Rooftops of Zadar's old town and the sea

Privacy policy

Last amended: 12 November 2026

The protection of your personal data is important to us. This policy explains which data we collect when you use our website or contact us, why we use it, how long we retain it and what rights you have. We process data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Act on the Implementation of the General Data Protection Regulation (Official Gazette NN 42/18) and the Electronic Communications Act (Official Gazette NN 76/22).

1. Controller

Life Tours Zadar, online travel agency
Ulica bana Josipa Jelačića 1 B, 23000 Zadar, Croatia
OIB: 24682232876 · MB: 97828343
E-mail: info@lifetourszadar.hr · Tel.: +385 91 508 9001, +385 95 838 4027

For any questions concerning the protection of personal data and the exercise of your rights, please write to us at info@lifetourszadar.hr with the subject "Data protection".

2. What data we collect and why

a) Inquiries and bookings (inquiry form, contact form, e-mail, telephone)
We collect: first name and surname, e-mail address, telephone number (optional), requested dates, number of adults and children, menu choice for excursions, the content of your message, the language of the website and the name of the accommodation, excursion or service you are enquiring about.
Purpose: responding to your inquiry, preparing an offer and carrying out the booking.
Legal basis: taking steps at your request prior to entering into a contract and performance of a contract (Art. 6(1)(b) GDPR).

b) Confirmed bookings and payments
We collect the data required for issuing vouchers and invoices and for guest registration (e.g. first name and surname, contact details, dates, payment details).
Purpose: performance of the contract and compliance with legal obligations (accounting, taxes, registration of stay and tourist tax).
Legal basis: performance of a contract and legal obligation (Art. 6(1)(b) and (c) GDPR).

c) Technical data when visiting the website
When the website is opened, the server automatically records technical data (IP address, browser type, time of access, page opened) for the secure and proper operation of the website and protection against misuse.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Our hosting provider (Lovable) also keeps simple, anonymous visitor statistics for us (number of visits and pages viewed). These statistics do not use cookies, do not identify individual visitors and are not used for tracking or advertising. The legal basis is our legitimate interest in monitoring server load and improving the website (Art. 6(1)(f) GDPR).

d) Cookies and external content
We use necessary cookies without consent, while maps (Google Maps, OpenStreetMap) are loaded only after your consent (Art. 6(1)(a) GDPR). Details are set out in our Cookie policy.

We do not use your data for automated decision-making or profiling, and we do not send you promotional messages without your explicit consent.

3. How long we retain data

Inquiries that did not result in a booking: up to 24 months from receipt of the inquiry, after which they are deleted.
Booking and invoice data: for as long as required by tax and accounting regulations (as a rule 11 years for accounting documents).
Technical server logs: for a short period, as a rule up to 30 days, unless required for the investigation of a security incident.
Cookie consent: we remember your choice for 12 months, after which we ask you again.

4. To whom we disclose data

We do not sell your data. We disclose it only where necessary for the purposes stated above:

Service providers within our offer (accommodation providers, excursion organisers, carriers, rent-a-car and rent-a-boat partners) – only the data required to carry out your booking;
Processors providing technical services on our behalf: website and database hosting (Lovable / Supabase), e-mail service, accounting service – on the basis of a data processing agreement and with appropriate safeguards;
Competent authorities where required by law (e.g. tax administration, tourist board, police).

Some of our technical service providers may process data outside the European Economic Area. In that case, the transfer is based on an adequacy decision of the European Commission or on the standard contractual clauses of the European Commission (Arts. 45 and 46 GDPR).

5. Your rights

You have the right at any time:

of access to your data and to obtain a copy of the data;
to rectification of inaccurate or incomplete data;
to erasure of data ("right to be forgotten"), except where we are required by law to retain it;
to restriction of processing;
to data portability;
to object to processing based on legitimate interest;
to withdraw consent at any time (e.g. for cookies via the "Cookie settings" link in the footer of the website), without affecting the lawfulness of processing prior to withdrawal.

Please send your request to info@lifetourszadar.hr. We will respond no later than within one month. To protect your data, we may request confirmation of your identity.

If you consider that our processing infringes the regulations, you have the right to lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP) (Croatian Personal Data Protection Agency), Selska cesta 136, 10000 Zagreb, www.azop.hr.

6. Data security

We apply appropriate technical and organisational measures: an encrypted connection (HTTPS), access to data restricted to authorised persons only, password protection of the administration area and regular backups.

7. Minors

Our services are not intended for persons under the age of 16. Inquiries and bookings for children are submitted by a parent or guardian.

8. Amendments to this policy

We may update this policy from time to time. The current version is always published on this page, together with the date of the last amendment.