Privacy Policy

1. Data controller

The controller of your personal data is Play Digital d.o.o., OIB (Croatian company ID) [OIB], Zagrebačka 6A, 52000 Pazin. For any privacy question, write to info@heycroatia.com.

The same company develops Apartmanica 2, the system hosts use to manage their accommodation, prices, calendar and bookings. Listings on HeyCroatia come from Apartmanica 2, and your inquiries and bookings reach the host through it.

2. What data we collect

For inquiries and bookings: your first and last name, email address, phone number, country, your message to the host, the dates of your stay and the number of guests.

For verification: the email address or phone number we send a one-time code to. If you sign in with Google (Google Identity Services), we only use your email address and name from Google. We do not access your contacts, files or any other data in your Google account.

In the inbox: the messages you exchange with the host, and price offers and counter-offers.

Technical data: IP address, browser type and referring page, in server logs and in click statistics for listings.

3. Why we use it and on what legal basis

We use the data from your inquiry or booking to forward it to the host and to let you exchange messages with them. This is necessary to take steps before entering into, and to perform, the accommodation contract (Art. 6(1)(b) GDPR).

We use email or phone verification, technical logs and click statistics to keep the portal secure, prevent fake inquiries and abuse, and improve the service. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

Some data must be kept to meet legal obligations (Art. 6(1)(c) GDPR). We do not sell your data and do not use it for advertising.

4. Who we share data with

The host of the accommodation you chose, through Apartmanica 2. For your stay, the host is a separate controller: they use your data for the booking, guest registration, payment and invoicing under their own rules and legal obligations.

Service providers working for us: server hosting, email delivery and delivery of SMS verification codes. They may use the data only to provide that service.

Google, only if you choose to sign in with your Google account. Public authorities only when the law explicitly requires it.

5. Cookies and browser storage

We only use strictly necessary cookies: a session cookie that keeps you signed in and protects forms against abuse (CSRF). It lasts while your session is active.

Saved listings (favorites) are stored only in your browser (localStorage) and are not sent to us.

We do not use advertising cookies, tracking pixels or third-party analytics. Google's sign-in script is loaded only on pages with the Google sign-in button, and Google then acts under its own privacy policy.

6. How long we keep data

Verification codes are valid for a short time and cannot be used afterwards. Inquiries, bookings and messages are kept while your conversation with the host is ongoing and as long as needed for legal obligations or possible disputes. Technical logs are kept for a shorter period.

Data received by the host is kept by the host under their own rules and the regulations that apply to renting accommodation.

7. Transfers outside the EU

We aim to process data within the European Economic Area. If a service provider (for example Google) processes data outside the EEA, this is done with the safeguards required by the GDPR.

8. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Send your request to info@heycroatia.com; we reply within one month at the latest.

If you believe your data protection rights have been violated, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or the supervisory authority in your country.

9. Changes

We may update this policy when the portal or the regulations change. The current version is always on this page, with the date of the last update.