1. Data Controller Identification
The data controller responsible for personal information processed through the Zestorysnnyb portal is:
Zestorysnnyb Brač Heritage Travel Media Ltd.
Company Registration Number: HR-89410928
Registered Address: Šetalište Anđelka Rabadana 14, 21420 Bol, Island of Brač, Republic of Croatia
Designated Data Protection Contact: [email protected]
2. Information Collection Principles
We operate under the data minimisation principle articulated in Article 5(1)(c) of Regulation (EU) 2016/679 (GDPR). We collect information exclusively when volunteered through direct interaction or strictly required for stable web delivery:
- Inquiry Data: When you complete our contact form, we collect your name, email address, topic selection, and the textual body of your message. The legal basis for this processing is Article 6(1)(b) GDPR (steps taken prior to or during contract/correspondence fulfillment) and Article 6(1)(f) (our legitimate interest in addressing inbound visitor communications).
- Technical Server Telemetry: When loading pages, our edge hosting nodes temporarily log the requesting internet protocol (IP) address, timestamp, requested URI, referrer, and user-agent string. These server logs are maintained strictly for network security and fault remediation under Article 6(1)(f) GDPR.
- Local Storage State: We store your cookie preference choice (`accepted` or `rejected`) inside your web browser’s local storage to prevent banner repetition on subsequent visits.
3. Third-Party Processors and Hosting Infrastructure
Zestorysnnyb does not sell, rent, or lease personal information to data brokers or advertising exchanges. Data may be processed on our behalf by audited service providers operating under written data processing agreements:
- Hosting & Edge Delivery: Secure web hosting infrastructure located within the European Economic Area (EEA), ensuring compliance with Chapter V GDPR transfer limitations.
- Transactional Email Relays: Standard cryptographic mail servers configured with SPF, DKIM, and TLS 1.3 to transmit inbound contact form notifications to our administrative desk.
4. Cookies and Analytical Trackers
We do not deploy intrusive third-party advertising cookies, fingerprinting pixels, or behavioral retargeting scripts. Any analytical metrics gathered are strictly aggregated and anonymized prior to storage. For an itemized catalogue of local cookies and browser management instructions, please consult our dedicated Cookie Policy.
5. Data Retention Periods
We retain personal data only as long as necessary to fulfill the specific purposes outlined herein:
- Contact Inquiries: Stored for a period not exceeding 18 months from the date of final resolution, after which communications are permanently scrubbed from our systems.
- Server Security Logs: Automatically rotated and permanently expunged on a rolling 30-day cycle.
- Cookie Banner Preferences: Maintained in local browser memory until cleared by the user or across a standard 365-day expiration interval.
6. Your Statutory Rights Under GDPR and CCPA
Residents of the European Union, European Economic Area, and California possess statutory rights regarding their personal records:
- Right of Access (Art. 15 GDPR): Request written confirmation of whether personal data is being processed, along with copies of collected records.
- Right to Rectification (Art. 16 GDPR): Request correction of imprecise or incomplete records.
- Right to Erasure (Art. 17 GDPR): Request permanent deletion of records when no prevailing legal obligation requires their retention.
- Right to Restriction and Objection (Art. 18 & 21 GDPR): Restrict processing or object to processing conducted under legitimate interests.
- Right to Data Portability (Art. 20 GDPR): Obtain your structured personal records in a commonly used machine-readable format.
- California Consumer Privacy Act (CCPA/CPRA): California visitors have the right to know what categories of data are collected and to opt out of any hypothetical sale of personal data. We do not sell consumer information.
To exercise any statutory privacy right, direct your signed request to [email protected]. We verify identity before fulfilling requests and respond within 30 days without imposing administrative fees.
7. Supervisory Authority
If you consider our processing of your personal data to infringe European data protection legislation, you maintain the right to lodge a formal complaint with the Croatian Personal Data Protection Agency (AZOP - Agencija za zaštitu osobnih podataka, Selska cesta 136, 10000 Zagreb, Croatia) or your domestic supervisory authority.