Legal

Privacy policy

Last updated: 17.10.2026

This policy explains what personal data we process when you visit villa-noor.com and when you send us an inquiry, why we do so, and what rights you have. It covers the website only. If your inquiry leads to a stay, we will tell you separately about any further data the stay requires, such as the guest registration required by Croatian law.

1. Who is responsible for your data

The controller of your personal data is:
[full name or business name], [legal form, e.g. private accommodation provider]
Labinci 135a, 52464 Labinci, Croatia
OIB: [personal identification number]
Email: info@villa-noor.com

Write to this address with any question about your data or to exercise your rights.

2. Inquiries

When you send an inquiry, we process:

  • your full name and email address;
  • your phone number, if you give it;
  • your preferred arrival and departure dates and the number of guests, if you give them;
  • your message, if you write one;
  • the language of the form and the indicative price the website showed you for your dates.

We also keep our replies to you and a record of whether our emails were handed over for delivery.

We use this data to answer your inquiry, check availability and prepare an offer. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). For questions without dates, the legal basis is our legitimate interest in answering messages sent to us (Article 6(1)(f) GDPR).

You are not obliged to provide this data, but without your name and email address we cannot reply.

After you send an inquiry, you receive an automatic confirmation by email, and we are notified by email. We send emails from info@villa-noor.com through Cloudflare's email service.

3. Protection against spam and abuse

  • Before an inquiry is sent, Cloudflare Turnstile checks that it comes from a person and not an automated program. The check runs only on the inquiry form. For this check, Cloudflare processes technical data such as your IP address and information about your browser and device.
  • To limit repeated submissions, we store values derived from your IP address and email address using a secret key. Without that key, your address cannot be read from them. They expire after one hour and are then deleted.
  • To recognise an inquiry submitted twice, we store a value derived the same way from its content with the inquiry.

The legal basis is our legitimate interest in protecting the website and the inquiry form (Article 6(1)(f) GDPR).

4. Visiting the website

The website runs on Cloudflare's network. To deliver pages and protect the site, Cloudflare processes technical connection data such as your IP address, the time of the request, the page requested and your browser type. Our technical logs are kept for up to 7 days. The legal basis is our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).

We do not use analytics, advertising or tracking tools, and we do not create user profiles.

5. Cookies and storage on your device

The website itself sets no cookies. Cloudflare's security services may set strictly necessary cookies to protect the site from automated attacks.

The website keeps one entry in your browser's session storage so that the opening animation is not repeated during your visit. It contains no personal data and is deleted when you close the tab.

The map on the contact page and the fonts are served from our own website and do not contact other services.

Links to Instagram, Facebook and Google Maps are plain links. Nothing is sent to these services until you open them, and then their own privacy policies apply.

6. Who receives your data

  • Cloudflare, Inc., as our processor: hosting, database, photo storage, email sending and the Turnstile check;
  • [Apple Distribution International Ltd.: the mailbox for info@villa-noor.com (iCloud+)];
  • [the person who maintains the website on our behalf, bound by a data processing agreement];
  • public authorities, where the law requires it.

We do not sell your data or use it for marketing. The website does not pass your inquiry to booking platforms or agencies.

7. Transfers outside the EU

Cloudflare [and Apple] may process data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on the Commission's standard contractual clauses.

8. How long we keep data

  • Inquiries that do not lead to a booking: up to [12] months after our last correspondence, then deleted.
  • Inquiries that lead to a booking: as long as needed for the stay and any claims arising from it. We keep them longer only where the law requires us to keep records.
  • Values that limit repeated submissions: one hour.
  • Technical logs: up to 7 days.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing and to receive it in a portable format. You also have the right to object to processing based on our legitimate interest. Write to info@villa-noor.com; we will reply within one month.

You may also lodge a complaint with the Croatian Personal Data Protection Agency, Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, www.azop.hr. You may also complain to the supervisory authority in your country of residence.

10. Security

The website uses an encrypted connection (HTTPS). Inquiries can be seen only in the website's administration, which is protected by two separate sign-ins. Only we [and the person maintaining the website on our behalf] have access.

11. Automated decisions

The website calculates the indicative price automatically from our published rates. This makes no decision about you: we answer every inquiry ourselves.

12. Changes

We will publish any change to this policy on this page and update the date at the top.