Privacy Policy

1. INTRODUCTION

 

The Croatian National Tourist Board pays great attention to the protection of personal data.  We respect your privacy and in this document, we would like to provide you with information on the handling of your personal data when using the website croatia.hr and the mobile application "EXPLORE CROATIA” in a clear and transparent manner. 

 

This Privacy Policy describes what personal data we collect, how we process it and for what purposes we use it, as well as your rights related to your personal data, all in accordance with the European General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679 (hereinafter: Regulation).

 

Please read this document carefully. It contains our privacy policy and information about how we use your personal data when you visit our website, mobile application or otherwise communicate with us. 

 

For the data we collect or process, we cannot know whether it relates to children, and if we determine that we are processing such data, we will close the user account and initiate data deletion. In the event that the guardian of the person whose data we process contacts us, and the guardian can be identified, i.e., has access to personal data, we can change the data upon his written request. We advise all parents and guardians to teach their children how to handle personal information safely and responsibly on the Internet.

 

You can access the desired information through the contents of this Privacy Policy.

 

In case of any questions, feel free to contact us in the manner provided below, under point 4. 

 

2. ABOUT US

 

Croatian National Tourist Board (hereinafter: CNTB) is a national tourism organization which, based on the Act on Tourist Boards and the Promotion of Croatian Tourism, was founded with the aim of creating and promoting the identity and reputation of Croatian tourism in the country and the world. The activities of CNTB include planning and implementing a promotional strategy, proposing and implementing promotional activities that are of common interest to all entities in tourism, and raising the quality level of Croatia's entire tourist offer.

 

The “EXPLORE CROATIA” mobile application is part of the entire e-Tourism system, a tourist information system and platform that provides tourist information and various data about Croatia as a tourist destination. Through the mobile application, already existing services are improved and faster, more efficient and personalized communication between the tourist information system and end users, i.e., the target audience of domestic and foreign visitors (tourists who visit Croatia and consume the offered content), and a higher level of timeliness and relevance of information about the tourist offer and essential service information (mobility and availability of information in real time as key principles in the development of this project), are enabled.

 

3. INFORMATION ABOUT THE CONTROLLER 

 

The controller responsible for processing your personal data is:

 

Croatian National Tourist Board
Iblerov trg 10/IV, Zagreb, Croatia, 
VAT No. (OIB): 72501368180

 

The Croatian National Tourist Board can present the services of other stakeholders in tourism through websites and mobile application. This means that if they use the service of one of them, that stakeholder will be responsible for processing your personal data.

 

4. CONTACT AND DETAILS OF THE DATA PROTECTION OFFICER

 

Inquiries and remarks related to this Privacy Policy, as well as additional information about the protection and processing of your personal data, can be submitted to the personal data protection officer of the Croatian National Tourist Board: 

 

- by mail, to the address Iblerov trg 10/IV., Attn. Data Protection Officer 
- by e-mail to the address zop@htz.hr

 

5. PURPOSE AND LEGAL BASIS OF DATA COLLECTION

 

Your privacy is important to us, so we collect data necessary for:

 

•    providing service and support,
•    improving user experience,
•    improving the service and informing about new services we have developed,
•    detection of misuse and recognition of errors,
•    compliance with legal regulations,
•    analytics of mobile application usage and website traffic.

 

We process the collected data, as well as the data we learn through the provision of services, for the following purpose:

 

•    for which the same are given,
•    for which you have given your consent,
•    based on a legal basis: applicable law, legitimate interest, consent or Terms of Use (contract)

 

We only process your personal data if we have a valid legal basis for doing so. 

 

CNTB processes personal data for the purpose of entering into or executing contracts and providing services to comply with applicable laws, by-laws or other regulations, such as responding to inquiries or resolving complaints received, detecting, preventing or resolving fraud and security or technical difficulties.

 

We can process personal data with the express consent of each user and for the purpose to which such consent relates, for example, we process your data based on consent for marketing purposes.

 

We may collect and process personal data in order to comply with legal obligations or if there is a legitimate interest in such collection and processing (e.g., personalization of services, enabling a better user experience).

 

Find more details under point 8 Records of processing activities.

 

6. TYPES OF PERSONAL DATA WE COLLECT

 

Personal data includes any data relating to an identified natural person or other data by which a person can be identified. The data we collect and process about you depends on your relationship with us and the reasons for our communication.

 

The type of data we collect depends on whether you are an unregistered user, a registered user or a service provider that can be accessed through contacts and links on our website and mobile application.

 

Users are divided into two groups: 

 

Unregistered users 

 

•    It is not possible to personally identify an unregistered user through the mobile application system, given that there is no associated personal data.
•    An unregistered user is managed in the mobile application system through his unique user identifier, which is created during the first use, but based on the aforementioned identifier, it is not possible to directly identify the user through the mobile application
•    For unregistered users, data processing necessary for the basic provision of the service is carried out 

 

*  In case the user wants to use other functionalities of the application, we need your consent and registration. If you do not agree, we are unable to provide you with all functionalities.

 

Registered users: 

 

•    A registered user is a user of the application to whom, in addition to a unique user identifier, personal data is added through the following functionality:

 

• registration in the mobile application,  
• registration process via the user's existing account profiles on other applications / social network services,
• by entering personal data through interfaces for functionalities that may require it (e.g., problem reporting, certain types of content reservation).

 

Also, depending on the purpose for which we process your data from time to time and which is explained in the table below, we need to process certain data that will, depending on the individual case, generally be as follows:

 

• data related to your identity (for example, first and last name, country of origin) 
• contact information that you provide to us (for example, address, e-mail address, telephone number)
• connection, geolocation and/or browsing information (for example, information about location and IP address, time zone, browser, operating system and other information about the technology you use to access our website and/or mobile application).
• usage data (data about how and in what way you use our website and/or mobile application)
• information about your preferences

 

We emphasize that when we ask you to enter personal data in order to enable you to access any of our functionality or service, we will mark certain fields as mandatory because they include data that we need in order to provide you with the appropriate service or enable you to access a certain functionality. Please also note that if you choose not to provide us with such information, you may not be able to complete your user registration or use such services or functionality.

 

Find more details under point 8 Records of processing activities

 

7. METHOD OF COLLECTION OF PERSONAL DATA

 

We collect your personal data directly from you, indirectly or automatically.

 

We collect your personal data directly from you, for example, when you register on the application, when you communicate with us, when you leave comments. 

 

We collect them indirectly, for example, when you use already existing user accounts on other social network applications/services (Facebook account, Google account, Apple account) for registration purposes. 

 

We collect your personal data through automated systems for the purpose of improving the service, for example by using the website and/or mobile applications, we collect certain information about how you use our site, as well as device data (such as IP address, browser type, device identifier, mobile network time and duration of access, browser type). Data that we have anonymized, in such a way that we cannot identify you, is not considered personal data in accordance with the General Data Protection Regulation.

 

If we close your user account in accordance with the Terms of Use, for example due to a violation of the Terms of Use or if you have not confirmed that you want to use the mobile application after 3 years of inactivity, we will initiate the deletion of your data and we will keep the data as long as we are obliged.

8. RECORDS OF PROCESSING ACTIVITIES

• The collected data can be used to detect misuse and identify errors and to protect the security of the website and mobile application in accordance with the law and based on legitimate interest.
• The Graylog tool is used for unforeseen problems in the operation of the application on a mobile device and for crashing the application on a particular part of the mobile application. 

 

9. YOUR RIGHTS REGARDING THE PROCESSING OF PERSONAL DATA

 

We undertake to keep your personal information confidential and ensure the exercise of your rights. With that in mind, at any time, you are free to contact us with a request for access to all personal data, to request correction of data, deletion of data, restriction of processing, transfer, and raise objection.

 

You can exercise your rights simply by informing us about the reason for your request and the right you want to exercise: 

 

• via e-mail to zop@htz.hr, or
• by sending a request to the address of the Croatian National Tourist Board, Iblerov trg 10/IV, Zagreb, Croatia.

 

We may refuse a request if we cannot confirm your identity as the owner of personal data or if there are other legal restrictions. In the event that we cannot identify you through the collected data, we will request a partial copy of your personal document through which we can identify you.

 

In particular, and regardless of the purpose or legal basis we use to process your data, you have the following rights:

 

ACCESS. You have the right to access your personal data and to be informed about which data is processed and how, for what purpose and for what period. We provide you with the ability to view your personal information or to request a copy of your personal information. 

 

CORRECTION. You have the right to request the correction or addition of your personal data if the collected data that you have given us and that we have collected is not accurate, complete and up-to-date. In any case, please note that at the moment you actively make your information available to us through any process, you warrant that it is true and accurate and undertake to notify us of any changes.

 

DELETION. You have the right to request the deletion of your personal data when the data is no longer needed to achieve the purpose for which it was collected, when you submit a justified complaint or your personal data is processed illegally. Data deletion is enabled for the user of the mobile application through the "Delete" functionality in the settings.

 

RESTRICTION OF PROCESSING. You have the right to request the restriction of the processing of your personal data, which includes that in certain cases you can request from us the temporary suspension of data processing or the retention of your data for longer than necessary. You can ask us to restrict data processing, for example, when deletion, correction or objection regarding your personal data is pending and/or when we do not have a valid basis for processing your data and you want us to keep it. When processing is restricted, your data will be stored and will not be processed further. For example, if you dispute the accuracy of your data, the processing of such data will be restricted until it is ensured that the data is correct.

 

TRANSFER. You have the right to request the transfer of personal data to another service provider - in practice, this means that you have the right to request that we provide you with all personal data that we process in a machine-readable form or request that we provide it directly to another company. 

 

WITHDRAWAL OF CONSENT. If we process your data on the basis of consent, you are authorized to withdraw the given consent at any time. We will immediately stop processing personal data collected on the basis of this legal basis.
You can revoke the consent you have given at any time. You can change your consent through the mobile application "EXPLORE CROATIA" at the moment when the functionality of granting and withdrawing consent is available, and in any case you can send your request for withdrawal of consent to the CNTB contact.

 

RIGHT TO OBJECT. You have the right to object to the processing of your data by the Croatian National Tourist Board. If we process your data for the purposes of carrying out tasks of public interest or when exercising our authority, or if when processing them we refer to our legitimate interests, you can file an objection against such data processing if there is an interest in protecting your data. For example, you can request that we stop processing your personal data for purposes of direct marketing.

 

10. THE RIGHT TO SUBMIT A COMPLAINT TO THE SUPERVISORY AUTHORITY

 

If you have a complaint regarding the processing of data or your rights, or if you believe that the processing of your personal data is not legal, feel free to contact us. If we fail to resolve your complaint, you have the right to file a complaint directly with the supervisory authority, especially in the EU country where you have your usual place of residence or place of work.
The direct contacts of the Croatian national supervisory authority are:

 

PERSONAL DATA PROTECTION AGENCY (AZOP)
Ulica Metela Ožegovića 16
HR - 10 000 Zagreb
Phone: +385 1 4609 000
e-mail: azop@azop.hr
Web: www.azop.hr

 

11. SECURITY OF THE PROCESSING OF PERSONAL DATA

 

The Croatian National Tourist Board pays special attention to the protection of data and takes the necessary precautions to protect your personal data.  

 

We apply technical and organizational measures to ensure that your data is secure and to protect it from accidental or intentional unauthorized access, loss or alteration. We have ensured that your data can only be accessed by those persons who have a business need for it, exclusively for purposes that are permitted and about which you have been informed, and that these persons are under an obligation to keep your data confidential.

 

Communication between the mobile application and the central location from which the Service is provided is protected by generally accepted cryptographic algorithms. The User of the Service is obliged to pay attention to who has access to his own mobile device on which the mobile application of the Service is located, which also depends on the security of the data in the mobile application.

 

If you suspect any unauthorized use, loss or unauthorized access to your personal data, please notify us.

 

We are aware that there is no such thing as a completely secure system and that security needs to be constantly improved.

 

12. DATA STORAGE AND DATA RETENTION PERIOD

 

We store your personal data collected for the purposes stated in this Privacy Policy as long as necessary in accordance with the purpose for which they were collected, including for the purpose of acting in accordance with legal obligations and will not be stored in a form that enables your identification for longer than the Croatian National Tourist Board reasonably considers necessary to fulfill the purpose for which the data was collected and processed.

 

• The data we collect as part of the mobile application is deleted 3 years after the date of inactivity in terms of activation and any interaction with the Service system through the mobile application. 
• Certain personal data will be stored for the time specified by the law or regulation that obliges the Croatian National Tourist Board to store data (for example, data from your request to exercise the right to deletion will be kept for 5 years from the resolution of the request).
• We do not delete data about the use of the Service if an objection to the Service is made within the deadline, until the final completion of the objection procedures in accordance with the applicable regulations (e.g., Consumer Protection Act, etc.), as well as in the case when we store personal data based on applicable regulations.
• Data on the User's habits of using the Service are generally kept for the duration of the use of the service, i.e., until the moment of your withdrawal of consent for their processing if the processing is based on consent.
• We store data based on our legitimate interest in accordance with justified and reasonable business needs.  

 

After the storage period has expired, we will delete the data, and in cases where this is not technically possible, we will make the data unreadable. In the event that we still need some data for legitimate business purposes after the data retention period has expired, we will take appropriate steps to anonymize that data, which means that we can no longer identify you and such data is no longer considered personal data in accordance with applicable regulations.

 

Certainly, at any time you have the right to request the stopping of further processing of your personal data and their deletion.

 

13. RECIPIENT OF PERSONAL DATA

 

The Croatian National Tourist Board expressly declares that it will not sell, share or in any other way transfer your personal data to third parties, except under the conditions and in the manner determined by this Privacy Policy. Third parties are obliged to use entrusted data only in accordance with our rules and exclusively for strictly declared purposes. They are also obliged to adequately protect your personal data and their privacy.

 

CNTB reserves the right to share your data with other recipients (third parties) in certain cases, namely:

 

• to providers of information and communication services in the capacity of processors, who provide support services of IT solutions for CNTB (hosting, IT services, customer support);
• in certain circumstances, we are obliged to submit your data to competent authorities (police, court, audit or other competent authority) based on a request established by law, if this is necessary for the purpose of carrying out a procedure prescribed by law and for the purpose of detecting, preventing or resolving fraud and security or technical difficulties related to the Croatian National Tourist Board or personal data of users for purposes prescribed by law),
• to service providers in the tourist board system,
• with partners in the provision of the service, 
• with third parties in cases where you have agreed to share your personal data with a third party (e.g., in the case of using cookies)

 

External services that are used for the purpose of providing the mobile application service are:  

 

• Subsystem for automatic reporting of technical problems: https://www.graylog.org/privacy-policy/
• Mobile application usage analytics subsystem: https://firebase.google.com/docs/analytics/

 

On our website and mobile application, you may find links that will take you directly to the site of another service provider that is not covered by this Privacy Policy. You will recognize this by the change in the URL. We cannot accept any responsibility for the confidential handling of your data on these third-party websites, as we have no influence on the compliance of these service providers with data protection provisions. Please familiarize yourself with their privacy policy and how they protect your personal data.

 

We recommend that you seek information about how these service providers handle your personal data.

 

If you use social networks to interact with our pages and mobile application, we point out that the data collected by Google, Apple and/or the Meta platform is transferred to the USA and they, as the controller, define what data, for what purpose and on what legal basis is it used, as well as about cookies that the platforms set and for what purpose they are used as well. You can find information about this in their privacy policies.
In order to make it easier for you to exercise your rights from third parties, below are the most important links with their Privacy Policies:

 

• https://policies.google.com/privacy,
• https://www.apple.com/legal/privacy/en-ww/,
• https://hr-hr.facebook.com/privacy/explanation/
• https://www.graylog.org/privacy-policy/

 

The Croatian National Tourist Board is not responsible for the methods and conditions of work of third parties that the user accesses, nor for the correct application of legal regulations by external services that you use independently in relation to these services.

 

14. CROSS-BORDER DATA FLOWS

 

When processing your personal data, we may use service providers outside the European Economic Area. For the purposes of service efficiency, some of the previously mentioned authorities may be located in areas outside the European Economic Area, where a level of protection comparable to that in the European Union is not provided. In such cases, we inform you that we transfer your data with appropriate safeguards and always keeping your data, using the most appropriate international data transfer tools, for example Standard Contractual Clauses and all relevant supplementary measures. You can view the content of such Standard Contractual Clauses via the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en.

 

15. INFORMATION ABOUT COOKIES

 

CNTB can collect and process anonymous data about access to websites. Such anonymous data is used for internal purposes to improve products and services, as well as to create internal statistics.

 

For this purpose, the so-called cookies, i.e., text files placed on the user's computer by the Internet server, through which the Internet access service provider (ISP) displays the website, and which collect data about your e-mail address, domain name and the date and time of accessing the pages, are used. Cookies cannot be used to reveal your identity.

 

Cookies are created when the browser on the user's device loads the visited web destination, which then sends data to the browser and creates a text file (cookie). The browser retrieves and sends a cookie to the server of the website when the user returns to it.

 

Our pages use technical cookies (mandatory cookies that cannot be turned off) that are necessary for the website to function.

 

Please read our Cookie Policy to better understand the cookies and similar tools we use, their purpose, how to manage your preferences and other information of interest.

 

It is important for us that you know that you can always change your mind about the selected categories of cookies via a pop-up window. 

 

Strictly Necessary Cookies

 

Basic cookies provide basic functionality such as setting user preferences. Our website and mobile applications cannot function properly without these cookies. Therefore, we do not ask your permission to use the strictly necessary cookies.

 

We also use essential cookies for security, network management, accessibility, and fast loading of the website. They help us monitor the interactions that give results at the end of the process.

 

The following strictly necessary cookies are downloaded to your device.

Analytical cookies are used for anonymous monitoring of statistics regarding site traffic and individual interactions on the website, enabling further improvements for end users and an understanding of the purpose of the visit. 

Personalisation cookies to improve the way our website and mobile app work and to provide enhanced, more personalised features.

 

These cookies improve the way our website and mobile applications work and provide you with enhanced, personalised features. For example, they collect information about how you use our website and help us evaluate and improve the way it works. They also help us remember your preferences, recent searches, and shortlisted holidays to make it easier for you to return to your previous search.

 

The following personalisation cookies are placed on your device:

Targeting and marketing cookies are used to provide relevant online advertising and measure the effectiveness of our marketing communications, including online advertising.

 

These cookies help us provide relevant online advertising and measure the effectiveness of our marketing communications. They collect information about your online behaviour, IP address, the website you came from, and information about your search history so we can predict which other products, services, and information might be of most interest to you. For example, to suggest flights from the nearest airport, holidays in destinations in which you have shown interest, or destinations you might like. They also tell us if you've seen a particular ad, how much time has passed since you saw it, and control how many times the ad is shown to you. They also tell us if you have opened the marketing e-mail we sent you.

 

If you choose not to accept these cookies, you may continue to see ads on our website, mobile applications, and websites of other organisations. The ads you see will not be personalised or based on information from your previous online behaviour, purchase history, or the contents of your shopping cart.

 

The following targeting and advertising cookies are placed on your device by us or a third party:

Other non-essential cookies

 

Other non-essential or optional cookies enable us to improve your experience, enhance the performance of our website and mobile apps, as well as to provide a user-driven relevant experience. 

Personalization cookies, advertising cookies, analytical cookies and other non-essential cookies will not be installed in your device and they will not collect any of your data, unless you provide specific consent for such purpose. Some cookies are installed by us, and some by third parties.

 

16. VERSIONS AND UPDATES

 

We regularly update the Privacy Policy so that it contains accurate and reliable information at all times about how we collect and use your personal data, and we reserve the right to change its content if we deem it necessary, primarily for the purpose of complying with legal changes, i.e., changes in purposes and methods of processing. You will be informed about all changes and additions in a timely manner through our website and mobile application in accordance with the principle of transparency, and in case of significant changes, we will inform you in some other appropriate way.

 

By continuing to use the website after the Privacy Policy has been changed, you confirm that you are familiar with the applicable rules and that you agree to the processing of data for the stated purposes.

 

In the case of using the "EXPLORE CROATIA" mobile application, it is necessary to accept such updated Privacy Policy before continuing to use it.

 

This Privacy Policy shall apply from June 15, 2023.