Privacy Policy

1. What data we collect

We collect the data you provide to us when you register: first name, last name, email address, and phone number. Hosts also provide information about accommodations (name, address, photos, prices). We automatically collect technical data such as IP address and session cookies. Hosts who pay for a plan also provide invoice details (name or company name, address, tax or VAT number, if they enter one). For payments we record the plan, amount, date and payment method, and for cards only the card type, the last 4 digits and the expiry date, as shown to us by Stripe; we never see or store card numbers.

2. How we use your data

We use your data solely for the platform's operation — enabling communication between guests and hosts, sending confirmations and notifications by email, managing your account, and improving our service. We use payment data to charge for plans and issue invoices, and we also e-mail you notices about your account, plan and payments (e.g. the welcome e-mail, plan activation, bank transfer details), as they are part of the service. We do not sell your data to third parties or use it for advertising purposes.

3. Data storage

Your data is stored on secure servers within the European Union (Supabase, Frankfurt, Germany). All data is protected in accordance with Regulation (EU) 2016/679 (GDPR). We use the following processors: Supabase (database), Vercel (hosting), Cloudflare (photo storage), Resend (email sending), Stripe (subscription payment processing), and Google Ireland Limited (site analytics, subject to user consent only). All are bound by data processing agreements in accordance with Article 28 of the GDPR. Individual processors may process data outside the European Economic Area, with safeguards such as Standard Contractual Clauses (SCC).

4. Cookies

We use two categories of cookies. Essential cookies enable login, security and basic site functionality; they are set without consent because they are technically necessary. Analytics cookies (Google Analytics 4, provided by Google Ireland Limited) are set only after your explicit consent — they provide anonymous statistics on visits and site usage, with IP anonymisation enabled. Analytics is not loaded until you give consent. You can withdraw consent at any time via the "Cookie settings" link in the site footer. We do not use advertising cookies or cookies for marketing profiling. Details of individual cookies are listed in our Cookie Policy.

5. Data Sharing

The guest's contact information (name, email, phone number) is shared with the host only after the guest independently sends an inquiry through the platform. The host thereby agrees to use the information solely to respond to the inquiry and arrange the accommodation.

6. Your rights (GDPR)

In accordance with the GDPR, you have the right to: access your personal data, rectification of inaccurate data, erasure of data ("right to be forgotten"), data portability, and objection to processing. To exercise your rights, contact us at info@croaholiday.com. We will respond within 30 days. You also have the right to file a complaint with a supervisory authority. The lead supervisory authority for the data controller is the Hungarian NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, naih.hu), and users from Croatia can also file a complaint directly with the Personal Data Protection Agency (AZOP, azop.hr).

7. Safety

We implement technical and organizational data protection measures. Passwords are never stored in their original form but as a cryptographic hash. All communication between the browser and the server is protected by SSL/TLS encryption.

8. Data Retention

We retain your data as long as your account is active. After your account is deleted, personal data is erased within 30 days, except for data we are required to keep by law (e.g., payment and invoice records, which accounting and tax regulations generally require us to keep for 8 years). Data collected through analytics is retained for a maximum of 14 months.

9. Contact

For any questions regarding data privacy or the exercise of your rights, please contact us at: info@croaholiday.com. Data Controller: TAKAC FILIP, sole proprietor (self-employed entrepreneur registered in Hungary), Visnya Ernő u. 2, 7636 Pécs, Hungary. Tax number (adószám): 92166882-1-22. VAT identification number: HU92166882. Registration number: 62491167.

CroaHoliday · Direct accommodation rental in Croatia