Last updated: 31 October 2026
This notice explains how we process personal data when you visit www.bellevuehotel.hr, contact us, book a stay or stay at Hotel Bellevue Šibenik. It is provided under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.
1. Who is responsible for your data
The controller is Riva sunca d.o.o., Obala hrvatske mornarice 1, 22000 Šibenik, Croatia, OIB 94337362035, which operates Hotel Bellevue (“we”, “us”).
Phone +385 22 646 400 · e-mail sales@bellevuehotel.hr
Data protection officer: Magda Lakoš-Mioč, manager@bellevuehotel.hr, +385 91 442 2007. Contact her with any question about your data or to exercise your rights.
2. What we process, why, on what legal basis and for how long
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answering enquiries sent through the contact form, by e-mail, phone or social networks | Name, e-mail, phone, your message; for booking enquiries the room, dates and number of guests; for the website form also the time and IP address of sending | Art. 6(1)(b) – steps you request before a contract; Art. 6(1)(f) – our legitimate interest in answering general questions | Website enquiries are deleted automatically 180 days after receipt. E-mail correspondence is kept as long as needed to handle your request and any resulting booking. |
| Job applications | Data in your application and CV | Art. 6(1)(b) – steps before an employment contract | 180 days after receipt, then deleted, unless you agree to a longer period for future vacancies |
| Online booking and booking management | Name, contact details, stay details, special requests, payment and guarantee details entered in the booking engine | Art. 6(1)(b) – performance of the contract | For the duration of the contractual relationship, then as required by accounting and tax law |
| Guest registration during your stay | Data from your identity document (name, date and place of birth, nationality, document number), address, dates of stay | Art. 6(1)(c) – legal obligations under Croatian tourism, tourist tax and foreigners legislation (registration through the eVisitor system) | For the periods prescribed by those regulations |
| Invoicing, payments and accounting | Name, address, company details, invoice and payment data | Art. 6(1)(c) – Accounting Act and tax regulations | 11 years from the end of the business year |
| Video surveillance of the hotel premises | Video images of persons in monitored areas | Art. 6(1)(f) – protection of persons and property, in line with the Croatian Act on the Implementation of the GDPR | No longer than 6 months, unless recordings are needed as evidence in proceedings |
| Operating and securing the website | IP address, browser and device information, time of access; a security cookie on the contact page | Art. 6(1)(f) – secure and reliable operation of the website and prevention of abuse | Server logs are kept by our hosting provider for a limited period for security purposes |
| Website statistics (Google Analytics) | Pseudonymous online identifiers, pages visited, device and browser data, approximate location | Art. 6(1)(a) – your consent through the cookie settings | Until you withdraw consent; statistics data in Google Analytics is kept for 14 months |
| Advertising measurement (Meta Pixel, Google Ads) | Pseudonymous online identifiers, pages visited, ad clicks and bookings | Art. 6(1)(a) – your consent through the cookie settings | Until you withdraw consent; cookie durations are listed in the Cookie policy |
| Proof of your cookie choices | Random consent identifier, your choices, date and time, a shortened one-way hash of the IP address | Art. 6(1)(c) in connection with Art. 7(1) GDPR – demonstrating consent | 24 months |
We do not send newsletters or promotional e-mails without your explicit consent. We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
Providing the data marked as required in our forms is necessary to answer your enquiry or make a booking. Providing guest registration data is a legal requirement; without it we cannot accommodate you.
3. Who receives your data
We do not sell personal data. Data is disclosed only where necessary to:
- Ego Media – website hosting and e-mail services (processor);
- Phobs – online booking engine (processor);
- accounting, IT maintenance and video surveillance maintenance service providers (processors);
- banks and card payment providers, to process payments and guarantees;
- Google Ireland Ltd (Google Analytics, Google Ads) and Meta Platforms Ireland Ltd (Meta Pixel) – only if you consent. For data collected with the Meta Pixel, we and Meta are joint controllers for the collection and transmission of the data;
- public authorities, where required by law – for example the eVisitor system, the Ministry of the Interior, the Tax Administration or courts.
All processors work under a data processing agreement and only on our instructions.
4. Transfers outside the European Economic Area
Google and Meta may process data in the United States. Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework of 10 July 2023 for certified companies, and on the Commission’s standard contractual clauses. Other data is processed within the EU/EEA.
5. Your rights
You have the right to:
- access your personal data and obtain a copy;
- have inaccurate data corrected;
- have your data erased when it is no longer needed or was processed unlawfully;
- restrict processing;
- receive data you provided in a portable format;
- object to processing based on our legitimate interest;
- withdraw consent at any time, without affecting processing before the withdrawal – for cookies, use Cookie settings.
Send requests to manager@bellevuehotel.hr or by post to our address. We reply without undue delay and within one month at the latest. We may ask you to confirm your identity.
You may lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, +385 1 4609 000, azop.hr.
6. How we protect your data
The website uses encrypted connections (HTTPS). Website enquiries are stored on protected servers and deleted automatically. Staff access to the content management system requires two-factor authentication and is logged. Stored secrets are encrypted. Only authorised staff can access personal data, and they are bound to confidentiality.
7. Children
Our website is not directed at children under 16. Bookings and registration of minors are made by their parents or guardians.
8. Changes to this notice
We update this notice when our processing changes. The date at the top shows the latest version. We will inform you of significant changes on this website.