This policy explains how Dubrovnik Explore handles personal data when you use dubrovnik-explore.com, contact us or arrange a private transfer or tour. It also explains your choices and how to exercise your rights.
1. Who is responsible for your data?
The data controller is DUBROVNIK EXPLORE, obrt za autotaksi prijevoz vl. Bruno Tadić, Dubrovnik, kneza Branimira 51, a Croatian sole trader owned by Bruno Tadić.
Business address: Kneza Branimira 51, 20000 Dubrovnik, Croatia
OIB: 91267117879
Craft register number (MBO): 98524780
Email: info@dubrovnik-explore.com
Phone: +385 91 608 1135
You can contact us using these details for any question or request about your personal data.
2. What information do we handle?
When you contact us by email, phone or WhatsApp, we receive the information you choose to share. This may include your name, contact details, requested dates, pickup and destination details, group size, flight details and messages about the service. A confirmed booking may also require billing details and records of the agreed service and payment.
If you arrange travel for someone else, we may receive their relevant details from you. Please share this policy with them and provide only the information needed for their journey.
When you browse the website, the systems delivering and protecting it process technical information such as your IP address, request time, requested resource, browser information and security events. Optional visit measurement is described separately below.
We also process your saved privacy choice and a limited record of analytics consent or withdrawal. These records are used to respect and demonstrate your choice, not to build a profile of your visits.
Please do not send payment card details, passwords, copies of identity documents or detailed medical information in an initial inquiry. If specific information is genuinely required for a requested service, we will explain why and how to provide it before asking for it.
3. Why do we use your data?
We use inquiry and booking details to answer a request for a quote, prepare the service you ask for, communicate about your journey and perform an agreed booking. The legal basis is taking steps at your request before a contract or performing a contract, under Article 6(1)(b) GDPR.
For other business correspondence, coordinating travel for passengers whose booking was made by someone else, preventing abuse and protecting the website, we rely on legitimate interests under Article 6(1)(f) GDPR. These interests are responding to relevant messages, delivering the requested journey and maintaining a secure, reliable service. We limit the data to what is needed and consider the effect on your rights.
We process records required by applicable tax, accounting and other legal obligations under Article 6(1)(c) GDPR. We may retain information necessary to establish, exercise or defend legal claims under Article 6(1)(f).
Optional analytics operates on your consent under Article 6(1)(a) GDPR. We remember your choice so that we can respect it. We keep limited evidence of consent to meet our legal accountability obligations under Articles 6(1)(c) and 7(1) GDPR. Declining analytics does not affect your ability to browse, request a quote or arrange a service.
4. Optional website analytics
When available, we use Cloudflare Web Analytics only after you accept optional analytics. It helps us understand which pages are visited and how well they load. Measurements can include page addresses, referring websites, browser and device information, approximate country and page performance.
Cloudflare states that Web Analytics does not use analytics cookies, local storage identifiers or fingerprinting to measure visitors. Your browser still communicates with Cloudflare to deliver the measurements. We do not treat this as a promise that no technical or personal data is processed.
We do not send inquiry messages, booking details, payment information or contact details to Web Analytics. We do not use advertising pixels or session recordings, and we do not link analytics to individual inquiries or bookings.
Use Cookie settings to accept, reject or withdraw analytics consent. Withdrawal stops future optional analytics from this website and does not affect the lawfulness of processing before withdrawal. It does not switch off the hosting and security processing needed to deliver the website.
5. Who may receive your data?
Access is limited to people and service providers who need it for the relevant purpose. Depending on your interaction, recipients can include authorised people handling your inquiry or journey; hosting, security and technical support providers; email and communications providers; a driver or service partner needed for your requested booking; and accounting or legal advisers. We share only the details necessary for their role.
Cloudflare provides website infrastructure and security and, when you consent and it is available, Web Analytics. Service providers acting on our instructions are subject to appropriate data processing arrangements. Some recipients, such as communications platforms, regulated advisers or public authorities, may act as separate controllers for their own responsibilities.
We may disclose information when a law requires it or where necessary to deal with a valid legal claim. We do not sell your personal data.
6. WhatsApp and external websites
Our WhatsApp links open an external service. If you use it, WhatsApp processes data under its own terms and privacy policy. For users in its European Region, the provider is WhatsApp Ireland Limited. We remain responsible for how we use the messages we receive to handle your inquiry or booking.
You can contact us by email or phone instead. Choosing WhatsApp does not give permission for optional analytics on this website. Read the WhatsApp Privacy Policy for details of its service.
Links to other providers, including partner recommendations, take you to websites governed by their own privacy information. Our website settings do not control those services.
7. Processing outside the European Economic Area
Some technology and communications providers operate internationally, including in the United States. Data may therefore be processed outside the European Economic Area. A Croatian business address does not mean that every part of the processing takes place in Croatia.
For transfers we arrange, we use an applicable adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses, where required. Cloudflare describes its transfer arrangements in its Data Processing Addendum. WhatsApp describes its international processing in its own privacy policy.
If your requested journey requires us to disclose your details to a service recipient outside the European Economic Area, we will explain the relevant recipient, purpose and transfer arrangement before that disclosure. Choosing a destination does not give blanket consent to unrelated transfers.
Contact us for information about safeguards relevant to your data or to request a copy, with information relating to others or protected commercial details redacted where appropriate.
8. How long do we keep information?
Retention depends on the purpose and the type of record. We review information when an inquiry or service is completed and remove it when the relevant purpose and any required retention have ended.
- Inquiries that do not result in a booking are kept while we answer the request and resolve related follow-up. They are then deleted unless a specific legal obligation or dispute requires limited information to be retained.
- Booking and billing records are kept for the service and the applicable statutory accounting or tax retention period. Information needed for a legal claim is kept for the relevant limitation period or until the claim is resolved. These requirements do not justify keeping every unrelated message indefinitely.
- Technical and security records are retained for the period needed to detect, investigate and resolve faults or abuse, taking account of the provider's configured retention. Access to records preserved for an incident is restricted.
- The browser cookie remembering your privacy choice lasts for up to 180 days from your last saved choice. It expires sooner if you delete it. Active consent and withdrawal records are kept for up to 180 days from the recorded event and are not used as visit history.
- Cloudflare currently makes Web Analytics reports available for the previous six months. Its documentation describes seven days of unsampled beacon data followed by longer-term sampled data. The reporting window is not a guarantee that every underlying record is deleted at six months. We do not export these reports into a separate customer database. You can read Cloudflare's Web Analytics information and contact us about the retention applying to this service.
When information is deleted from active systems, any residual backup copies remain restricted and expire through the backup retention cycle. Backups are used for recovery, not for marketing or analytics. External communications platforms also apply their own retention rules to data they control.
9. Your rights and choices
Subject to the conditions in the GDPR, you can request access to your personal data, correction, deletion, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your situation. You can withdraw consent at any time.
Email info@dubrovnik-explore.com or use the contact details above. We may ask for proportionate information to confirm your identity. We respond without undue delay and within one month. If a request is complex or you have made several requests, the period may be extended by up to two further months; we will explain the extension within the first month.
You can complain to the Croatian Personal Data Protection Agency, AZOP, or another competent supervisory authority, including where you habitually live, work or believe an infringement occurred. You do not have to contact us before making a complaint.
10. Is providing information required?
You do not have to provide inquiry or booking details just to browse the public website. If you request a quote or service, we need enough information to answer you and organise it. Without essential contact or journey details, we may be unable to provide that quote or service. Some billing details may be required by law.
Optional analytics is never a condition of contacting us or making a booking. We do not use your inquiry as consent to a newsletter or advertising. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
11. Updates and further information
We may update this policy when our services or data handling change. The version date appears at the top. If an optional use requires new consent, it will stay off until you make a new choice.
For browser storage and controls, read our Cookie Policy or open Cookie settings.