Who is responsible for your data?

Misto d.o.o. is the data controller for personal data processed in connection with this website, direct enquiries and direct bookings.

Address: Kamenar 20, 22202 Primošten, Croatia
Email: ivan@misto.hr

---

What we collect

Depending on how you contact or book with us, we may collect:

• your name, email address, telephone number and postal address;
• arrival and departure dates, selected house, number and ages of guests and booking preferences;
• messages, requests and other information you choose to provide;
• booking, invoice and payment-related information;
• identification and stay details required for statutory guest registration;
• technical information such as IP address, browser data and server logs when you use the website or booking service.

Why we use it

We use personal data to answer enquiries, prepare offers, manage and fulfil bookings, process payments, communicate before and during a stay, issue invoices and meet Croatian tax, accounting and guest-registration obligations.

The legal basis is normally taking steps at your request before a booking, performing our agreement with you, complying with legal obligations, or our legitimate interest in operating and protecting the website and accommodation business. Where consent is required—for example for optional analytics or marketing—we will ask for it separately.

Who receives it

We share data only where needed to provide the service or comply with the law. Recipients may include:

• Beds24, which provides our booking engine and property-management system;
• our payment service provider, such as Stripe, when you pay online;
• website hosting, email and technical service providers;
• accounting and professional advisers where necessary;
• Croatian authorities and the eVisitor guest-registration system where required by law;
• a booking platform such as Airbnb or Booking.com when your reservation originated there.

These providers process only the information needed for their role and are subject to their own legal and contractual data-protection obligations.

How long we keep it

Unsuccessful enquiries are normally deleted or anonymised within 12 months. Booking, invoice, payment and statutory registration records are kept for the periods required by Croatian tax, accounting and tourism laws. Other correspondence is kept only while it is reasonably needed for the booking, customer service or the establishment, exercise or defence of legal claims.

Cookies and website services

The website and Beds24 booking service may use cookies or similar storage that is necessary for security, availability searches and the booking process. Optional analytics or marketing cookies will be used only after consent where the law requires it. You can change or withdraw your cookie choices through the cookie settings available on the website.

Links to Google Maps, Facebook and Instagram take you to external websites. Their own privacy policies apply after you open those services.

Your rights

Subject to the conditions in the GDPR, you may request access to your personal data, correction, deletion, restriction of processing or data portability, and you may object to certain processing. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.

To exercise a right, email ivan@misto.hr. We may need to confirm your identity before completing the request. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr.

Security and updates

We use reasonable technical and organisational measures to protect personal data. No internet service can guarantee absolute security, but access is limited to people and providers who need the information for the purposes described above.

We may update this policy when the website, booking process or legal requirements change. The current version and update date will always be shown on this page.