter.rijeka@gmail.com. We will respond within one month at the latest. If a request is complex or there are several requests, the period may be extended under applicable rules, with timely notice.

We will request additional identity verification only where there is justified doubt about the requester’s identity. A copy of an identity document is not requested routinely.

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP): azop.hr.

11. Changes to this policy

We may update this policy when site functions, service providers or legal obligations change. The date of the latest update will always be stated on this page.