Privacy policy

Who is responsible for your data?

The controller is DU - TIPS (DUBROVNIK TIPS), obrt za turističku agenciju (a Croatian sole proprietorship), owned by Lucia Petrina, Sustjepanska obala 2, 20236 Sustjepan, Croatia, Croatian tax ID (OIB) 05698237089. NADIGRA is a brand of this business.

For privacy questions and requests, contact info@nadigra.com or the postal address above. This policy covers nadigra.com, its language versions and communication initiated through the website.

What do we collect?

Our enquiry forms ask for your name, contact details (email or phone) and a message. Business name or existing website, location and service selection are optional. We also store the enquiry date, its status and notification delivery status. The enquiry is saved in NADIGRA's enquiry database and a copy is emailed to info@nadigra.com.

On the taxi package page we collect the application details: the official business name, Croatian tax ID (OIB) or equivalent, contact details, information about vehicles, services and the website, and any photos and files you attach. The apartment enquiry and the enquiry on the /en/balkans page ask for your name, contact details, location, type of business and message. This data is stored in NADIGRA's enquiry database with Cloudflare (EU), and attachments in private storage. An unfinished taxi application draft is deleted after 30 days.

When the website loads, technical infrastructure providers process information needed to deliver and protect it, such as your IP address, request time and browser information. If you accept analytics, a browser identifier, pages visited, referral sources, visit duration and device information are also processed.

Do not send passwords, payment card details, health information or other sensitive details unnecessary for your enquiry. This website has no checkout or visitor account registration.

We protect the form with Cloudflare Turnstile in your browser, without a user account on our site. To limit abuse, we process the verification token, email address and enquiry content in line with Cloudflare's privacy terms. This protection does not add visitor tracking for advertising.

Why do we use it, and on what basis?

We answer your request and prepare a proposal to take steps at your request before entering a contract (GDPR Article 6(1)(b)). For general business enquiries and communication with company representatives, we rely on our legitimate interest in responding to requested business communication (Article 6(1)(f)).

Website security, preventing abuse and resolving technical issues rely on our legitimate interest in a reliable service (Article 6(1)(f)). If we work together, necessary data is processed to perform the contract (Article 6(1)(b)) and meet applicable legal obligations, such as accounting requirements (Article 6(1)(c)).

Optional analytics and ad measurement rely on your consent (Article 6(1)(a)). Continuing to browse is not consent. You can contact us after rejecting analytics and advertising; we do not require marketing consent to handle an enquiry you request.

Cloudflare Web Analytics

With your consent, we use Cloudflare Web Analytics (Cloudflare, Inc.) to measure page views, referral sources, browser and device information, and page speed and visual stability. We load its script only after you accept analytics. We do not send contact form contents to this service.

Cloudflare Web Analytics does not set analytics cookies or our local analytics identifier. Cloudflare states that this analytics history is available for up to six months; it retains more detailed data for the latest seven days and aggregates older data. This history is separate from measurement of form actions.

You can withdraw consent in Cookie settings. This stops future transmission from your browser; previously sent data is not automatically deleted.

Google Analytics and Google Ads (only with consent)

If we enable the Google tag (Google Ireland Limited) on the website, it loads only after you accept analytics or advertising on the bar. We use Google Consent Mode v2 with all settings denied by default: without your consent the Google script is not loaded.

With analytics consent, Google measures visits and actions on the website. With advertising consent, we measure whether a visit came from a Google ad and whether an enquiry or contact followed (a conversion), and the data may also be used for ad personalisation. We do not send form contents to Google, only the fact that an action took place (for example a submitted enquiry or a click on phone, WhatsApp or email).

Google may process data outside the EEA. Read more in Google's privacy policy (policies.google.com/privacy) and in its explanation of how Google uses information from partner sites (policies.google.com/technologies/partner-sites). You can withdraw consent in Cookie settings in the footer.

Who may receive your data?

NADIGRA manages the website and enquiries. Access to data is limited to authorised people handling your enquiry and contracted technical infrastructure providers for hosting, database storage, security and technical functions, analytics and advertising providers (Google) with your consent, and email delivery and mailbox providers. Your enquiry is automatically forwarded to our business mailbox.

During an agreed engagement, accounting or other professional providers may receive necessary data, and competent authorities may receive it where legally required. We do not sell form submissions or automatically subscribe you to a newsletter.

Technical providers process data as part of the contracted service. For information about the specific recipients of your data, their roles and safeguards, contact info@nadigra.com.

Is data processed outside the EEA?

Our contracted technical infrastructure providers and their subprocessors may process data outside the European Economic Area. Data processing agreements provide for applicable transfer mechanisms, such as adequacy decisions or the European Commission's standard contractual clauses. We do not claim that all processing takes place exclusively within the EU.

For information about safeguards applying to your data and how to obtain a copy, contact info@nadigra.com.

How long do we keep it?

We retain enquiry details while handling the enquiry, preparing a proposal and conducting related communication. After an enquiry closes, further retention is limited to information needed for the agreed engagement, a specific legal obligation or establishing, exercising or defending legal claims. The period depends on that obligation or proceeding; possible future marketing alone is not a reason to retain an enquiry.

Contract and accounting records are retained for the periods required by applicable law. Technical logs and backups have separate hosting-provider retention periods; relevant records may be kept until a specific security incident is resolved.

Your cookie choice lasts 180 days. When you withdraw consent, Google cookies on this domain are removed from your browser. This does not retroactively erase data already sent. Contact info@nadigra.com for the retention period of a particular record or a deletion request.

What are your rights?

Depending on the legal basis and applicable conditions, you may request access and a copy, correction, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation.

Withdraw analytics and advertising consent in Cookie settings in the footer. Withdrawal does not affect the lawfulness of earlier processing. Send other requests to info@nadigra.com. To protect your information, we may ask for proportionate identity verification.

We respond without undue delay, normally within one month. If the complexity or number of requests requires an extension, we will explain why within that month; the extension may be up to two further months.

You may complain to the Croatian Personal Data Protection Agency (AZOP) or the competent supervisory authority in the country of your habitual residence, workplace or alleged infringement. You do not have to contact us first.

Do you have to provide data?

Browsing public content does not require an enquiry or acceptance of analytics or advertising. Required fields in forms are marked; a form cannot be submitted without them. Optional fields can stay blank. We may later request information necessary for a contract or legal obligations.

People handle enquiries and proposals. We do not make decisions on this website solely through automated processing that produce legal or similarly significant effects.

WhatsApp and external links

WhatsApp opens only when you click its link. Further communication takes place within that service and is also subject to its privacy terms. You can use our form or email instead.

We load advertising tags (Google) only with consent, as described above. We do not use external chat or session recordings. Fonts are served from our website; your browser does not connect to Google Fonts to load them.

Changes to this policy

If purposes, providers or processing change, we will update this page. We will ask for a new choice before enabling new optional purposes. The date above identifies this policy version.