Privacy policy

This is a translation for your convenience. In case of any discrepancy, the Croatian version of this document prevails.

Last update: 05.10.2026.

This Privacy Policy explains how the My Adriatic Way platform (further: "Platform", "we", "us") collects, uses, stores and protects users' personal data when using the website and boat tour booking services. The policy is aligned with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the Act on the Implementation of the General Data Protection Regulation of the Republic of Croatia.

1. Data controller

Data about the Platform (controller):

• Byte IT, obrt
• Vrpolje, Put Birnja 20, 22000 Šibenik, Croatia
• OIB: 15831663764
• E-mail for questions and requests about data protection: [email protected]

The identity and contact of the charter company whose tour you are booking can be found at its page on this Platform and in the reservation confirmation e-mail.

The roles are divided according to the processing stage, because two parties participate in the reservation:

• Platform (My Adriatic Way) — data controller for collection of your data via the form on this page, their transfer to the selected charter company and for the operation and security of the Platform itself. The platform determines which fields are requested and how the query is forwarded.
• Charter company whose tour you have chosen — the data controller for everything that is done with your data after receiving the request: contacting, confirmation or cancellation, execution of the tour and own records. In this part, the Platform acts as a processor, that is, it stores and processes data exclusively according to the instructions of that company.

For the collection and forwarding phase, the Platform and the charter company act as joint controllers (Article 26 GDPR). The essential content of their agreement is as follows: The platform ensures the form, system security, e-mail notifications and compliance with the retention period; the charter company decides to accept the reservation and is responsible for its further processing; both parties are obliged to forward to each other the request of the data subjects that they receive.

You can exercise your rights against either of those two parties (Art. 26, paragraph 3 of the GDPR) — either through the charter company's contact information listed on its website, or at [email protected]. A request received from one party is forwarded to the other.

2. What data we collect

When sending a request for a tour reservation, we collect the following personal data that you voluntarily submit to us:

• Name and surname — for identification and contact purposes;
• E-mail address — to send confirmation, reply and reservation status;
• Phone number (optional) — for faster contact;
• Desired date and number of guests — to process the reservation;
• Message (optional) — additional notes you enter yourself.
• Reservation number (eg MAW-2026-00042) — a label assigned by the system to each reservation for easier tracking and communication. The number itself does not contain your personal data.

Automatically, for technical and security reasons, we also collect:

• IP address from which the request was sent — for protection against misuse, unauthorized and automated (spam) reservations and for record keeping in case of dispute. The IP address is displayed in the booking form and is automatically recorded with your inquiry;
• Time of giving consent — when you confirm your agreement with this Policy when sending an inquiry, we record the date and time of that consent for proof of lawful processing;
• Reservation source and language — we record whether the reservation was made via a web form or entered on your behalf by an authorized representative (booker) of the charter company, and the language in which you communicated, for proper processing and communication;
• Technical data — browser type, language and access time (via necessary cookies).

In the case of a reservation on the ground (e.g. on site or by phone), an authorized representative of the charter company ("booker") can enter the above information into the system on your behalf. In this case, the booker acts on behalf of the charter company that is the data controller, and you still retain all the rights specified in this Policy. You will receive confirmation of the confirmed reservation by e-mail.

3. Purpose and legal basis of processing

We process your data exclusively for the following purposes:

• Reservation processing and communication with you — legal basis: taking actions at your request before concluding a contract (Article 6, paragraph 1, point b GDPR);
• Sending confirmation, notification of receipt and reservation status by e-mail (including notification of cancellation) — legal basis: execution of actions at your request;
• Keeping records of consent (date and time of acceptance of this Policy) — legal basis: fulfilling the obligation to prove the legality of the processing (Article 7 of the GDPR);
• Protection against misuse and fraud (recording of the IP address) — legal basis: the legitimate interest of the data controller (Article 6, paragraph 1, point f GDPR) for system security;
• Fulfillment of legal obligations — when required by regulation.

4. To whom the data is delivered

We pass your reservation information exclusively to the charter company whose tour you have chosen, so that they can process your inquiry. Access to reservation data within that company is given to its authorized employees, including the company owner and authorized representatives (bookers) in charge of entering and processing reservations. We do not sell, rent or share data with third parties for marketing purposes.

To send e-mail notifications, we use an e-mail service provider (Microsoft 365 / SMTP server). Email transmission is encrypted (TLS). Data may be processed on servers within the EU/EEA.

Processors and transfer outside the EU. Apart from the charter company, data can only be accessed by service providers necessary for the operation of the Platform:

For transfers to third countries, standard contractual clauses of the European Commission, or other mechanisms from Chapter V of the GDPR, which these providers have incorporated into their conditions, apply.

What we do NOT send to anyone: fonts, map and all libraries are served from our server, and the map tiles are fetched by our server for you. Your browser therefore does not contact Google, Esri, CARTO or any other external service during your visit, so your IP address is not sent to them either.

5. Storage period

We keep personal data only as long as is necessary for the purpose for which it was collected, with predetermined deadlines:

• Reservation data (name, e-mail, phone, message) — 12 months from the date of the tour, or from the receipt of the inquiry if the tour did not take place;
• IP address and time of granting consent — also 12 months, after which they are deleted;
• Automatic anonymization: upon expiration of the term, the system itself, without special request, permanently removes the name, e-mail, telephone, message, IP address and time of consent from the record. After that, the record no longer allows you to be identified;
• What remains after anonymization: exclusively non-personal data required for business records and accounting — reservation number, charter company, tour, date, number of people, amount and commission. This data is not linked to you;
• Before the expiration of the deadline, you can request deletion at any time (see point 6), except when the processing is necessary for the establishment, realization or defense of legal claims (e.g. a complaint or an ongoing dispute) — then the data is kept until the end of that procedure;
• Backups: data can exist for a short time in backups that are rotated regularly. Deletion is carried out in them after the expiration of those copies, and if the copy is returned to operation, the deletion is repeated.

A charter company may have its own legal retention periods (eg accounting regulations) that apply to its records and are not affected by the Platform.

6. Your rights

In accordance with the GDPR, at any time you have the right to:

• Access his personal data;
• Correction of incorrect or incomplete data;
• Deletion ("right to be forgotten") — you can request the permanent deletion of your data;
• Processing restrictions and objections to processing;
• Portability of data;
• Withdrawal of consent at any time (when processing is based on consent).

You can send the request to Platform or charter company — whichever receives it, will forward it to the other party. If you have a reservation number (e.g. MAW-2026-00042), please include it as it speeds up the search of records. We respond to the request without delay, and within one month at the latest. After the deadline from point 5, the data is automatically anonymized anyway.

To exercise any right, write to us at [email protected]. You also have the right to file a complaint with the supervisory authority — Agency for the Protection of Personal Data (AZOP), Selska cesta 136, Zagreb (azop.hr).

7. Data security

We apply appropriate technical and organizational protection measures: connection encryption (HTTPS/TLS) for accessing the site and for sending e-mails, cryptographic storage of passwords (hash), protection against unauthorized access to the administration, limiting the number of login attempts, protection against automated (spam) reservations, protection against request forgery (CSRF) and regular backups. Only authorized persons of the charter company and the Platform have access to the data, each within the scope of their authority.

8. Cookies

The platform uses cookies necessary for the operation of the site. See the separate Cookie Policy for details.

9. Minors

The platform is not intended for persons under the age of 16. We do not knowingly collect information from minors without the consent of their parents or guardians.

10. Changes to the Policy

We reserve the right to change this Privacy Policy. We publish all changes on this page with the updated date. We recommend periodic checking.