Privacy Policy

ECCO ING d.o.o. (hereinafter referred to as the “Company”, “we”, “us” or the “Data Controller”), as the company associated with the operation of Hotel Vestibul Palace, respects the privacy of its guests, customers and visitors to the vestibulpalace.com website and takes the protection of their personal data seriously.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/2018), and other applicable laws and regulations of the Republic of Croatia and the European Union.

This Privacy Policy explains what personal data we may collect, why and how we process it, how long we retain it, with whom it may be shared, and what rights you have in relation to the processing of your personal data.

1. Personal Data

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is an individual who can be identified, directly or indirectly.

Depending on how you use our website and the services provided by Hotel Vestibul Palace, we may process the following categories of personal data:

  • first and last name;
  • email address;
  • telephone number;
  • residential or other address, where required;
  • information you provide through our contact forms;
  • information you provide when making an enquiry or booking accommodation or other hotel services;
  • information required to process your reservation, guest registration, payment and invoicing;
  • information relating to your communications with Hotel Vestibul Palace;
  • technical information relating to your use of the website, such as your IP address, device and browser type, date and time of access, pages visited and other technical information;
  • information collected through cookies and similar technologies, depending on your preferences and consent;
  • other information you voluntarily provide when using our services.

We do not collect personal data that is not necessary for the relevant purpose.

2. Purposes and Legal Bases for Processing

We may process your personal data for the following purposes:

  • responding to enquiries and communicating with you;
  • receiving and processing reservations;
  • providing accommodation, restaurant and other hotel services;
  • performing a contract or taking steps at your request prior to entering into a contract;
  • complying with legal obligations relating to hotel operations, guest registration, accounting, taxation and other applicable requirements;
  • issuing and retaining invoices and other business documentation;
  • improving the quality of our services and website;
  • protecting the security of our information systems, premises, guests and employees;
  • protecting our legal interests and establishing, exercising or defending legal claims;
  • analysing the use of our website, where the appropriate consent has been obtained;
  • sending promotional and marketing communications where you have provided your consent or where another appropriate legal basis applies.

We process personal data only where there is an appropriate legal basis for doing so. Depending on the circumstances, this may include:

  • your consent;
  • performance of a contract or taking steps prior to entering into a contract;
  • compliance with a legal obligation;
  • the legitimate interests of the Company or a third party, provided that such interests are not overridden by your fundamental rights and freedoms.

Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

3. Contact Forms and Communications

When you contact us through a contact form on our website, by email, telephone or through another communication channel, we may process the information you provide in order to respond to your enquiry and provide the requested information or service.

Through our contact forms, we may collect information such as your name, email address, telephone number and the content of your message.

Please do not send sensitive personal data that is not necessary for resolving your enquiry through contact forms or ordinary email.

4. Reservations and Hotel Services

When you book accommodation or use other services, we may process personal data required for:

  • identifying the guest;
  • confirming and managing the reservation;
  • communicating with you before, during and after your stay;
  • providing the contracted hotel services;
  • processing payments;
  • issuing invoices;
  • complying with legal requirements relating to guest registration and records.

If you make a reservation through an external booking system or business partner, the processing of certain personal data may also be subject to that service provider’s own privacy policy.

We recommend reviewing the privacy policies of external booking platforms before using their services.

5. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected or for the period required by applicable law.

The retention period depends on the type of personal data and the legal basis for its processing.

Personal data processed for the performance of a contract is retained for as long as necessary to perform the contract and for any subsequent period during which legal claims may be brought.

Personal data that we are legally required to retain for accounting, taxation or other statutory purposes will be retained for the periods prescribed by applicable law.

Where processing is based on consent, we may process the relevant personal data until consent is withdrawn or until the data is no longer necessary for the purpose for which consent was provided, unless another legal basis permits or requires further retention.

Once the applicable retention period expires, personal data will be deleted, anonymised or otherwise removed from further processing, as appropriate.

6. Recipients and Data Processors

We may engage external service providers to perform certain business and technical activities. In some cases, these providers process personal data on our behalf.

Such service providers may include:

  • website hosting and maintenance providers;
  • IT and technical service providers;
  • reservation and hotel management system providers;
  • email service providers;
  • analytics and marketing service providers;
  • accounting service providers;
  • lawyers, tax advisers and other professional advisers;
  • payment and financial service providers;
  • business and booking partners where necessary to process a reservation or provide a requested service.

We require processors acting on our behalf to process personal data only in accordance with our documented instructions, to implement appropriate technical and organisational security measures and not to use personal data for their own unauthorised purposes.

We may also disclose personal data to competent public authorities where required by law or pursuant to another valid legal request.

We do not sell your personal data to third parties.

7. Transfers of Personal Data Outside the European Economic Area

Certain providers of technological, analytics, reservation or marketing services may process personal data outside the European Economic Area (EEA).

Where such transfers occur, we take appropriate measures to ensure that personal data receives an adequate level of protection in accordance with the GDPR.

Such transfers may be based, for example, on an adequacy decision of the European Commission, the European Commission’s Standard Contractual Clauses or another transfer mechanism permitted under applicable data protection law.

8. Automatically Collected Technical Information

When you visit our website, certain technical information may be automatically recorded in order to ensure the secure and proper operation of the website.

Such information may include your IP address, date and time of access, browser and device type, pages visited, the URL from which you accessed our website and other technical information.

We may use this information to ensure the technical functionality and security of the website, detect and prevent misuse and, where applicable and permitted, analyse website usage.

9. Cookies

The Hotel Vestibul Palace website may use cookies and similar technologies.

Cookies are small text files stored on your device when you visit a website.

Cookies may include:

  • Strictly necessary cookies – required for the proper and secure operation of the website;
  • Functional cookies – used to remember certain user preferences;
  • Analytics cookies – help us understand how visitors use our website;
  • Marketing cookies – used to measure the effectiveness of marketing activities and to display more relevant advertising.

Cookies that are not strictly necessary for the operation of the website are used only where an appropriate legal basis exists, including your prior consent where required.

You can change or withdraw your cookie preferences through the cookie settings available on our website.

Where we use third-party services, such as analytics, advertising or other external services, those providers may process certain information in accordance with their own privacy policies and applicable data protection laws.

10. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unauthorised processing.

Our security measures are adapted to the nature of the personal data, the purposes of processing and the risks involved.

Despite the security measures implemented, no method of transmitting or storing data over the Internet can guarantee absolute security.

11. Your Rights

Subject to the conditions set out in the GDPR and other applicable legislation, you have the following rights in relation to your personal data:

Right of Access

You have the right to obtain confirmation as to whether we process personal data concerning you and, where we do, to request access to that personal data and information about its processing.

Right to Rectification

You have the right to request the correction of inaccurate personal data concerning you and to have incomplete personal data completed.

Right to Erasure (“Right to be Forgotten”)

In the circumstances provided for by the GDPR, you have the right to request the deletion of your personal data.

The right to erasure is not absolute. We may be required to retain certain information in order to comply with legal obligations or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing

In the circumstances prescribed by the GDPR, you have the right to request that the processing of your personal data be restricted.

Right to Data Portability

Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and, where legally applicable, to transmit that data to another data controller.

Right to Object

Where processing is based on our legitimate interests, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you.

Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time. Once you object, we will no longer process your personal data for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Right to Lodge a Complaint with a Supervisory Authority

If you believe that your personal data is being processed in breach of applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In the Republic of Croatia, the competent supervisory authority is:

Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136
10000 Zagreb
Republic of Croatia

12. Personal Data Breaches

In the event of a personal data breach, we will act in accordance with our obligations under the GDPR.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority where required by law.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will also notify the affected individuals, unless an applicable legal exception applies.

13. External Links

Our website may contain links to websites and services operated by third parties, including booking, travel, social media, mapping and other external platforms.

We do not control the privacy practices of these third parties. We therefore recommend reviewing their privacy policies and terms of use before using their services.

14. Contact Regarding Personal Data Protection

If you have any questions regarding the processing of your personal data or wish to exercise any of your data protection rights, you can contact us at:

ECCO ING d.o.o. / Hotel Vestibul Palace
Iza Vestibula 4
21000 Split
Croatia

Email: info@vestibulpalace.com

When submitting a request, we may ask you to provide additional information necessary to verify your identity in order to prevent unauthorised disclosure of personal data.

We will respond to your request within the time limits prescribed by applicable law.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, technology, our services or our personal data processing practices.

The current version of this Privacy Policy will always be available on the Hotel Vestibul Palace website.

We recommend reviewing this page periodically to stay informed of any changes.

Last updated: September 2026