This policy describes personal data processing on wellspring.hr under the General Data Protection Regulation (GDPR).
1. Data controller
The controller is Knjigovodstveni ured Leko d.o.o., Zagrebačka cesta 185A, 10000 Zagreb, Croatia, OIB: 36262470547. Contact info@wellspring.hr with privacy questions or requests to exercise your rights.
2. Data and purposes
The contact form collects your name, email address, preferred arrival date, number of nights and message. If you contact us by phone or provide additional information, we process it only as needed to respond and arrange accommodation. Please do not send sensitive data. Required fields are needed to process your enquiry; other fields are optional.
3. Legal bases
Booking enquiries are processed to take steps at your request before entering into a contract and to perform a contract (Article 6(1)(b) GDPR). Other enquiries are processed based on our legitimate interest in responding to messages (f). Records required by law are processed to comply with legal obligations (c). The external virtual tour loads only with your consent (a), which you may withdraw in privacy settings.
4. Recipients and external services
The website and contact form use Netlify. Authorised staff and hosting, form processing and email providers may process data needed to deliver their services. The virtual tour is provided by Tourmkr (tourmkr.com). Once enabled, it receives your IP address and browser information and may use its own cookies and similar technologies. External providers may process data outside the EEA; applicable GDPR safeguards must be in place for such transfers. You may request details of providers and safeguards at our contact address.
5. Retention
Enquiry data is kept as needed to respond and continue communication, for no longer than two years from receipt. If an enquiry leads to a booking, records needed to perform the contract, comply with legal obligations or establish legal claims are kept for the applicable periods. You may request deletion at info@wellspring.hr; deletion is not unconditional where a legal obligation or another valid retention basis applies.
6. Security
We apply appropriate technical and organisational safeguards, including encrypted HTTPS transmission and restricted access to data. No transmission or storage system can guarantee absolute security.
7. Cookies and similar technologies
Our own website code does not use analytics or marketing scripts. The sessionStorage entry language-detected prevents repeated language redirects and lasts until the browser session ends. The localStorage entry wellspring-privacy-choice remembers whether you allowed the external virtual tour until you change settings or clear browser storage. These functional entries are not used for tracking. The tour is blocked until you allow it. Declining does not prevent access to other content or sending enquiries. You can reopen privacy settings in the footer and withdraw consent; if necessary, remove data already stored by the external service through your browser settings.
8. Your rights
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. You may withdraw consent without affecting the lawfulness of previous processing. Send requests to info@wellspring.hr. We normally respond within one month and may request information to verify your identity. You may complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, https://azop.hr.
9. External links and changes
External websites have their own privacy policies. This policy may be updated to reflect changes to services or legislation; the current version is published on this page.