Privacy policy

The controller of your personal data is BULAT TRANSFER d.o.o., trading as Private Experience Croatia, Omiška 14/a, 21000 Split, Croatia, OIB 87984430594.

For any question about your data, or to use one of the rights below, write to info@private-experience-croatia.com.

• Bookings. Your name, email, phone number, pickup and drop-off points, date and time, the tour or transfer, vehicle, number of passengers, luggage, extras, notes and the language you booked in. We use them to run the trip, send your confirmation and voucher, and contact you about the booking. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
• Payments. Card payments are processed by Stripe. We receive the payment status and amount, never your full card number. Legal basis: our contract with you.
• Enquiries. When you ask for a quote or write to us through a form, by email or on WhatsApp, we use what you send to answer and prepare an offer. Legal basis: steps you ask us to take before a contract (Art. 6(1)(b) GDPR).
• Emails about your booking. Besides the confirmation, we may write if your booking changes, send one reminder if you started a booking and did not finish the payment, and send a thank-you note after the trip with a link to leave a review. Legal basis: our contract with you and our legitimate interest in looking after our guests (Art. 6(1)(f) GDPR).
• Reviews. If you leave a review through the link we send, we store your name, country, rating and text and publish them on the trip page after a check. Your email address is never shown. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Accounting. Invoices and payment records are kept as Croatian accounting and tax law requires. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Website visits. Our hosting provider processes technical data such as your IP address and browser to deliver the pages and protect the site from abuse. Legal basis: our legitimate interest in a secure website (Art. 6(1)(f) GDPR).
• Analytics and advertising. Only with your consent, as described in section 6.

We share personal data only with the companies that help us provide the service, and only as far as each one needs it:

• Stripe: card payments.
• Supabase: the database where bookings are stored.
• Vercel: website hosting.
• Resend: sending our emails.
• Google: Maps suggests addresses while you type your pickup point, Calendar holds our driving schedule, and Analytics and Ads measure the website when you allow it.
• Microsoft Clarity: shows how the pages are used, when you allow it.
• WhatsApp: if you choose to message us there, its own privacy terms apply.
• Your driver: receives the details needed to pick you up.

We also disclose data to public authorities when the law requires it. We never sell personal data.

Some of these providers are based in the United States or use servers there. Such transfers rely on the safeguards the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We keep booking and payment records for as long as Croatian accounting and tax law requires, and other personal data only as long as we need it for the purposes above. Reviews stay published until you ask us to remove them. Your cookie choice stays in your browser until you clear it or change it.

• Strictly necessary. Your cookie choice is stored in your browser, and our staff sign in to the admin with a session cookie. If you arrive from a Google ad, the click identifier in the link is kept for your visit and saved with your booking, so we can see which ads bring bookings.
• Analytics, only with your consent. Google Analytics sets cookies that count visits and show which pages help travellers. Microsoft Clarity records clicks, scrolling and page views on the public pages so we can fix what does not work; it never runs on our admin pages.
• Advertising, only with your consent. Google Ads cookies show which of our ads lead to bookings.

Until you choose, Google's tags run in a restricted mode that sets no analytics or advertising cookies. When a payment succeeds, our server reports the booking reference, amount and trip name to Google Analytics; if you allowed analytics cookies, the report is linked to your visit.

You can change your choice at any time with the Cookie settings link at the bottom of every page.

You can ask us for access to your data, to correct or delete it, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. Write to info@private-experience-croatia.com and we will reply within one month.

If you believe we handle your data unlawfully, you can complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or to the data protection authority in your own country.

When the way we process personal data changes, we update this page and the date at the top.