Your data
Privacy Policy
This policy explains how the Villa Stefanija Brestova website handles visitors’ personal data, particularly when you contact us through the enquiry form, by email or by phone. It also describes our technical providers, retention periods, your rights and the website’s only cookie.
1. Controller and contact details
Villa Stefanija is responsible for handling personal data relating to accommodation enquiries and communications. Location: Stipani 49c, 52333 Zagorje (Brestova), Croatia. Contact us at bi.mil@netplus.ch, +385 91 891 6237 or +41 79 461 95 60.
For privacy questions or to exercise your rights, email bi.mil@netplus.ch. The address info@promovero.hr is currently the technical recipient of messages submitted through the form; it is not presented as a separate data controller.
2. Personal data we process
The enquiry form collects your full name, email address and message, together with your phone number and preferred dates if you choose to provide them. If you contact us directly, we process the information contained in your email, telephone call or other communication.
When you visit the website, hosting, network and security systems may automatically process basic technical information such as your IP address, request time, requested resource, browser type and security logs. This information is used to deliver, maintain and protect the website.
We do not request special categories of personal data. Please do not include health information, identity documents, payment details or other sensitive information that is not needed to answer your enquiry.
3. Purposes and legal bases
- Answering your enquiry and discussing a possible stay: taking steps at your request before potentially entering into a contract, Article 6(1)(b) GDPR.
- Keeping required business and legal records: compliance with applicable legal obligations, Article 6(1)(c) GDPR.
- Security, abuse prevention and technical reliability: our legitimate interest in protecting the website and communications systems, Article 6(1)(f) GDPR.
Enquiry data is not used for newsletters, profiling, targeted advertising or promotional messages without a separate and appropriate legal basis.
4. Required and optional information
Your full name, email address and message are required because we cannot reliably understand and answer an enquiry without them. Your phone number and preferred dates are optional. If you prefer not to use the form, you may contact us directly by email or phone.
5. Form delivery and data recipients
The form uses FormSubmit to deliver enquiries to the temporary recipient address info@promovero.hr. FormSubmit acts as a technical intermediary in transmitting the message. The recipient address must be confirmed through FormSubmit’s activation email when the first live enquiry is submitted.
Data may be accessed by people responsible for Villa Stefanija’s enquiries and bookings and by providers of hosting, network protection and email infrastructure, only to the extent needed to provide those services. Personal data is not sold.
FormSubmit’s published help information states that submissions sent to an email address which has not yet been activated are retained for up to 30 days to allow activation to be completed. Any later retention in the recipient’s email account is governed by the deletion rules below.
6. Transfers outside the European Economic Area
Some technical providers may process or store personal data outside the European Economic Area. Where this occurs, the controller must ensure a valid transfer mechanism and appropriate safeguards, such as an adequacy decision or Standard Contractual Clauses, and provide further information on request.
7. Retention periods
Enquiries that do not lead to further arrangements should be deleted no later than 12 months after the last relevant communication. If an enquiry develops into a booking or contractual relationship, related information is retained for the duration of that relationship and afterwards for as long as required by applicable accounting, tax, tourism or other laws, or as reasonably needed to establish, exercise or defend legal claims.
Security and technical logs are kept only for the period set by the actual hosting provider and needed to protect the system. These periods must be aligned with the final production hosting setup.
8. Cookies
The website does not use analytics, advertising or profiling cookies. It sets only one first-party, strictly necessary cookie after you close the notice:
| Name | Purpose | Duration | Type |
|---|---|---|---|
vs_cookie_notice | Remembers that the cookie notice has been closed. | 180 days | Essential first-party cookie |
Consent is not required for this essential cookie because it provides the requested function of remembering the dismissed notice. You can remove it in your browser settings, in which case the notice will appear again. Blocking cookies does not prevent you from viewing the website or sending an enquiry.
9. Data security
Reasonable technical and organisational safeguards are applied, including HTTPS in production, required fields, input-length limits and a hidden field intended to reduce automated spam. FormSubmit may display its own anti-abuse check. No method of internet transmission is entirely risk-free.
10. Your rights
Depending on the circumstances, you may request access to your personal data, correction, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing.
Send your request to bi.mil@netplus.ch. We may ask for reasonable proof of identity to protect your information. Requests are handled without undue delay and within the time limits set by the GDPR.
If you believe your data has been processed unlawfully, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia. This does not affect any other administrative or judicial remedy available to you.
11. Children, automated decisions and external links
The website is not intended to independently collect personal data from children. It does not use automated decision-making or profiling that produces legal or similarly significant effects. Links to other websites lead to services with their own privacy practices; Villa Stefanija does not determine how those external services process data.
12. Changes to this policy
We will update this policy if the form, technical providers, processing purposes or legal obligations change. The current wording and latest revision date will be published on this page.
Last updated: 1 September 2026.