Privacy Policy
Last updated: 11.09.2026.
This Privacy Policy explains what personal data we collect when you visit this website or contact us, why we use it, and what rights you have under the General Data Protection Regulation (GDPR).
1. Data controller
The data controller is Avalena, Ul. Augusta Šenoe 22, Borik, Zadar, Croatia (Tax ID: [company tax ID to be added]). For any privacy-related questions, contact us at info@avalena.hr or +385 91 474 7435.
2. What data we collect
This site does not include a form that automatically collects personal data. We process your data only in the following cases:
- Booking and contact enquiries — when you contact us by email or phone, we process the information you provide (e.g. name, email address, phone number, message content, requested dates).
- Technical data in your browser — the site stores your chosen display language and your cookie/privacy preferences locally in your browser (local storage, not a classic cookie). This data is never sent to our servers. See our Cookie Policy for details.
- Data logged by our hosting provider — like any website, the server and CDN hosting this site may record standard technical logs (IP address, browser type, access time) for security and maintenance purposes.
3. Purpose and legal basis
We process your data on the basis of:
- Pre-contractual steps / your request — when you send a booking enquiry, we process your data in order to respond and prepare an offer.
- Legitimate interest — to keep the website secure and functioning correctly (technical logs, essential local storage).
- Consent — for anything not strictly necessary for the site to work (e.g. any future analytics), which you can give or withdraw at any time via the cookie settings.
4. Cookies and similar technologies
For a detailed list of what we store in your browser, why, for how long, and how to manage your preferences, see our Cookie Policy.
5. Data retention
We keep data from booking enquiries for as long as needed to handle your enquiry and any related communication about your stay, and no longer than 2 years from the last contact, unless a longer period is required by law (e.g. tax regulations). Privacy preferences stored in your browser remain until you delete or change them yourself.
6. Recipients of data
We do not sell or share your data with third parties for marketing purposes. Data may only be accessed by service providers we use to run the site and our business (e.g. our email provider and hosting/CDN provider), who process it strictly on our instructions and in line with applicable data protection law.
7. Transfers outside the EU/EEA
We do not currently carry out any intentional transfer of personal data outside the European Union/European Economic Area. Should this change (e.g. through a new third-party service), this Privacy Policy will be updated with the relevant safeguards.
8. Your rights
Under the GDPR, you have the right to:
- access the data we hold about you,
- rectify inaccurate or incomplete data,
- request erasure ("right to be forgotten"),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at info@avalena.hr. If you believe our processing of your data does not comply with the law, you have the right to lodge a complaint with the Croatian Data Protection Agency (AZOP), Selska cesta 136, Zagreb — azop.hr — or with your local supervisory authority.
9. Data security
We take reasonable technical and organisational measures to protect the data we process against unauthorised access, loss or misuse.
10. Minors
This website is not intended for individuals under 18 years of age, and we do not knowingly collect data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time, for example due to legal changes or new site functionality. The date of the latest update is shown at the top of this page.