General terms and conditions of business, use, and purchase

HOTEL VESTIBUL PALACE

Split, Dioklecijanova palača · Impresia Collection · Small Luxury Hotels of the World

1. GENERAL PROVISIONS

These General Terms and Conditions of Business, Use and Purchase (hereinafter: the “Terms”) govern the rights and obligations between the company ECCO ING d.o.o., Personal Identification Number (OIB): 28671967175, VAT ID number: HR28671967175 (if the Merchant is a VAT payer), with registered office at Kralja Zvonimira 65A, 21000 Split, Croatia, entered in the court register of the Commercial Court in Split under registration number (MBS): 060025006, holder of travel agency business license No. HR-AB-21060025006 (hereinafter: the “Merchant” or “Hotel Vestibul Palace”), which operates accommodation facilities in Split under the trademarks Hotel Vestibul Palace, Vila Dobrić and Residence, and these Terms apply to reservations and purchases made through the Hotel Vestibul Palace website [www.vestibulpalace.hr / actual domain], and to every user of the said website who makes a reservation, purchase or inquiry through it (hereinafter: the “Guest” or “User”).

By accessing the website, making a reservation and/or completing a purchase, the Guest confirms that they have read and understood these Terms and that they accept them in full. If the Guest does not agree with the Terms, they must refrain from using the website and reservation services.

The Terms apply to all accommodation reservations, additional services and any purchase of products (e.g. gift vouchers) via the Hotel’s website, including payments made through the CorvusPay system.

2. DEFINITIONS

Merchant / Hotel — the legal entity referred to in points 1 and 3 of these Terms, which operates Hotel Vestibul Palace.

Guest / User / Customer — a natural or legal person who makes a reservation, purchase, or inquiry via the website.

Service — accommodation, food & beverage, wellness, transfer, and other hospitality and tourism services offered by the Hotel.

Product — physical or electronic goods that, where applicable, may be purchased via the website (e.g. a gift voucher).

CorvusPay — CorvusPay d.o.o., a payment card and other electronic payment processing service provider that enables the Hotel to securely charge reservations online.

Security / guarantee charge — a charge or pre-authorization of an amount on the Guest’s payment card to guarantee a reservation, to charge a no-show fee, or for any potential damage, carried out via the CorvusPay payment link (PayByLink).

3. MERCHANT INFORMATION

Company: ECCO ING d.o.o.

Trademarks under which the Merchant operates: Hotel Vestibul Palace · Vila Dobrić · Residence

Travel agency business license: HR-AB-21060025006

Registered office address of the Merchant: Kralja Zvonimira 65A, 21000 Split, Croatia

Hotel address (point of sale), if different from the registered office: Iza Vestibula 4a, 21000 Split, Croatia

OIB (Personal ID Number): 28671967175 · VAT ID number: HR28671967175 (if the Merchant is a VAT payer) · MBS (Registration No.): 060025006 (Commercial Court in Split)

Share capital: EUR 485,712.39, fully paid in · Management Board member: Nenad Nizić

IBAN: HR0224020061100475856 · Bank: Erste & Steiermärkische Bank d.d. · SWIFT/BIC: ESBCHR22

Email: info@vestibulpalace.com · Email for complaints and data protection: info@vestibulpalace.com

Phone: +385 21 329 329, +385 99 329 3333 · Reservations department working hours: 24/7

4. SUBJECT MATTER OF THE TERMS AND SCOPE OF SERVICES

Via the website, the Guest may: (a) check availability and prices of accommodation units and make an online reservation; (b) order additional Hotel services (e.g. transfer, gastronomic experiences); (c) purchase a Hotel gift voucher, if that option is available on the website. All prices displayed on the website are expressed in euros (EUR) and include VAT, unless expressly stated otherwise. The exact name, main characteristics, and final price of each individual room/service are stated on the corresponding accommodation or service description page.

4.1 Export restrictions

The services offered by the Hotel via the website (accommodation and related services) are, by their nature, not subject to export restrictions prescribed by customs or similar regulations. Should the Hotel in the future offer, via the website, a physical product intended for delivery outside the Republic of Croatia, the Guest will be expressly informed of any applicable export restrictions prior to concluding the contract.

4.2 Codes of conduct

Hotel Vestibul Palace operates in accordance with the quality and business standards of Small Luxury Hotels of the World and Impresia Collection, of which it is a member.

4.3 Warranty and after-sales services

The Hotel warrants that the contracted accommodation service and accompanying services will be provided in accordance with the description published on the website and the SLH/Impresia Collection quality standards. The Guest may raise remarks regarding the quality of the service provided at the Hotel reception during their stay for immediate resolution, and subsequently also via the complaints procedure described in point 11 of these Terms.

5. RESERVATION AND PURCHASE PROCEDURE

A reservation is made by selecting the dates of stay, the type of room/service, and entering the required personal and payment details. Before final confirmation, the Guest is shown a reservation summary (dates, price, cancellation terms, total amount to be charged). By submitting the order, the Guest makes a binding offer to conclude a contract for the provision of the accommodation service; the contract is deemed concluded at the moment the Hotel sends the Guest an electronic reservation confirmation with a reservation number.

In certain cases (e.g. group reservations, special requests, guarantee charges), the Hotel may send the Guest a special CorvusPay link for a security/guarantee charge by email, which the Guest voluntarily uses to enter card details directly on the CorvusPay payment form.

6. PRICES

Prices may change without prior notice for new reservations, but a change in price does not affect already confirmed reservations. For certain promotional or non-refundable rates, special payment and cancellation terms are clearly displayed on the website prior to confirming the purchase.

7. METHODS OF PAYMENT

Hotel Vestibul Palace enables the following methods of payment for reservations and services via the website:

Credit and debit cards: Visa, Visa Electron, Mastercard, Maestro and Diners Club, via the secure CorvusPay payment form.
Bank transfer to the Hotel’s IBAN, for selected types of reservations (e.g. group reservations, payment by pro forma invoice).
Payment of the remaining amount (if the reservation provides for partial advance payment) at the Hotel reception upon arrival, by card or cash, in accordance with applicable fiscalization regulations.
Security/guarantee charge (pre-authorization) via the CorvusPay PayByLink link — used to guarantee the reservation, to charge a no-show fee, or for damages, with prior notice to the Guest of the possible amount and reason for the charge.

Payment card details entered by the Guest during payment are processed exclusively on the CorvusPay payment form and are never transmitted to or stored on the Hotel’s servers or systems.

8. PAYMENT SECURITY

Card payments on the Hotel’s website are processed by CorvusPay d.o.o., an authorized payment services provider operating in accordance with the PCI DSS Level 1 standard — the highest security standard prescribed by the leading card schemes (Visa, Mastercard, etc.).

Payment card data is transmitted exclusively in encrypted form (SSL/TLS encryption) directly between the Guest’s browser and the CorvusPay system.

Hotel Vestibul Palace never obtains or stores complete payment card data (card number, expiry date, CVV/CVC number) — such data is processed exclusively by CorvusPay.

Additional verification of the cardholder’s identity is carried out via the 3-D Secure protocol (Mastercard Identity Check / Visa Secure), whereby the card-issuing bank confirms the Guest’s identity via a one-time password or authentication app.

If a card is saved for future charges (e.g. reservation guarantee or no-show fee), this is done exclusively via CorvusPay tokenization (PayByLink Tokenization) with the Guest’s explicit consent — the Hotel thereby only holds a security token, not the actual card data.

Sensitive data is additionally protected by cryptographic devices certified to the FIPS 140-2 Level 3 standard, in accordance with the publicly published security standards of the CorvusPay system.

CorvusPay treats all data collected for payment processing purposes as confidential and uses it solely for the purpose for which it was collected. More information about the CorvusPay security system is available on the service provider’s official website.

9. RESERVATION CONFIRMATION AND SERVICE DELIVERY INFORMATION

Since the subject matter of the contract is predominantly an accommodation service rather than physical goods, the term “delivery” below refers to the manner and timeframe in which the contracted service is provided, while delivery terms for any physical products are stated separately.

The electronic reservation confirmation, invoice and/or e-voucher are sent to the Guest at the specified email address immediately, and at the latest within 24 hours of receipt of payment or successful payment authorization. Electronic delivery of the confirmation is free of charge.

The accommodation service is provided (“delivered”) on the date specified in the reservation confirmation, with check-in from 14:00 and check-out until 11:00, unless otherwise expressly agreed with the Hotel.

For any purchase of a physical product via the website (e.g. a printed gift voucher): the delivery period is up to 10 business days from confirmation of payment; delivery is carried out via [Croatian Post / courier service name]; the delivery cost is EUR 6, or delivery is free for orders above [EUR 100]; delivery is carried out within [the Republic of Croatia / the European Union].

An electronic gift voucher is delivered by email free of charge, generally immediately upon recorded payment.

10. RIGHT OF UNILATERAL TERMINATION, CANCELLATION AND REFUNDS

Pursuant to Article 79 of the Consumer Protection Act (which transposes into Croatian law Article 16(l) of Directive 2011/83/EU on consumer rights), the consumer’s right to unilaterally terminate a distance contract within 14 days does not apply to contracts for the provision of accommodation services not intended for residential purposes, where the contract provides for a specific date or period of performance. The standard 14-day right of withdrawal therefore does not apply to accommodation reservations at Hotel Vestibul Palace.

Instead, the cancellation terms for a reservation and any refund of amounts paid are determined by the price plan (rate) selected at the time of booking, with which the Guest is familiarized prior to confirming the purchase, for example:

Flexible rate — free cancellation is possible up to 7 days before the arrival date; after this deadline, or in case of no-show, [one night’s stay / the full reservation amount] is charged.
Non-refundable rate — the amount paid is not refunded regardless of when the cancellation or no-show occurs, unless the law expressly provides otherwise.

A cancellation request must be submitted by the Guest via email to info@vestibulpalace.com or through the contact details provided in the reservation confirmation. Where a refund is justified (in accordance with the selected rate, a Hotel decision, or a legal obligation), the refund is made using the same payment method as the original payment, generally within 14 days of the grounds for the refund arising, via the CorvusPay system.

Complaints relating to the quality of the service provided (as opposed to cancellation) are handled in accordance with the procedure described in point 11 of these Terms.

11. GUEST RIGHTS AND COMPLAINTS PROCEDURE

Pursuant to Article 10 of the Consumer Protection Act, the Guest-consumer has the right to submit a written complaint regarding the quality of the service provided, billing accuracy, staff conduct, or any other aspect of the Hotel’s operations, as follows:

by email to info@vestibulpalace.com (or a dedicated complaints address, should the Merchant choose to establish one);
by post to the Merchant’s registered office address stated in point 3;
in person at the Hotel reception, where the complaint is recorded in the guest complaints/feedback book.

The Merchant is obliged to confirm receipt of the complaint in writing without delay and to respond to it in writing no later than 15 days from the date of receipt. To enable the Guest to exercise this right, the Hotel provides the Guest with confirmation of receipt of the complaint.

If the complaint is not resolved to mutual satisfaction, the consumer may attempt to resolve the dispute out of court, including via the European Commission’s Online Dispute Resolution platform for consumer disputes, pursuant to Regulation (EU) No. 524/2013, available at: https://ec.europa.eu/consumers/odr.

12. PERSONAL DATA PROTECTION — PRIVACY POLICY AND RULES

12.1 Data controller

The controller of personal data is ECCO ING d.o.o.; contact details are provided in point 3 of these Terms. Inquiries relating to personal data protection may be sent to: info@vestibulpalace.com (or a dedicated data protection address, should the Merchant choose to establish one).

12.2 What data we collect

Identification data: first name, last name, and, where required by law (registration of foreign nationals’ stay), passport/ID card number and nationality.
Contact data: email address, phone number, home address.
Reservation data: dates of stay, room/service type, special requests, stay history.
Payment data: processed exclusively by CorvusPay; the Hotel does not store complete payment card data (see point 8).
Data collected via cookies and similar technologies while using the website.

12.3 Purposes and legal basis for processing

Performance of the contract for the provision of the accommodation service and related services (Art. 6(1)(b) of the General Data Protection Regulation — GDPR).
Fulfillment of the Hotel’s legal obligations — registering the stay of foreign nationals with the competent police authority pursuant to the Aliens Act, maintaining the guest register, issuing invoices, and keeping accounting records (Art. 6(1)(c) GDPR).
The Merchant’s legitimate interest — improving service quality, preventing abuse and fraud, direct marketing to existing guests with the option to object at any time (Art. 6(1)(f) GDPR).
The Guest’s consent — e.g. sending marketing communications to new contacts, or saving card data (tokenization) for future charges; consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 6(1)(a) GDPR).

12.4 Recipients of data and data processors

For the purpose of fulfilling the reservation and providing the service, certain data may be shared with the following categories of recipients, strictly to the extent necessary: CorvusPay d.o.o. (card payment processing); the hotel property management system (PMS) provider Oracle Hospitality OPERA Cloud; sales channel management systems (channel manager) and online booking platforms (OTAs) through which the reservation may have been received; IT and hosting service providers; competent state authorities where required by law (police, tax administration, tourism inspectorate, etc.). The Hotel does not sell Guests’ personal data to third parties.

12.5 Transfer of data outside the European Economic Area

Should certain data processors (e.g. IT infrastructure providers) be located outside the European Economic Area, data transfers are carried out exclusively using appropriate safeguards recognized under the GDPR, such as the European Commission’s standard contractual clauses.

12.6 Data subject rights

The Guest has the right, at any time, to request from the Merchant: access to their personal data, correction of inaccurate or incomplete data, erasure of data (“the right to be forgotten”) where legal conditions for this are met, restriction of processing, portability of data they themselves provided, objection to processing based on legitimate interest or for direct marketing purposes, and withdrawal of given consent. Requests are to be submitted to info@vestibulpalace.com. If the Guest believes their personal data has been processed contrary to applicable regulations, they have the right to lodge a complaint with the supervisory authority — the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10 000 Zagreb, www.azop.hr.

12.7 Cookies

The website uses technically necessary cookies required for the operation of the reservation system and the CorvusPay payment form, as well as, subject to the Guest’s prior consent, analytical and marketing cookies. On the first visit to the website, the Guest is shown a cookie notice through which they may accept, reject, or customize their settings, which may subsequently also be changed through the settings of their internet browser.

13. DATA COLLECTION AND RETENTION POLICY

Data from the guest register (check-in/check-out, including data on foreign nationals) is collected and retained in accordance with the deadlines prescribed by the Aliens Act and the regulations on tourist check-in and check-out.

Invoices and related accounting documentation are retained for at least 11 years, in accordance with the Accounting Act and the General Tax Act.

Reservation data not subject to specific statutory retention periods is deleted or anonymized no later than 5 years after the end of the Guest’s stay, or after the purpose for which it was collected ceases, unless longer retention is necessary for the establishment or defense of legal claims.

Data processed on the basis of consent (e.g. marketing communications, card tokenization for future charges) is retained until the Guest withdraws their consent.

Payment card data is retained in its entirety exclusively within CorvusPay’s systems (in tokenized form, where applicable), in accordance with the PCI DSS standard — the Hotel does not store such data on its own infrastructure.

The Merchant applies appropriate technical and organizational data protection measures (access control and restriction, encryption of data transmission, regular updating and monitoring of information systems, staff training) to prevent unauthorized access, loss, alteration, or misuse of Guests’ personal data.

14. INTELLECTUAL PROPERTY

The content of the website (texts, photographs, graphic elements, the Hotel’s trademark) is owned by the Merchant, or the Merchant is authorized to use it, and may not be reproduced, distributed, or otherwise used without the Merchant’s prior written approval.

15. LIMITATION OF LIABILITY

The Merchant makes reasonable efforts to ensure the accuracy and up-to-date nature of information published on the website, but is not liable for any technical disruptions beyond its reasonable control, including interruptions to the operation of the CorvusPay payment system, internet connectivity, or third-party systems involved in processing the reservation.

16. AMENDMENTS TO THE TERMS

The Merchant reserves the right to amend these Terms at any time, and Guests will be notified by publication of the amended text on the website. Amendments apply to reservations made after the date of publication, while already confirmed reservations remain governed by the Terms in force at the time of their confirmation.

17. GOVERNING LAW AND JURISDICTION

These Terms and all relationships arising from them are governed by the law of the Republic of Croatia. Any disputes shall fall under the jurisdiction of the competent court in Split, unless mandatory consumer protection regulations provide for different jurisdiction.

18. CONTACT

For all questions relating to reservations, payment, complaints, or personal data protection, the Guest may contact the Merchant using the contact details provided in point 3 of these Terms.

19. TECHNICAL NOTES FOR WEBSITE COMPLIANCE (for the implementation team)

The following requirements are not addressed by the text of these Terms but must be implemented on the website itself, and should be verified before activating CorvusPay charges:

In a visible location on the website (e.g. in the footer and on the payment page), the logos of the payment cards actually accepted by the Hotel must be displayed (planned: Visa, Mastercard, Maestro, Diners Club), along with the logos of the corresponding security programs (e.g. Visa Secure, Mastercard Identity Check/3-D Secure). The final, exact list of card brands must be confirmed with the banks approving the CorvusPay merchant application for this point of sale before the logos are published.
The reservation process must allow the Guest to review and correct entered data (dates, guest details, amount) before final confirmation/payment — see point 5.
These Terms must be published in a manner that allows the Guest to save, print, and reproduce them (e.g. a separate, permanently accessible web page and/or the option to download as a PDF), rather than solely within a pop-up/modal window that cannot be saved.
All product/service information (names, main characteristics, final prices including taxes and fees) must be kept up to date on the pages of the individual accommodation units/services.

These Terms enter into force on the day of publication on the Hotel’s website.