Introduction
Plava Laguna d.d., with its registered office at R. Končara 12, Poreč, Croatian Personal Identification Number (OIB): 57444289760, (hereinafter referred to as: Plava Laguna) respects your privacy and the security of your personal data. The collection, use, and processing of your personal data is carried out in accordance with this Privacy Policy and applicable legal provisions, including Regulation (EU) 2016/679 of 27 April 2016 (hereinafter referred to as: the “General Regulation”) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/2018). This Privacy Policy applies to our website, www.istriaexperience.com (the “Website”), through which we provide our services. This Privacy Policy sets out our approach to the protection and management of your personal data, including how we collect personal data, which data we collect, the reasons for processing it, how we use and store it, with whom we share it, and why.
Through this website, Plava Laguna acts as an intermediary in the promotion and management of bookings for certain tourism-related services – including excursions, transfers, tickets, experiences/events, and other travel-related activities (“Experiences”). In such cases, we process personal data relating to the identity of the data subjects, their contact details, and financial information.
The controller
The controller of your personal data is: Plava Laguna d.d., with its registered office at R. Končara 12, Poreč, Croatian Personal Identification Number (OIB): 57444289760, (hereinafter referred to as: Plava Laguna)
Contact information
If you have any questions regarding this Policy, feel free to contact us at the following email address: dpo@plavalaguna.com
Please note that before acting on your request, we may ask you to provide additional information to verify your identity. We may also request further details to confirm whether you are authorised to submit the request on someone else’s behalf.
Information on the processing of personal data
For the purposes of this Policy, the term “data subject” refers to: customers, suppliers, partners, and visitors to our website.
The categories of personal data we may process are as follows:
Identity data, which may include: name and surname;
Contact data, which may include: email address and telephone number;
Experience-related data, which may include: service selection, place of departure, voucher details, information about special requirements, and number of participants;
Analytical data, meaning information obtained from your web browser (such as browser type and language), and details of your visits to our website, including traffic data, location data, logs, page views, visit duration, navigation paths, and data about your device and internet connection, including your IP address and how you interact with our product.
The processing of specific personal date is necessary for the provision of our services, in other words, it is a prerequisite for our business activities.
The processing of personal data may also be based on the data subject’s consent, for example, for the purpose of sending newsletters. In such cases, the data subject has the right to withdraw their consent at any time in relation to the personal data they have provided. The withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal. Data subjects are informed of the possibility to withdraw consent before giving it. The controller is required, at all times, to be able to demonstrate that specific personal data was obtained on the basis of consent.
Customers
If you are a customer using Plava Laguna’s services to book an Experience, we may process your identity data and contract-related information.
In such cases, we process your personal data for the purpose of providing the service, resolving any service-related issues, and ensuring the quality of the service or product.
The legal basis for this processing of customer personal data is the performance of a contract between you and Plava Laguna (as the controller), as well as the pursuit of our legitimate interests in conducting our business activities, except where such interests are overridden by the interests or fundamental rights and freedoms of customers or end users requiring the protection of personal data.
It is in our legitimate interest to provide a high-quality service and to work continuously on its improvement and development. For this reason, we process your personal data in order to:
improve our application programming interface (“API”);
maintain the security and integrity of our website and systems; and
protect or exercise legal rights and investigate complaints.
We will delete the personal data once the purpose for which it was collected has been fulfilled.
Providers
Providers are persons that provide Experiences through this website. If you are a Provider for Plava Laguna, we may process your personal data necessary for the performance of the contract, including identity data, contact information, and financial details. In doing so, we may also process personal data of employees who communicate on the Provider’s behalf, namely: their full name, email address, and telephone or mobile number.
We process Providers’ personal data for the purpose of managing our contractual relationship with the Providers.
The legal basis for this processing is the performance of a contract between the Provider and Plava Laguna, as well as our legitimate interest in carrying out our business activities, except where those interests are overridden by the interests or fundamental rights and freedoms of the Provider or their employees requiring the protection of personal data.
It is in our legitimate interest to provide a high-quality service and to work continuously on its improvement and development. For this reason, we process your personal data in order to:
improve our API;
maintain the security and integrity of our website and systems; and
protect or exercise legal rights and investigate complaints.
We will delete the personal data once the purpose for which it was collected has been fulfilled.
Apart from the above, we also process the personal data of Providers in order to meet legal obligations established by applicable law, primarily data related to financial regulations, all in accordance with the legal framework, and we will retain such personal data for as long as required by applicable law.
Partner
If you are a Partner of Plava Laguna, we may process your personal data necessary for the performance of the contract, including identity data, contact information, and financial details. We may also process personal data of employees who communicate on the Partner’s behalf, namely: their full name, email address, and telephone or mobile number.
We process the Partner’s personal data for the purpose of managing our contractual relationship with the Partner.
The legal basis for this processing is the performance of a contract between the Partner and Plava Laguna, as well as our legitimate interest in conducting our business activities, except where such interests are overridden by the interests or fundamental rights and freedoms of the Partner or the Partner’s employees requiring the protection of personal data.
It is in our legitimate interest to provide a high-quality service and to work continuously on its improvement and development. For this reason, we process your personal data in order to:
improve our API;
maintain the security and integrity of our website and systems; and
protect or exercise legal rights and investigate complaints.
We will delete the personal data once the purpose for which it was collected has been fulfilled.
Apart from the above, we also process the personal data of Partners in order to meet legal obligations established by applicable law, primarily data related to financial regulations, all in accordance with the legal framework, and we will retain such personal data for as long as required by applicable law.
Who we share data with
We may share or transfer customer data with the following categories of third parties (on the basis of a contract containing provisions on the protection of your personal data), some of whom are engaged to provide services, including:
our Providers who supply the Experience booked by the customer through our services;
our partner who owns the API used to manage bookings and payments;
our contractors who provide IT services, system administration, and other IT service providers used for hosting or maintaining our website and digital services:
our analytics providers who assist us in improving and optimising our website and services.
We will share your identity and contact data with the Provider of the Experience (e.g. excursion or transfer Providers) as part of the service we offer. The Provider will process your personal data as an independent data controller. The Provider will use the customer’s data solely for the purpose of delivering the service booked by the customer, and only to the extent and for the duration necessary to carry out that service. The Provider shall adopt and comply with the Policy in accordance with all applicable laws, rules, regulations, and guidelines, including this Privacy Policy, and shall implement reasonable industry-standard physical, technical, and administrative measures to protect customer data, and shall further ensure that any collection, use, or disclosure of customer data is carried out in accordance with all applicable privacy laws, regulations, and policies.
International transfers
Our partner, who owns the API we use for booking and payment services, is based outside the European Union, in the United Kingdom. As a result, their processing of your personal data necessarily involves a transfer outside the EU.
We will transfer your personal data outside the EU only if such transfer is not prohibited or restricted by law.
Data security
We have implemented appropriate technical and security measures to prevent the accidental loss, misuse, unauthorised access, alteration, or disclosure of your personal data. We control physical access to our information systems and business premises. In addition, access to your personal data is restricted to authorised employees who process such data as part of their job responsibilities. These employees will process your personal data strictly in line with applicable instructions and legal obligations and are subject to confidentiality obligations.
Cookies
Plava Laguna uses tools to analyse the use of the Website, which allow us to collect certain information about you and thereby gain insight into the needs of our visitors and/or users, with the aim of improving the quality of our services. This includes the use of so-called cookies, as well as some other tools. The user and/or visitor may configure the use of cookies via the relevant settings on the website. These tools collect and store certain technical data, including the IP address of the user and/or visitor. You can find more information about the cookies and other tools we use here.
Your rights
As a data subject, you are entitled to exercise the rights provided under applicable legislation, including:
The right of access;
The right to rectification and erasure;
The right to restriction of processing;
The right to data portability;
The right to object;
The right to withdraw consent.
All of the above rights may be exercised by submitting a written request to the contact details of Plava Laguna. We will respond within 30 days.
You also have the right to lodge a complaint with the local data protection supervisory authority – namely, the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), to the following address: Agencija za zaštitu osobnih podataka, Ulica grada Vukovara 54, HR – 10 000 Zagreb, E-mail: azop@azop.hr
We place great importance on ensuring that the personal data we hold about you is accurate and current. Kindly notify us of any changes to your personal data during your relationship with Plava Laguna.
Policy amendments and effective date
Plava Laguna reserves the right to amend this Privacy Policy.
This Policy shall enter into force and take effect as of April 2025.