Privacy Policy

The controller of personal data is MCODE, obrt za računalno programiranje, VAT/OIB 58358056658, D. Cesarića 67, 31550 Valpovo. For any question about processing and to exercise your rights, write to hello@mcode.hr.

Guest data. When a guest sends a booking enquiry, we process their name, email address, telephone number, requested dates and the text of the message. We forward that data to the owner of the property the enquiry concerns, because the enquiry is addressed to them.

Owner data. To operate an account we process email address, name and telephone number, and optionally a Facebook profile name, which administrators use to approve access to the Vile za odmor group. When membership charging is switched on, we additionally process the data required to issue an invoice: tax number, legal name and address. While membership is free we do not ask for them.

Technical data. To prevent abuse we record a shortened, cryptographically hashed form of the IP address at registration, along with ordinary server logs. We also record the time and version of the accepted terms of use.

Purposes and legal bases. Enquiries are processed in order to pass them to the owner, on the basis of steps taken at the request of the data subject prior to entering into a contract and our legitimate interest in the service working. Owner accounts are maintained to perform the contract for use of the platform. Abuse prevention rests on legitimate interest. Invoices are issued and fiscalised on the basis of a legal obligation.

Recipients. Enquiry data is received by the property owner, who from that moment processes it as a separate controller. As processors we use Google (Firebase — servers, database, authentication, abuse protection), an email delivery provider, and, when charging is switched on, Stripe for payment and MCODE for fiscalisation, which forwards invoice data to the Croatian Tax Administration. We do not sell data and do not use it for advertising.

Transfers outside the EU. Google and Stripe may process data outside the European Economic Area, on the basis of the European Commission’s standard contractual clauses and the additional safeguards set out in their processing terms.

Retention. Guest enquiry data is anonymised 18 months after the last date of stay. Issued invoices and the associated accounting records are kept for the periods prescribed by tax and accounting law. Owner account data is kept while the account exists, and after deletion only what we are required by law to retain.

Your rights. You have the right of access, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, and data portability. Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Send your request to hello@mcode.hr; we respond within one month.

Complaints. If you believe we process data unlawfully, you may contact the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, Zagreb, azop.hr.

Security. Access to data is limited to those who need it, traffic is encrypted, and access to the administrative interface requires authentication and an assigned role.

We do not take decisions by automated processing, nor do we carry out profiling that would produce legal effects for you.

Changes. We may amend this policy. The date of the last change is shown at the top of the page, and owners are notified of material changes by email.