Your data
Privacy Policy
This policy explains how the Villa Stefanija Brestova website handles visitors’ personal data, particularly when you contact us through the enquiry form, by email or by phone. It also describes our technical providers, retention periods, your rights and the website’s only cookie.
1. Controller and contact details
Villa Stefanija is responsible for handling personal data relating to accommodation enquiries and communications. Location: Stipani 49c, 52333 Zagorje (Brestova), Croatia. Contact us at bi.mil@netplus.ch or bi.mil@hispeed.ch, and by phone at +385 91 891 6237 or +41 79 461 95 60.
For privacy questions or to exercise your rights, email bi.mil@netplus.ch. The address info@promovero.hr is currently the technical recipient of messages submitted through the form; it is not presented as a separate data controller.
2. Personal data we process
The enquiry form collects your full name, email address and message, together with your phone number and preferred dates if you choose to provide them. If you contact us directly, we process the information contained in your email, telephone call or other communication.
When you visit the website, hosting, network and security systems may automatically process basic technical information such as your IP address, request time, requested resource, browser type and security logs. This information is used to deliver, maintain and protect the website.
We do not request special categories of personal data. Please do not include health information, identity documents, payment details or other sensitive information that is not needed to answer your enquiry.
3. Purposes and legal bases
- Answering your enquiry and discussing a possible stay: taking steps at your request before potentially entering into a contract, Article 6(1)(b) GDPR.
- Keeping required business and legal records: compliance with applicable legal obligations, Article 6(1)(c) GDPR.
- Security, abuse prevention and technical reliability: our legitimate interest in protecting the website and communications systems, Article 6(1)(f) GDPR.
- Audience measurement through Google Analytics 4: your consent, Article 6(1)(a) GDPR. You may refuse or withdraw consent at any time.
Enquiry data is not used for newsletters, profiling, targeted advertising or promotional messages without a separate and appropriate legal basis.
4. Required and optional information
Your full name, email address and message are required because we cannot reliably understand and answer an enquiry without them. Your phone number and preferred dates are optional. If you prefer not to use the form, you may contact us directly by email or phone.
5. Form delivery and data recipients
The form uses FormSubmit to deliver enquiries to the temporary recipient address info@promovero.hr. FormSubmit acts as a technical intermediary in transmitting the message. The recipient address must be confirmed through FormSubmit’s activation email when the first live enquiry is submitted.
Data may be accessed by people responsible for Villa Stefanija’s enquiries and bookings and by providers of hosting, network protection and email infrastructure, only to the extent needed to provide those services. If you accept analytics cookies, Google may also receive analytics data as the provider of Google Analytics 4 and Search Console. Personal data is not sold.
FormSubmit’s published help information states that submissions sent to an email address which has not yet been activated are retained for up to 30 days to allow activation to be completed. Any later retention in the recipient’s email account is governed by the deletion rules below.
6. Transfers outside the European Economic Area
Some technical providers may process or store personal data outside the European Economic Area. Where this occurs, the controller must ensure a valid transfer mechanism and appropriate safeguards, such as an adequacy decision or Standard Contractual Clauses, and provide further information on request.
7. Retention periods
Enquiries that do not lead to further arrangements should be deleted no later than 12 months after the last relevant communication. If an enquiry develops into a booking or contractual relationship, related information is retained for the duration of that relationship and afterwards for as long as required by applicable accounting, tax, tourism or other laws, or as reasonably needed to establish, exercise or defend legal claims.
Security and technical logs are kept only for the period set by the actual hosting provider and needed to protect the system. These periods must be aligned with the final production hosting setup.
8. Google Analytics 4, Search Console and cookies
The website uses Google Analytics 4 (GA4) only after you give explicit consent. GA4 helps us understand, in aggregate, which pages are visited, how visitors reach the website, approximate visit duration, device type and basic technical information. We do not use GA4 for personalised advertising, remarketing or linking data to Google Ads.
Basic consent mode is applied: Google’s analytics script is not loaded and no data is sent to Google Analytics before you select “Accept cookies”. If you select “Essential only”, GA4 remains blocked.
Google Search Console is used to review aggregate information about the website’s visibility in Google Search, such as queries, impressions, clicks, indexing and technical issues. Search Console is not loaded as a script on this website and does not itself set cookies in a visitor’s browser. Domain ownership may be confirmed through DNS or a verification meta tag.
| Name | Purpose | Duration | Type |
|---|---|---|---|
vs_cookie_consent | Remembers whether analytics cookies were accepted or refused. | 180 days | Essential first-party cookie |
_ga | Distinguishes visitors for Google Analytics 4 statistics. | Up to 2 years | Analytics, consent required |
_ga_<ID> | Persists session state for a specific GA4 measurement tag. | Up to 2 years | Analytics, consent required |
Consent is not required for the essential cookie because it remembers your choice. Analytics cookies are set only after acceptance. You can change your choice using “Cookie settings” in the footer. Refusing analytics does not prevent you from viewing the website or sending an enquiry.
9. Data security
Reasonable technical and organisational safeguards are applied, including HTTPS in production, required fields, input-length limits and a hidden field intended to reduce automated spam. FormSubmit may display its own anti-abuse check. No method of internet transmission is entirely risk-free.
10. Your rights
Depending on the circumstances, you may request access to your personal data, correction, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing.
Send your request to bi.mil@netplus.ch. We may ask for reasonable proof of identity to protect your information. Requests are handled without undue delay and within the time limits set by the GDPR.
If you believe your data has been processed unlawfully, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia. This does not affect any other administrative or judicial remedy available to you.
11. Children, automated decisions and external links
The website is not intended to independently collect personal data from children. It does not use automated decision-making or profiling that produces legal or similarly significant effects. Links to other websites lead to services with their own privacy practices; Villa Stefanija does not determine how those external services process data.
12. Changes to this policy
We will update this policy if the form, technical providers, processing purposes or legal obligations change. The current wording and latest revision date will be published on this page.
Last updated: 2 September 2026.