Your data

Privacy Policy

last updated on: OCTOBER 2026

This policy explains how Villa Kara Sevda processes personal data when you visit https://villakarasevda.com, send us an enquiry, book the villa or contact us by WhatsApp, email or phone. We process personal data in line with the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Simona Baškovič
Private renter (natural person) – iznajmljivač, fizička osoba
OIB: HR87590564505
Bizeljska cesta 49F, SI-8250 Brežice, Slovenia
Phone: +386 51 685 030
Email: info@villakarasevda.com

2. What data we collect and why

Booking requests and contact forms – name, email, phone number, number of adults and children, dates, language, messages and special requests. We use them to answer you, prepare an offer and manage your booking (performance of a contract, Art. 6(1)(b) GDPR).
Bookings made by WhatsApp, email or phone – the same details, entered into our booking system by the owner or staff so that we can confirm your stay by email.
Payments – amounts, dates and payment method of the deposit and balance. We keep these records to meet accounting and tax obligations (legal obligation, Art. 6(1)(c) GDPR).
Guest registration – identity details required by Croatian law to register your stay with the local authorities (legal obligation).
Booking emails – confirmations, payment receipts, cancellations and sign-in links are sent from notify.villakarasevda.com.
Website statistics – anonymous counts of which pages were visited and how the visit arrived (search engine, social post or direct link). We store only the day, the page, the domain of the site that referred the visit and whether the visit started here. We use no cookies for this, we do not record IP addresses, and a count cannot be traced back to you. It helps us understand which pages guests find useful (legitimate interest, Art. 6(1)(f) GDPR).

eVisitor. Croatian law requires every guest to be registered in the national eVisitor system of the Croatian tourist boards. For this we enter your name, date of birth, nationality and identity card or passport details into eVisitor (legal obligation, Art. 6(1)(c) GDPR).

3. My booking (guest area)

To let you view and manage your booking, we email you a one-time sign-in link. It can be used only once and expires after 30 minutes (links included in booking emails expire after 7 days). We store only a scrambled (hashed) copy of each link, never the link itself. After you sign in, a strictly necessary cookie keeps you signed in on that device for up to 24 hours; signing out removes it. The guest area shows only the bookings made with your verified email address. Changes you make there (for example your phone number, special requests or cancelling an unconfirmed request) are recorded in your booking history.

4. AI assistance for our staff

When you book with us by WhatsApp or email, an administrator may paste the conversation into an AI tool inside our booking system. The tool suggests a draft with your dates, contact details and preferences. The pasted conversation is sent to our AI provider only to create that draft and is not stored in our system. A person always checks and corrects the draft before any booking is created. No decisions about you are made automatically (Art. 22 GDPR). Legal basis: our legitimate interest in handling enquiries accurately and quickly (Art. 6(1)(f) GDPR).

5. Calendar synchronisation

To avoid double bookings we exchange availability calendars with booking portals. Only the booked dates are shared – never names or other guest details.

6. Who receives your data

We share personal data only as far as necessary with: our website hosting and database provider; our email delivery provider; our AI provider (see section 4); banks and card payment providers that process your payments; accountants; and public authorities where the law requires it (for example guest registration). These providers process data on our behalf under data processing agreements. Where data is transferred outside the EEA, appropriate safeguards such as the EU Standard Contractual Clauses are in place. We never sell your data.

7. How long we keep data

Enquiries that do not lead to a booking are deleted within 12 months. Booking and payment records are kept as long as accounting and tax law requires (in general up to 11 years). Sign-in links expire after the times stated above and sign-in sessions after 24 hours.

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to data portability. To use these rights, write to info@villakarasevda.com. You also have the right to lodge a complaint with a data protection authority, for example the Croatian Personal Data Protection Agency (AZOP) or the Information Commissioner of the Republic of Slovenia.

9. Security

All connections to the website are encrypted (HTTPS). Access to the booking system is limited to the owner and authorised staff with personal logins.

10. Cookies

Please see our Cookie Policy.

11. Changes

We may update this policy when our services change. The current version is always published on this page.