Privacy Notice

At a Glance

• We use your data to answer your inquiry, organise your stay and meet our legal duties, such as registering guests in Croatia.
• Statistics and advertising cookies (Google Analytics, Microsoft Clarity, Meta, Google Ads) are only set if you agree in the cookie banner.
• For advertising on Facebook and Instagram we send the e-mail addresses and phone numbers of our guests, of people who sent us an inquiry and of people who signed up for our news to Meta in hashed form, so that Meta can find people with similar interests and leave our contacts out of those ads. You can object to this at any time.
• We do not sell personal data.

Your Right to Object

You can object at any time to our use of your data for direct marketing, including sending it to Meta for advertising audiences and the e-mails we send after your stay or your inquiry. An e-mail to benjamin@marimluxuryvillas.com is enough; no reason is needed. We then stop using your data for these purposes and remove you from our list at Meta without undue delay. You can also object, on grounds relating to your particular situation, to any processing based on our legitimate interest (Art. 21 GDPR). You can ask us for our assessment of these legitimate interests.

Who We Are

Marim Luxury Villas is a brand of MARIM d.o.o. and MANATIS d.o.o. (details in the Imprint below). MARIM d.o.o. is the controller for this website, inquiries, our e-mail lists, advertising and the bookings of Villa Marim and Villa Moana; MANATIS d.o.o. is the controller for the bookings of Villa Manatis. For any question about your data, write to benjamin@marimluxuryvillas.com.

When You Visit the Website

Server logs. Our server (netcup, data centre in Nuremberg, Germany) records your IP address, the date and time, the page requested, your browser and the referring page with every request. We use this to run and secure the website and to fend off attacks (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted automatically: each log file is written until it reaches about 100 MB and is then kept for at most 90 days.

Maps. The Krk Map pages load map tiles from OpenFreeMap (Hyperknot Software Kft., Hungary) and elevation data from Amazon Web Services (USA). These providers receive your IP address so that the map can be shown (legitimate interest, Art. 6(1)(f) GDPR). No cookies are set for this.

Cookies and Similar Technologies

Without your consent, we set only the cookie that stores your cookie choice. Our pages also keep a few small notes in your browser's own storage, which never leave your device and contain no identifier: that you have already seen a page during this visit (deleted when you close the tab), that you closed the language suggestion, when our pop-up was last shown to you, that and when you sent us an inquiry or signed up (so that the pop-up does not appear again), and on the Krk Map what you keep there (saved and visited places with their dates, recently viewed places, your day plan, the villa and month you chose), your last visit, which tips you have seen and your display settings (kept until you clear your browser data). Everything else is set only after you agree in the cookie banner (your consent: § 25 TDDDG for visitors from Germany, § 165(3) TKG 2021 for Austria, Art. 43(4) ZEK for Croatia, and Art. 6(1)(a) GDPR). To show the cookie banner, every page loads Google Tag Manager and the CookieScript banner; Google and CookieScript receive your IP address for this (legitimate interest, Art. 6(1)(f) GDPR). Other Google services load only after you agree. You can change or withdraw your choice at any time here: Cookie settings; a withdrawal applies from then on. If you decline, you can still use the whole website.

Google Analytics keeps event data for 2 months and user-level data for 14 months. Google signals is switched off. According to Google, Google Analytics does not store IP addresses of visitors from the EU, the UK or Switzerland.

Microsoft Clarity records how pages are used (clicks, scrolling, page views) and shows it to us as heatmaps and session recordings. Microsoft may also use this data for its own purposes: microsoft.com/privacy/privacystatement.

Meta Pixel with advanced matching. If you agree, the pixel sends Meta your page views and events such as a form being sent. First name, last name, e-mail address, country and gender, as far as you type them into a form, are hashed in your browser and sent to Meta, so that Meta can match the event to an account.

We and Meta Platforms Ireland Ltd. are jointly responsible for collecting and transmitting this data (Art. 26 GDPR): Meta is responsible for its own further processing and answers requests about it, and we pass on to Meta any request that reaches us. Meta's privacy policy: facebook.com/privacy/policy.

Your Inquiry

When you write to us through the inquiry form, by e-mail, phone or WhatsApp, or (from 2024 to January 2026) through a form in an ad for our villas on Facebook or Instagram, we process your name, e-mail address, your phone number if you give it, the villa, travel dates, number of guests, the occasion and your message. For the form on our website we also store the IP address, browser and time, to detect abuse.

We use this to answer your inquiry and make you an offer (steps before a contract, Art. 6(1)(b) GDPR, and our legitimate interest in handling inquiries, Art. 6(1)(f)). Your inquiry reaches our mailbox (easyname) and our guest records; your e-mail address and phone number can also be added to our e-mail service Brevo and, from there, to our list at Meta (see "Advertising on Facebook and Instagram"). While we keep your inquiry, we may write to you by e-mail about stays in our villas, at most once a year; you can say no at any time, free of charge, with a reply or the link in the e-mail (our legitimate interest in letting people who asked about our villas know about stays, Art. 6(1)(f) GDPR). We keep inquiries that do not lead to a booking for follow-up questions, for these e-mails and for our list at Meta for 5 years from your last contact, then we delete them (see "How Long We Keep Your Data"). You can ask us at any time to delete yours.

Villa Guide and Guest List

For the free Villa Guide we process your first name, e-mail address and language, the time, IP address and browser of your sign-up and confirmation (as proof of your consent) and, if you came through one of our ads, the campaign, the ad and Meta's click identifier, to see which ad works. For the guest list we process your e-mail address, language, time and IP address.

Both use double opt-in: you receive the guide or our news only after clicking the link in our confirmation e-mail. Guide readers then receive three e-mails about the guide; both receive occasional news from Krk and the villas, at most once a month (your consent, Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every e-mail. Your e-mail address, also before you confirm, can be added to our list at Meta (see "Advertising on Facebook and Instagram").

We send these e-mails through Brevo (Brevo SAS, Paris, with servers in France and Belgium). Brevo records whether an e-mail was opened and whether a link was clicked; we use this to improve our e-mails.

Booking and Stay

For your booking we process your name, e-mail address, phone number, country, postal address, travel dates, number of guests, the extras you book and your payments, to carry out the contract (Art. 6(1)(b) GDPR). We cannot accept a booking without these details.

• Booking system: Lodgify manages our calendar and bookings and sends booking confirmations itself.
• Our own booking pages (from their launch): when you book there, we also record when you accepted our terms, in which version, with IP address and browser, as proof of the contract.
• Payments: card payments are handled by Stripe; only Stripe receives your card details, we do not. Bank transfers go to our bank.
• Invoices are issued through Parra (fiscalisation under Croatian law), and our accounts are kept by our accounting firm. We are legally required to do this (Art. 6(1)(c) GDPR).
• Bookings through Booking.com, Airbnb or agencies: they pass on the details needed for your stay. They are responsible for their own processing, and their privacy notices apply as well.

Guest registration. Croatian law requires us to register every guest within 24 hours of arrival in the state registration system eVisitor (Art. 22 of the Croatian Tourist Tax Act). For this we process name, address, date of birth, nationality, gender and the type and number of your identity document (legal obligation, Art. 6(1)(c) GDPR). We need these details to register you.

Guest portal. Your booking number opens our guest portal. There you can confirm your check-in and send us feedback after your stay, including, if you wish, a sign-up for our news (contract; for the feedback our legitimate interest in improving; for the news your consent).

Reviews. If you write a public review of our villas, for example on Google or Airbnb, we keep a copy with the name shown there, to answer it and to learn from it, and we may show it on our website with the name shown there, the villa and the month (our legitimate interest, Art. 6(1)(f) GDPR). You can ask us at any time to delete our copy or to take the review off our website.

E-mails After Your Stay

If you have stayed with us, we may write to you personally by e-mail about stays in our villas, at most twice a year, at the address you gave us yourself. You can say no at any time, free of charge, with a reply or the link in every e-mail (our legitimate interest in staying in touch with our guests, Art. 6(1)(f) GDPR). If you book on our own booking pages, we also tell you there.

Advertising on Facebook and Instagram

Customer lists. We send Meta Platforms Ireland Ltd. the e-mail addresses and phone numbers of our guests, of people who sent us an inquiry and of people who signed up for the Villa Guide or the guest list (also before they confirm); for our main list also the amount a guest has spent with us. Before upload the values are hashed, that is, turned into an unreadable checksum; Meta can still match them to its accounts.

Meta matches these values with its user accounts and uses the list to find people with similar interests to whom it shows our ads, and to leave the people on the list out of those ads. Two older lists from 2024 (guests and inquiries) are still held at Meta; no running ad uses them. Meta deletes the uploaded checksums after matching; the audience built from them stays in our ad account until we replace or delete it, and Meta does not show us who is in it. Our legal basis is our legitimate interest in finding, at reasonable cost, new guests who suit our villas (Art. 6(1)(f) GDPR). You can object at any time (see "Your Right to Object"); we then remove you from our list at Meta without undue delay.

Meta Pixel. With your consent (see "Cookies and Similar Technologies"), Meta builds audiences from visitors to our website, each kept for 30 to 180 days, and measures whether our ads lead to inquiries.

Who Receives Your Data

These providers receive personal data from us or, when you use the website, directly from your browser:

Responsible for their own processing: Meta Platforms Ireland Ltd. (jointly with us for collecting and sending pixel data; for our customer lists Meta acts on our behalf under its Custom Audience terms), WhatsApp Ireland Ltd., the booking platforms, the Croatian authorities (eVisitor), our accounting firm, and other authorities where the law requires it.

Transfers Outside the EU

Google, Meta, Microsoft, Stripe, Anthropic, Amazon Web Services, WhatsApp and some sub-processors of our providers (for example of Brevo) may process data in the United States. Google, Microsoft, Stripe and Amazon Web Services are certified under the EU-US Data Privacy Framework; for them the European Commission's adequacy decision of 10 July 2023 applies. Otherwise the European Commission's standard contractual clauses in the provider's terms apply (Art. 46 GDPR); you can ask us for a copy. Our booking system Lodgify is provided by Codebay Solutions Ltd in the United Kingdom; for the United Kingdom the European Commission's adequacy decision applies (renewed on 19 December 2025).

How Long We Keep Your Data

• Server logs: until the log file reaches about 100 MB, then at most 90 days.
• Inquiries that did not lead to a booking: 5 years from your last contact with us; then we delete them. You can ask us to delete yours at any time.
• Invoices and the booking records behind them: 11 years from the end of the business year, as Croatian accounting law requires (Zakon o računovodstvu, NN 85/24); then we delete them.
• Guest registration: in eVisitor as Croatian law requires. Our own copy of the registration details (type and number of your identity document, date of birth, address, nationality, gender) is deleted at the end of the calendar year after your stay; your name, dates and villa stay with the booking. Lists from 2024 stays that hold these details are still kept for now.
• Villa Guide and guest list: until you unsubscribe. After that your address stays on our block list, with the proof of your sign-up, so that you are never added or written to again.
• Copies of public reviews (also those shown on our website): until you ask us to delete them.
• Sign-ups you do not confirm: kept, also on our list at Meta, for 5 years from your sign-up; then we delete them, or earlier if you object or ask us to.
• Feedback in the guest portal: 5 years after your stay; then we delete your name and your text, and only the ratings stay, without a name.
• Our lists at Meta: kept until we delete them; if you object or unsubscribe, we remove you from all of them without undue delay.
• Google Analytics: 2 months (events), 14 months (user level).
• Microsoft Clarity: session recordings 30 days (9 months if we mark one), click and heatmap data 9 months (Microsoft's figures).
• Cookies: see the table under "Cookies and Similar Technologies".

Your Rights

An e-mail to benjamin@marimluxuryvillas.com is enough. We make no automated decisions with legal effect on you (Art. 22 GDPR).

Changes to This Notice

We update this notice when our processing or the law changes. The version with the date at the top applies.

Contact

E-mail: benjamin@marimluxuryvillas.com
Phone: +43 680 5583751
Post: MARIM d.o.o., Stara Baška 237A, 51521 Stara Baška, Croatia

Imprint