Privacy Policy

The data controller for personal data collected through this website is:

The protection of your personal data is of paramount importance to us. This Privacy Policy describes what data we collect, how we use, store and protect it, in compliance with the Law on Personal Data Protection of the Republic of Serbia (Official Gazette RS, No. 87/2018, hereinafter: LPDP) and the EU General Data Protection Regulation (GDPR, Regulation 2016/679/EU).

2.1 Data you provide directly

• Contact and reservation forms: first name, last name, email address, phone number, preferred date and time, number of guests, text message.
• Newsletter subscription: email address.

2.2 Automatically collected data

• Analytics data via Google Analytics 4: pseudonymized visit data (pages visited, session duration, country, device and browser type). IP addresses are anonymized before processing and are not stored in full form. This data is collected only with your explicit consent.
• Server logs: IP address, browser type, access time - solely for security and error diagnostics purposes.

2.3 Data collected by our processors

We process data on the following legal bases (Art. 12 LPDP; Art. 6 GDPR):

• Consent (Art. 12(1)(1) LPDP; Art. 6(1)(a) GDPR): newsletter subscription, analytics cookies. You may withdraw consent at any time without consequence.
• Performance of a contract or pre-contractual steps (Art. 12(1)(2) LPDP; Art. 6(1)(b) GDPR): processing reservations and inquiries.
• Legitimate interest (Art. 12(1)(6) LPDP; Art. 6(1)(f) GDPR): server logs for information system security.

• Responding to your inquiries and processing reservation requests.
• Sending informational and promotional newsletters to users who have given consent.
• Analyzing anonymized visit statistics to improve site content and functionality (only with consent).
• Protecting system security against malicious and automated attacks.

We do not sell, rent or exchange your personal data with third parties for commercial purposes. Data is transferred exclusively to:

• Google LLC - as a data processor, for visit analytics via Google Analytics 4 (only with your consent). Google is a signatory of EU Standard Contractual Clauses and certified under the EU–US Data Privacy Framework.
• Cloudflare Inc. - as a data processor, for bot protection on forms via the Turnstile widget (necessary service).
• Competent public authorities - solely on the basis of a legal obligation or court order.

All data processors are contractually bound to process your data solely according to our instructions and in compliance with applicable law.

Upon expiry of the retention period, data is permanently deleted or anonymized.

Under the LPDP and GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 26 LPDP): you may request confirmation of whether we process your data and a copy of that data.
• Right to rectification (Art. 29 LPDP): you may request correction of inaccurate or completion of incomplete data.
• Right to erasure - "right to be forgotten" (Art. 30 LPDP): you may request deletion of your data when there is no longer a legal basis for processing.
• Right to restriction of processing (Art. 31 LPDP): you may request a temporary suspension of processing while certain circumstances are being verified.
• Right to data portability (Art. 36 LPDP): you may request your data in a structured, machine-readable format.
• Right to object (Art. 37 LPDP): you may object to processing based on legitimate interest.
• Right to withdraw consent: you may withdraw consent for newsletter or analytics at any time, without affecting the lawfulness of prior processing.

Our website uses cookies in accordance with your choices. We use only necessary cookies (for administrator authentication and bot protection) and Google Analytics 4 analytics cookies - where analytics cookies are set only with your explicit consent.

Detailed information about each cookie category, as well as the ability to manage your consent, is available via the "Cookie Settings" button in the footer of the site. You can change your consent at any time.

We apply appropriate technical and organizational security measures in accordance with Art. 50 LPDP and Art. 32 GDPR:

• All communication with the server is protected by HTTPS/TLS encryption.
• Administrator authentication tokens are transmitted exclusively via HTTPOnly, Secure cookies.
• Access to data is limited to personnel for whom it is necessary to perform their duties.
• Cloudflare Turnstile protects forms against automated attacks.

Please note that no system for transmitting data over the internet is completely secure. We take all reasonable protective measures but cannot guarantee the complete security of any transmission.

Data may be transferred outside the territory of the Republic of Serbia only in the context of using Google Analytics 4 services (USA). The transfer is carried out on the basis of Standard Contractual Clauses adopted by the European Commission and accepted by Google, which provide an adequate level of data protection.

We reserve the right to amend this Privacy Policy. All changes will be published on this page with the date of last update. In the event of significant changes, we will notify you via a prominent notice on the site. We recommend checking this page periodically.

The original and authoritative version of this Privacy Policy is the one drafted in the Serbian language. The English translation is provided solely for the convenience of users and carries no legally binding effect. In the event of any inconsistency, ambiguity or discrepancy in interpretation between the Serbian and English versions, the Serbian version shall prevail.

For all questions, requests or complaints regarding the processing of your personal data, please contact us: