Website user privacy statement

POLICY IN FORCE FROM: 11/2025

1. Purpose of the Privacy Policy

In this section of our website, we will provide you with a detailed notice on how your data is processed (“Privacy Policy”) with the intention of informing you transparently at all times about our activities, allowing you to make valid decisions regarding your personal data. The protection of personal data is of utmost importance to us. The purpose of this Privacy Policy is to explain which personal data we collect, how long we keep it, the reasons for its collection, who has access to your data, what your rights are, and how you can exercise them. We respect your rights and process your data exclusively for the specific and legal purposes stated in this notice.

When processing your personal data, we comply with all regulations relating to the protection of personal data, especially the General Data Protection Regulation (GDPR), which has been in force since May 25, 2018. We also adhere to this Privacy Policy.

As the security of your data is our priority and we monitor all legal developments, it is possible that we will make certain changes to this Policy in the future to ensure compliance with regulations and the overall legal framework. You will be promptly notified of all changes and amendments to the Privacy Policy by publication on the website https://www.budankotravel.com

We, Turistička agencija Budanko travel j.d.o.o., represented by Jurica Budanko, with headquarters at Šimićev prolaz 4, 21300 Makarska, Croatia, PIN (OIB) 40013059472 (hereinafter: "Agency" or "Data Controller"), process the personal data of visitors who use this website.

Please read this Privacy Policy carefully, and if you have any questions regarding the processing of personal data or requests to exercise your rights, you can contact us via email at info@budankotravel.com.

2. What is Personal Data?

Personal data refers to information that can directly identify you (e.g., your name) or indirectly identify you (e.g., via a pseudonym). It includes details such as your email address, home address, mobile phone number, personal identification number, and other similar data. Additionally, personal data can include numerical identifiers, such as the IP address of your computer, mobile phone, MAC address, or cookies.

In this section, we will present the categories of data, purposes, and legal basis for processing your personal data. Detailed information can be found below.

3.1. Whose data do we process?

The Agency processes the personal data of the following persons:

• 3.1.1. Persons accessing the Agency's website.

• 3.1.2. Potential clients of the Agency who contact us directly via email or telephone.

As the data controller, the Agency is responsible for the processing of personal data in these cases. When visitors use the Agency's services and make a reservation via the website, additional data is processed.

3.2. How do we collect personal data?

We collect your personal data in two main ways:

• 3.2.1. Directly from you in various situations, e.g., when you make a reservation, request an offer, contact us by phone, give your consent to receive newsletters, or contact us via email regarding a complaint or to exercise your rights.

• 3.2.2. Automatic collection: We also collect data automatically through our website. This may include information such as your IP address, cookies, browsing activity, and device information. These automated processes help us improve your experience on the website and provide relevant services.

By applying these collection methods, we ensure a comprehensive understanding of your personal data while respecting your privacy and adhering to applicable data protection regulations.

3.3. Why do we process your personal data?

The purposes and legal bases for processing your personal data vary depending on your activities while visiting our website. Generally, we process your personal data to fulfill your requests, specifically by taking actions to conclude a contract, for our marketing activities, and to achieve our legitimate interests in improving business activities.

For more detailed information on the processing of specific data, including the legal basis and purpose, please see the section below showing the activities we engage in.

• 3.3.1. Sending a general inquiry via email or online form: Data collected through these channels is used exclusively for processing your inquiry and communicating regarding services. This processing is carried out to perform actions based on your request prior to the finalization of a contract.

• 3.3.2. Sending other messages: This includes praise or suggestions. The legal basis here is our legitimate interest in improving our business.

• 3.3.4. Cookies and similar technologies: These are implemented to ensure the correct functioning of the website and to improve our offer. For detailed information, please see our Cookie Policy.

3.4. Who are the recipients of personal data?

Depending on the specific purpose, we may share data with relevant third parties, including:

• 3.4.1. Advertising and marketing agencies.

• 3.4.2. Technical support providers.

• 3.4.3. Payment service providers.

• 3.4.4. Legal representatives.

• 3.4.5. Competent state authorities (if required by law).

4. Data Retention Period

Personal data is kept exclusively for the specific purpose for which it was collected, unless regulations dictate a longer period.

• 4.2.1. Data based on consent (newsletter): Kept as long as valid consent exists.

• 4.2.2. Accounting documents (invoices): Kept for 11 years.

• 4.2.3. Compensation claims: Kept for a maximum of 5 years.

• 4.2.4. Visitor messages: Usually processed within 10 business days; complaints are kept for 1 year.

• 4.2.5. Official proceedings: Kept for the duration of the proceedings; realized claims kept for 10 years after the final judgment.

5. Security of Personal Data Processing

We process your personal data within the European Economic Area (EEA). We have implemented organizational and technical measures to protect data from loss, destruction, alteration, or unauthorized access.

6. Links to Third-Party Websites

The Agency is not responsible for the data processing that occurs on third-party websites reached via links on our site. We recommend reviewing their specific privacy policies.

7. Your Rights

To exercise your rights, please contact us at: info@budankotravel.com.

• 7.1. Right to withdraw consent: You can withdraw consent for newsletters at any time.

• 7.2. Right of access: You have the right to receive confirmation of processing and a copy of your data.

• 7.3. Right to be forgotten (Erasure): You can request the deletion of data if there is no valid reason for further processing.

• 7.4. Right to rectification: You can request the correction of inaccurate or incomplete data.

• 7.5. Right to object: You can object to processing based on legitimate interests.

• 7.6. Right to restriction of processing.

• 7.7. Right to data portability.

• 7.8. Right to information.

• 7.9. Right to lodge a complaint with AZOP: You have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP).

8. Final Provision

This Privacy Policy aims to provide a clear understanding of how we process your data. As the data controller, we guarantee that all data is processed in full compliance with current regulations.

Turistička agencija Budanko travel j.d.o.o. Director: Jurica Budanko Address: Šimićev prolaz 4, 21300 Makarska, Croatia OIB: 40013059472