Guest Privacy Notice

1.Who is responsible for your data

The controller — the person who decides why and how your data is used — is:

Slavica Svilar Kotorska 54, 51260 Crikvenica, Croatia OIB 98307611899

She is the registered private renter for Apartments Gloria. "Apartments Gloria" is the name of the house, not a company; the person legally responsible for your data is named above.

The processor — the company that runs the booking and guest-management platform on her behalf — is:

quantX Ltd Bahnhofplatz, 6300 Zug, Switzerland <info@quantx.partners> · UID CHE-429.016.202

quantX acts only on the controller's documented instructions and never uses your data for its own purposes.

There is no Data Protection Officer, which the GDPR does not require at this scale. Write to either address and a person will answer.

2.What we collect, and why

We collect different things for different reasons, and the reason determines what rights you have over each. This is the honest version of that table.

2.1 To give you the apartment you booked

Your name, contact details, the dates of your stay, how many of you there are, which apartment, the price, and anything you asked us for. We need this to perform the accommodation contract with you. Without it there is no booking. If you book on our own website we also ask for your mobile number, so that we can reach you about your arrival and your stay; that is part of the same contract, not marketing.

If you booked through Booking.com, they gave us these details. If you booked directly, you gave them to us.

2.2 Because Croatian law requires it

Croatian law obliges every accommodation provider to register guests with the national eVisitor system. For that we must record your surname and first name, gender, date of birth, country of birth, citizenship, the country you live in, the type and number of your travel document, your tourist-tax category, and your arrival and departure dates. Your place of birth is needed only if you were born in Croatia, and your town only if you live in Croatia.

We do not record your full home address. eVisitor permits it but does not require it, so we leave it out.

This one is not a choice — not ours and not yours. We cannot host you without it, and we cannot delete it on request, because the law sets how long it is kept. We are telling you plainly rather than dressing it up as consent.

2.3 To connect you to the WiFi

Your email address, your device identifier, and when you connected.

Your internet access does not depend on agreeing to marketing. The network lets you on first. Anything else we ask is a separate question you are free to answer with no.

2.4 To send you offers

If you booked and paid directly on our website, we may email you occasional offers — for our own apartments only, never anyone else's. Croatian law allows this for our own customers (Zakon o elektroničkim komunikacijama, čl. 50. st. 2.) on one condition, which we keep: you can say no when you book, with a box on the booking page, and in every email, with one click. Say no once and we stop for good; booking again does not change that.

Everything else only if you say yes: offers by WhatsApp, offers to a guest who booked through Booking.com or another platform, and anything you sign up to on the WiFi page or the arrival form. For these we use your name, the email or mobile number you give us yourself, which stays you have made, and — if you take part in the referral programme — who referred you or whom you referred. We never send offers to the address a booking platform passes on to us; that address exists only for your booking.

We keep a record of exactly what you were shown when you agreed, and when. That record exists to protect you: it is what lets you check later what you actually consented to.

You can withdraw or say no at any time, from a link in every message we send or by writing to us. It is as easy as agreeing was, and it changes nothing about your booking.

2.5 To take payment

The cardholder name, the amount, the time, and a payment token.

We never see or store your card number. It goes directly to the payment provider, and what comes back to us is a token that cannot be used anywhere else.

2.6 To reply to you, and to your reviews

Your messages to us — by email, through the booking platform, or on WhatsApp if you choose to write to us there — and any review you publish. We rely on our legitimate interest in answering guests and responding publicly to public reviews. You can object — see §5.

2.7 If you need an invoice

Most guests need nothing beyond a receipt. If you need an invoice your employer or your own company will accept, we also need the billing name, address and tax number to put on it. We ask for those only when you ask for the invoice, and keep them for as long as accounting law requires.

2.8 If you visit our pages on social media

Where we run a page on a social platform, the platform gives us anonymous statistics about who visited it. For those statistics the platform and we are joint controllers — it decides how they are collected, we decided to have a page. What the platform does with your data there is covered by its own privacy notice; what we do with it is look at how many people saw a post.

We do not publish a photograph in which a guest is recognisable, or a guest's name, without asking that guest first.

3.Who else sees your data

We work with a small number of service providers, listed here by what they do. Individual suppliers change from time to time; what they are given, and why, does not.

Three of those are outside the EU, and in each case the European Commission has formally decided that the country, or the framework the recipient has joined, protects your data to an equivalent standard:

• the platform is hosted in the United Kingdom, under the adequacy decision renewed on 19 December 2025 and running to 27 December 2031;

• the processor is established in Switzerland, under the adequacy decision in force since 2000 and confirmed by the Commission's review of 15 January 2024;

• Google LLC in the United States, if you accept analytics on our website, under the EU–US Data Privacy Framework (adequacy decision of 10 July 2023), to which Google LLC has certified.

Your data is not used to train anyone's AI models, and it is not sent to externally hosted AI services.

4.How long we keep it

5.Your rights

You can ask us to:

• show you everything we hold about you (Art. 15);
• correct anything wrong (Art. 16);
• delete it (Art. 17) — we will, except where the law obliges us to keep it, and we will tell you specifically which data that is and why;

• restrict how we use it while a dispute is resolved (Art. 18);
• hand it over in a machine-readable form, to you or to someone else (Art. 20);

• stop processing based on legitimate interest (Art. 21); and
• withdraw consent for marketing, or for analytics on our website, at any time (Art. 7(3)), and say no to offers by email at any time (Art. 21(2)) — after which we stop for good.

Write to the contact address in §1. We answer within one month.

If you are not satisfied, you may complain to the Croatian supervisory authority: AZOP, Agencija za zaštitu osobnih podataka, Selska cesta 136, 10000 Zagreb, <azop@azop.hr>. You may also complain to the authority where you live.

6.Automated decisions

We do not make decisions about you by automated means alone, and we do not profile you in any way that produces legal or similarly significant effects.

7.Children

We register children with the authorities exactly as the law requires, and for the same reason as adults. We do not market to children and do not knowingly collect a child's email address through the WiFi portal.

8.Cookies and website analytics

Until you say yes, apartmentsgloria.com sets no cookies and sends nothing to Google or anyone else. Its fonts, images and scripts are served from the site's own address. What it does store on your device is your answer to the question below — yes or no, when you gave it and which version of the question you saw — so that it does not ask on every page. That answer stays in your browser; it is not sent to us or to Google.

What we ask. A bar at the foot of the page asks whether we may use Google Analytics. It offers two equal choices, Accept and Reject. Nothing is ticked in advance and nothing on the site depends on the answer: if you reject it, or ignore the bar, every page reads and every booking works exactly the same.

If you accept, your browser loads Google Analytics, and Google records for us:

• the pages you visit and how long and how far you read (the address only, never what follows the "?" in it);
• how you reached the site — a search, an advertisement, another website;
• when you check dates and when you go on to the booking page, with the number of nights, how many guests and, where only one apartment fits, which apartment — never your name, email address or the dates themselves;
• when you complete a booking on our booking page, that a booking was made and its total in euros — not your booking number, and nothing about you;
• what Google Analytics collects from any browser: your device type, browser, approximate location derived from your IP address, and a random identifier stored in a cookie.

Why: to understand how visitors find and use the site, and to measure our advertising with Google — including letting Google show our ads to people who have visited the site before. Legal basis: your consent (Art. 6(1)(a) GDPR), which is also what Croatian law requires before anything is stored on your device for this purpose (Zakon o elektroničkim komunikacijama, implementing the ePrivacy Directive).

Who receives it: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with Google LLC in the United States. Google processes the analytics for us under its data processing terms. The transfer to the United States rests on the EU–US Data Privacy Framework (§3).

The cookies Google Analytics sets, on our domain:

Those durations are Google's own, from its published cookie list ("Cookie information for Google's ad products", business.safety.google). The events Google records are kept in Google Analytics for 14 months, then deleted.

Changing your mind. Every page has a Cookie settings link at the foot ("Postavke kolačića" in Croatian). It opens the same question again. If you withdraw a yes, the site deletes the _ga and _ga_ cookies from your browser and reloads without Google Analytics; nothing more is recorded from then on. Withdrawing does not undo what was recorded before it. If we ever change what we ask, we ask again rather than relying on your earlier answer.

Links that leave the site take you to pages run by others, under their own policies. The booking page is run by Beds24, our booking system, on its own address; it sets a session cookie to hold your booking while you complete it, and payment is taken there. Any other site we link to may set cookies of its own, described in its own privacy policy.

9.Security

Guest data is held in an isolated environment with encryption at rest and access limited to the people who need it. Card numbers never reach us. Should something go wrong, §10 says what happens.

10.If something goes wrong

If a breach is likely to put your rights at serious risk, we will tell you directly and without delay, in plain language, along with what we are doing about it. We will notify AZOP within 72 hours where the law requires it.

11.Keeping this notice current

We review this notice at least once a year, and whenever we start doing something genuinely new with your data — a new purpose, or a new kind of recipient. Replacing one mailing provider with another of the same kind is not that, and does not need a new version of this document.

The version number and the date at the top tell you which text you are reading. Earlier versions are kept.