Privacy Policy

Controller and contact

Edi Ferjan, private accommodation provider trading as Mravilla

Edi Ferjan is the controller for personal data used to answer enquiries and arrange your stay. Contact and property address: Braće Radića 10, 21209 Mravince, Solin, Croatia. Email: info@mravilla.com. Phone: +385 97 780 8361. This address is not described as a registered residence.

This notice explains the purposes and legal bases for processing. Browsing this website is not blanket consent to processing.

Enquiries and booking arrangements

We process your enquiry and communicate with you to take steps at your request before entering a booking contract (GDPR Article 6(1)(b)). Once a booking is agreed, we use necessary details to fulfil the contract, coordinate arrival, provide support and handle agreed payments or refunds on the same basis. We do not use enquiries for marketing.

When available, the enquiry form requests arrival and departure dates, adult and child counts, pets and pet count where relevant, name and email. Phone and message or special requests are optional. Please do not include identity documents, card details or unnecessary sensitive information in your message. There is no card payment or identity-document upload on this website.

Form delivery and technical safeguards

When the secure enquiry form is available, enquiries are forwarded only to info@mravilla.com through Lovable’s email delivery service; the host mailbox holds accepted enquiries. If the form is unavailable, please contact us via WhatsApp or email. No automatic guest or marketing emails are sent.

The website does not save enquiry contents in a database or log their contents. Necessary temporary processing validates input and prepares the message. For abuse prevention, the server temporarily holds an IP address and request timestamps, and a submission identifier after an accepted send. These limited safeguards are based on our legitimate interest in protecting the enquiry service (GDPR Article 6(1)(f)), not on marketing or profiling. Hosting services may also process technical access and error data under their applicable terms.

Legal guest and accounting records

If you book, necessary guest identification and stay details may be collected separately for legally required guest registration, including eVisitor where applicable, and tax or accounting records. Processing required by law is based on GDPR Article 6(1)(c). These are host obligations, not guest-registration or accounting systems implemented by this website. We do not collect identity documents through the enquiry form. Written complaints and their responses are retained for at least one year as required.

Service providers and recipients

Lovable provides website hosting and associated technical services. Hosting suppliers process technical data to operate and protect the site; their precise contractual roles, processing locations and applicable processing terms must be confirmed by the host before launch. Public privacy information is available at https://lovable.dev/privacy.

Lovable provides the enquiry email delivery service using the verified sender notify.mravilla.com. Necessary enquiry data is processed to deliver the email to the host mailbox at info@mravilla.com. The host must confirm the sending service and mailbox provider’s contractual roles, terms, data locations and retention, and update this notice as needed.

Only necessary details are shared with authorities where required by law or with a separately agreed service provider where needed to arrange your requested service. We do not sell personal data. Google and WhatsApp process data for their own services under their policies when you choose to use them; this notice does not describe them as our contracted processors without an applicable agreement.

Google Maps and your choice

The Contact page shows a map placeholder, not a Google iframe, until you choose. “Show map” loads Google Maps once; “Always show map” loads it and remembers your consent on this device so the map then loads automatically on later visits. Google may receive your IP address, browser information and other technical data and may set or read cookies under https://policies.google.com/privacy. The map does not request your geolocation.

You can decline by simply not loading the map, use the written address or open Google Maps externally instead. “Hide map” removes the iframe and deletes the remembered choice from this browser. This does not erase cookies or data already received by Google. The only item stored is the map choice itself (in local storage, key mravilla.consent.googleMaps), and only after you select “Always show map”.

Spam protection (Cloudflare Turnstile)

When the enquiry form is active, a Cloudflare Turnstile security check protects it against automated abuse. Its script loads only after you start filling in the form. Cloudflare processes technical data such as your IP address and browser signals to decide whether the request is automated, under https://www.cloudflare.com/turnstile-privacy-policy/ and https://www.cloudflare.com/privacypolicy/. The resulting single-use token is checked by our server before any email is sent. This is based on our legitimate interest in protecting the enquiry service (GDPR Article 6(1)(f)) and is necessary to provide the form securely; you can always contact us via WhatsApp or email instead.

WhatsApp and other external links

WhatsApp enquiry links open an external service only when selected. Messages you send there are processed under WhatsApp’s own terms and privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea. We use messages to answer your request and arrange a potential booking, not to enrol you in marketing. External websites have their own data practices; an external link is an alternative to loading the embedded map.

International processing

Hosting, email or optional third-party services may process data outside the European Economic Area. We do not promise EU-only processing. Where we engage a processor and a transfer requires safeguards, the applicable arrangement must provide a lawful mechanism, such as an adequacy decision or appropriate contractual safeguards. The host must confirm the actual arrangements with hosting and future email suppliers before launch or activation. Google, WhatsApp and Lovable describe their processing and transfer arrangements in their linked policies; contact us for information about safeguards applicable to your data.

Retention and deletion

Enquiry correspondence is kept until your request is resolved and for no longer than necessary for a resulting booking, follow-up or a justified legal claim. The host reviews it and deletes it without undue delay once it is no longer needed; no arbitrary fixed period is promised for unbooked enquiries. Booking, guest-registration, accounting and complaint records are retained for the applicable statutory periods, and necessary dispute records for as long as justified.

Anti-abuse information is temporary and kept separately from enquiry contents. Browser form fields remain on the page after an error so you can correct or retry; the application does not save them to persistent browser storage. Email suppliers may retain technical delivery records under their terms once sending is activated.

Your rights and complaints

Contact info@mravilla.com to request access, rectification, erasure, restriction, portability or to object to processing, where the relevant right applies. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. The map choice can be withdrawn directly on the Contact page with “Hide map”.

We normally respond within one month of receiving a rights request. GDPR Article 12 allows an extension of up to two further months for complex or numerous requests; if needed we explain the reason within the first month. We may need proportionate verification of your identity. Erasure is not absolute where statutory retention or another lawful exception applies.

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP): https://azop.hr/ . Its official rights-complaint guidance and submission information are at https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava-2/ . You may also contact the supervisory authority competent for your situation.

Cookies, fonts and security

The site uses locally hosted Outfit and Manrope fonts, rather than requesting Google Fonts. No advertising, analytics or marketing tracker is added by the application. This is not a guarantee that hosting infrastructure or optional external services never use cookies or technical logs; their actual practices and contractual settings must be confirmed before launch. Optional Google Maps stays blocked until your choice; the only optional browser storage is the remembered map choice described above.

We use input validation, limited anti-abuse checks and fixed email destinations. No internet transmission is risk-free. Hosting diagnostics are intended for technical errors, not enquiry contents. Please contact us if you have a concern.

Notice updates

We update this notice when processing arrangements change, particularly before email delivery is activated. Contact Edi Ferjan using the details above for questions about this notice or the handling of your data.