1. Data controller
The controller is ŠVARC PROJECT MANAGEMENT d.o.o., Škuncini stani – Samorašnji 100, 53291 Novalja, Croatia, OIB 05942749080. Privacy contact: racun@svarc.hr.
2. Data we process
- Name, email, phone and billing details.
- Stay dates, number of guests and message content.
- Order, payment and related communication records.
- Necessary technical and security data used by the website and payment page.
3. Purposes and legal basis
We use data to handle enquiries, enter into and perform accommodation contracts, receive payments, meet accounting and legal duties, handle complaints and protect legitimate business interests. Marketing is sent only with an appropriate consent or other lawful basis.
4. Recipients and transfers
Where necessary, data may be processed by Stripe as payment provider, our accountant, hosting and email providers, the resort and Avantio. Each recipient processes data according to its role and legal obligations.
5. Retention
Unsuccessful enquiries are kept only as long as necessary, normally no longer than 12 months. Booking, payment and accounting records are kept for the periods required by Croatian law and to protect legal claims.
6. Your rights
You may request access, correction, erasure, restriction, object to processing and, where applicable, request data portability. Consent can be withdrawn at any time. You may also complain to the competent supervisory authority. Send requests to racun@svarc.hr.
7. Cookies, external content and website analytics
We use necessary cookies and local storage for security, administrator login, language preference and the booking process. Analytics and the live Instagram content are enabled only with your consent. We record campaign source, visited page and booking-funnel steps; we do not send names, email addresses or phone numbers to analytics.
You can change your choice at any time through the Cookies link in the footer. After consent, Google Analytics / Google Ads may be used and the public @villas_on_beach profile is loaded directly from Instagram. Google and Meta act as separate providers and may receive technical connection data under their own terms.
8. Marketing emails
We send special offers, news and available-date information only to guests who give a separate voluntary consent in the form. Marketing consent is not required for a booking and the box is not pre-selected.
For this purpose we record name, email, phone, language, and the time and source of consent. Consent can be withdrawn free of charge at any time through the link in every marketing message or by emailing racun@svarc.hr. After unsubscribing, the address is no longer used for marketing; a limited suppression record may be kept to demonstrate withdrawal and prevent unwanted re-subscription.