Privacy Policy

This policy explains what personal data Ardura Travel ("we", "us") collects when you contact us or book a boat tour, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Croatian data protection law.

Who is responsible for your data

The data controller is Ardura Travel, 3. studenog 1944 br. 8, 22000 Šibenik, Croatia (OIB 76772410360). For any privacy question or request, contact us at info@arduratravel.com, on WhatsApp, or by post at the address above.

What we collect

• Contact and booking details you give us when you message us on WhatsApp, call us, or make a booking: your name, phone number, email address (if you provide it), party size, tour dates, and any requests you tell us (for example a hotel pickup or a dietary note).
• Payment details are agreed with you directly when we confirm your booking. We do not take payments through this website, and we do not see or store your full card number.
• Technical data that any website receives automatically, such as your IP address, device, and browser type. Our hosting and content delivery provider (Cloudflare) processes this to serve the site and protect it from abuse.

We also use Google Analytics and Microsoft Clarity to understand how visitors use this website - which pages they view, where they came from, and how they interact with the site. We use this data in aggregate to improve our tours and website, and we do not sell it. See our Cookie Policy for the cookies involved.

Why we use it, and our legal basis

• To answer your enquiry and arrange your tour - legal basis: performance of a contract, or steps taken at your request before a contract.
• To keep our website secure and working - legal basis: our legitimate interest in running a safe, functioning site.
• To keep tax and accounting records - legal basis: compliance with a legal obligation under Croatian law.
• To understand how our website is used (analytics) - legal basis: our legitimate interest in improving our tours and website. You can object at any time, and you can block these cookies in your browser.

Who we share it with

We do not sell your personal data. We share it only with the providers we need to run the business:

• WhatsApp / Meta - if you choose to message us on WhatsApp, your chat is handled under Meta's own privacy terms.
• Cloudflare - website hosting and content delivery.
• Google and Microsoft - analytics processing (Google Analytics, Microsoft Clarity), as described above.
• Our accountant and the Croatian tax authorities - where we are legally required to report.

Some of these providers may process data outside the European Economic Area. Where they do, they rely on safeguards approved under the GDPR, such as standard contractual clauses.

How long we keep it

We keep enquiry messages only as long as needed to deal with your request and for a reasonable period afterwards. Booking and invoice records are kept for the period required by Croatian tax and accounting law. After that, we delete or anonymise the data.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on your consent, you can withdraw it at any time. To exercise any of these, contact us using the details above.

If you believe we have handled your data incorrectly, you have the right to complain to the Croatian data protection authority, AZOP (Agencija za zaštitu osobnih podataka), azop.hr.

Children

Our tours are family-friendly, but bookings and enquiries are made by adults. We do not knowingly collect personal data directly from children without a parent or guardian.

Changes to this policy

We may update this policy as our business or the law changes. The date at the top shows when it was last reviewed.