Last updated: August 2026
The controller responsible for processing your personal data is:
Business: Hidden Gems Dubrovnik
OIB: Not currently applicable
Address: [Business Address, Dubrovnik, Croatia]
Email: info@hiddengemsdubrovnik.com
Phone: +385 95 1990 046
Website: hiddengemsdubrovnik.com
Hidden Gems Dubrovnik respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Croatian data protection laws.
We may collect personal data when you browse our website, contact us, or book an experience.
Depending on how you interact with us, this may include:
Identity information: Full name
Contact information: Email address and phone number
Booking information: Selected experience, preferred date and time, number of guests, and special requests
Communication records: Messages and information you provide through email, WhatsApp, contact forms, or other communication channels
Technical information: IP address, browser type, device information, approximate location, pages visited, and information about how you interact with our website
Payment information: Where online payment is available, payment information is processed securely by Stripe. Hidden Gems Dubrovnik does not store your full card details on its own servers.
We only collect information that is reasonably necessary for providing our services, managing bookings, communicating with customers, operating our website, and complying with our legal obligations.
We may use your personal data for the following purposes:
Managing bookings: To receive, confirm, modify, and manage your reservation
Providing experiences: To organise and deliver the experience you have booked
Customer communication: To answer questions and communicate important information regarding your booking or experience
Payment processing: To process payments securely when online payment is available
Customer support: To respond to requests, complaints, and other communications
Website operation: To maintain website security, functionality, and performance
Website analytics: To understand how visitors use our website and improve our services and user experience
Fraud and security: To prevent abuse, fraudulent activity, spam, and security incidents
Legal compliance: To comply with applicable legal, tax, accounting, and regulatory requirements
We do not sell your personal data to third parties.
We do not use your personal data for unrelated purposes without an appropriate legal basis.
Under the GDPR, we process personal data on one or more of the following legal bases:
We process information that is necessary to arrange and provide an experience you have requested or booked, including managing your reservation and communicating important information related to it.
We may process certain information where necessary for our legitimate interests, such as maintaining website security, preventing fraud and abuse, responding to customer inquiries, and improving our services.
Where required, we rely on your consent for optional cookies and similar technologies, including analytics and other non-essential tracking technologies.
You may withdraw consent at any time.
We may process and retain certain information where necessary to comply with applicable Croatian or European legal, tax, accounting, or regulatory requirements.
We use selected third-party services to operate our website, communicate with customers, analyse website usage, process payments, and protect our website.
These services may include:
When online payments are available, Stripe processes payment information securely on our behalf.
Hidden Gems Dubrovnik does not store your full payment card details on its own servers.
Stripe may process personal data in accordance with its own privacy policy and applicable data protection requirements.
We use Google services, including Google Analytics and services provided through Google Site Kit, to understand how visitors use our website and improve its performance.
Depending on the services enabled on the website, Google may process technical and usage information such as IP address, device information, browser information, and website interactions.
Our website may use Google Maps to display maps, locations, meeting points, or other geographical information.
Google may process technical information when Google Maps content is loaded or interacted with.
We may use Google reCAPTCHA to protect forms and other website functions against spam, abuse, and automated submissions.
reCAPTCHA may collect technical and usage information necessary to determine whether an interaction is likely to be performed by a human user.
We may communicate with customers through WhatsApp when customers choose to contact us through WhatsApp or when WhatsApp is used as a communication option on our website.
Information exchanged through WhatsApp is also subject to WhatsApp/Meta’s applicable privacy policies and terms.
We only share personal information with third-party service providers where reasonably necessary for the relevant service or purpose.
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.
Generally:
Booking information: Retained for as long as necessary to manage the booking and subsequent customer service, and for any additional period required by applicable tax, accounting, or legal obligations.
Payment and transaction records: Retained for the period required by applicable accounting, tax, and legal requirements.
Contact inquiries: Retained for as long as reasonably necessary to respond to the inquiry and manage any resulting communication or business relationship.
Communication records: May be retained where reasonably necessary for customer service, dispute resolution, security, or legal purposes.
Consent and cookie preferences: Retained as necessary to demonstrate and manage your privacy choices.
Analytics information: Retained according to the applicable settings and retention periods configured for the relevant analytics service.
When personal data is no longer necessary, it will be deleted, anonymised, or otherwise securely disposed of where reasonably possible.
Under the GDPR, you may have the following rights regarding your personal data:
Right of access: You may request information about the personal data we process about you and request a copy of that data.
Right to rectification: You may ask us to correct inaccurate or incomplete personal data.
Right to erasure: You may request deletion of your personal data where there is no valid legal reason for us to continue processing it.
Right to restrict processing: You may request that we restrict processing of your personal data in certain circumstances.
Right to data portability: Where applicable, you may request your personal data in a structured, commonly used, machine-readable format.
Right to object: You may object to certain processing, particularly processing based on legitimate interests or direct marketing.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Some rights are subject to legal limitations. For example, we may be required to retain certain information to comply with legal or accounting obligations even if you request its deletion.
To exercise your rights, contact us at:
Email: info@hiddengemsdubrovnik.com
Phone: +385 95 1990 046
We will respond to valid requests within the period required by applicable data protection law.
If you believe that your rights have not been respected, you have the right to lodge a complaint with the Croatian supervisory authority:
Croatian Personal Data Protection Agency (AZOP)
Website: azop.hr
Our website uses cookies and similar technologies to ensure that the website functions correctly, remember your preferences, understand how visitors use the website, and improve our services.
We use Complianz to manage cookie consent and preferences.
When you first visit our website, you may be asked to choose which categories of non-essential cookies and similar technologies you wish to allow.
Some cookies and similar technologies are necessary for the website to function correctly.
These may be used for purposes such as:
Website security
Form functionality
Booking functionality
Remembering privacy and cookie preferences
Essential website functionality
These technologies may remain active because the website cannot function properly without them.
Where you provide the required consent, we may use Google Analytics through Google Site Kit to understand how visitors interact with our website.
Analytics may collect information such as:
Pages visited
Approximate location
Device and browser information
How visitors arrived at the website
Interactions with the website
Analytics cookies are not used unless permitted by your cookie preferences and applicable law.
Google Maps may use cookies or similar technologies when map functionality is loaded or used.
The availability and operation of these technologies may depend on your cookie preferences and Google’s own policies.
Google reCAPTCHA may process technical and interaction information to protect our website from spam and automated abuse.
Our website may include a WhatsApp contact button. If you choose to use it, you will be directed to WhatsApp and your interaction will then be subject to WhatsApp’s own privacy policy and terms.
You can change or withdraw your cookie preferences at any time through the Manage Cookies option available on our website.
You can also manage or delete cookies through your browser settings.
We take reasonable technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration, or disclosure.
However, no method of transmitting or storing information online can be guaranteed to be completely secure.
Where third-party providers process personal data on our behalf, we seek to use providers that provide appropriate security and data protection safeguards.
Some third-party service providers we use may process personal data outside Croatia or the European Economic Area (EEA).
Where personal data is transferred outside the EEA, appropriate safeguards will be used where required by applicable data protection law, such as an adequacy decision, Standard Contractual Clauses, or another legally recognised transfer mechanism.
Our website and services are not specifically directed toward children.
We do not knowingly collect personal data from children where such collection is not permitted by applicable law.
If you believe that a child has provided us with personal data improperly, please contact us so that we can review and take appropriate action.
For questions about this Privacy Policy, the processing of your personal data, or to exercise your GDPR rights, please contact us:
Hidden Gems Dubrovnik
Email: info@hiddengemsdubrovnik.com
Phone: +385 95 1990 046
Address: [Business Address, Dubrovnik, Croatia]
We may update this Privacy Policy from time to time to reflect changes to our services, website, third-party providers, cookies, or applicable legal requirements.
When we make significant changes, we will update the Last updated date at the top of this page.
We encourage you to review this Privacy Policy periodically to stay informed about how we process and protect your personal data.
