1. Controller

The controller responsible for this website is:

Xplore, Olga Grubesic, obrt
Ul. Andrije Kacica Miosica 20D, 23000 Zadar, Croatia
OIB: 84940350729
Email: travel@zdxplr.com
Phone: +385 91 151 4111

2. What this policy covers

This Privacy Policy explains how Xplore Travel processes personal data when you visit travel.zdxplr.com, send a travel inquiry, contact us by email, contact form or WhatsApp, or communicate with us about tours, houses, apartments or travel-related services in the Zadar region.

3. Personal data we process

Depending on your inquiry, we may process:

• name and surname
• email address
• phone number and WhatsApp contact details
• country of residence or travel origin if provided
• preferred dates, number of guests and travel preferences
• tour, house or apartment inquiry details
• message content and communication history
• technical website data such as IP address, browser type, device information, pages visited and time of access
• security and anti-spam data processed through Google reCAPTCHA, such as IP address, device and browser information, interaction patterns, referrer URL, date and time of access and risk assessment information
• cookie consent preferences

4. Purposes and legal bases

We process personal data for the following purposes:

• Responding to travel inquiries: to answer questions, check availability and prepare proposals. Legal basis: steps prior to entering into a contract or legitimate interest.
• Organizing own tours: to arrange tour dates, logistics, communication and service delivery after confirmation. Legal basis: contract.
• Accommodation inquiries: to communicate with third-party accommodation partners when needed to answer or arrange an inquiry. Legal basis: steps prior to entering into a contract, contract or legitimate interest.
• Customer communication: to provide updates, support and service-related messages. Legal basis: contract or legitimate interest.
• Website security and operation: to operate WordPress, prevent abuse, protect forms against spam and automated misuse, and keep the website available. Legal basis: legitimate interest.
• Legal and accounting duties: to comply with Croatian and EU legal obligations where applicable. Legal basis: legal obligation.
• Optional marketing: only if you request it or consent to it. Legal basis: consent.

5. Contact forms, email and WhatsApp

If you contact us through a form, by email or via WhatsApp, we process the data you provide to respond to your inquiry. WhatsApp is operated by Meta Platforms and may process data according to its own terms and privacy policy. Please do not send sensitive information through WhatsApp unless necessary.

6. Accommodation partners

Houses and apartments shown or discussed through Xplore Travel may belong to third-party partners. When necessary to respond to or arrange an accommodation inquiry, we may share relevant inquiry details with the relevant partner, such as name, dates, guest count and contact details. We do not share more data than necessary for the inquiry.

7. Website technology and third-party services

The website is built with WordPress and may use WordPress plugins for forms, security, display, cookie consent and website functionality. Based on the current public website, the site may load services or assets related to WordPress, Elementor, JetEngine, Contact Form 7, Hostinger Reach, Slider Revolution, Google Fonts, Google reCAPTCHA and related theme/page-builder plugins.

If analytics, marketing pixels, newsletter tools, map embeds, booking tools, payment tools or additional third-party services are added later, this Privacy Policy and the cookie settings must be updated before or at the time those tools are activated.

8. Google reCAPTCHA

We use Google reCAPTCHA on website forms to protect the website against spam, automated submissions and misuse. reCAPTCHA analyzes technical and interaction-related information in order to distinguish human users from automated systems.

The data processed by reCAPTCHA may include IP address, browser and device information, operating system, referrer URL, date and time of access, cookies, mouse movements, keyboard or touch interactions and other usage signals needed for security assessment. This information may be transmitted to Google and processed by Google for security and anti-abuse purposes.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where data is transferred to Google entities outside the European Economic Area, Google relies on applicable transfer safeguards. Further information is available in Google’s Privacy Policy and Terms: https://policies.google.com/privacy and https://policies.google.com/terms.

Legal basis: our legitimate interest in protecting website forms, preventing abuse and maintaining website security. If your cookie consent tool classifies reCAPTCHA as a service requiring consent in your configuration, reCAPTCHA should be blocked until consent is given.

9. Cookies

The website uses cookies and similar technologies. Some cookies are necessary for website functionality, security and cookie consent management. Google reCAPTCHA may also use cookies or similar technologies for security and anti-abuse checks. Optional analytics or marketing cookies should only be used after consent where legally required. You can manage cookies through the website cookie banner where available and through your browser settings.

10. Recipients of personal data

Personal data may be shared with:

• hosting and website infrastructure providers
• email and communication providers
• IT, website maintenance and security providers
• Google, where Google reCAPTCHA is used for form security and spam prevention
• accommodation or travel partners where necessary for a specific inquiry
• professional advisers such as accounting or legal advisers where necessary
• public authorities where legally required

We do not sell personal data.

11. International transfers

Some service providers may process data outside Croatia or outside the European Economic Area. This may include Google where Google reCAPTCHA is used. Where required, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms.

12. Retention

Travel inquiry data is kept for as long as needed to respond, arrange the requested service and manage possible follow-up communication, normally up to 24 months unless a longer period is necessary. Confirmed service and accounting records are kept for the period required by applicable Croatian law. Technical logs and cookie consent records are kept for a limited period necessary for security, compliance and website operation.

13. Your rights

Under the GDPR, you may have the right to request access, correction, deletion, restriction, portability, objection to processing and withdrawal of consent where processing is based on consent. To exercise your rights, contact us at travel@zdxplr.com.

14. Supervisory authority

You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP): https://azop.hr/.

15. Changes

We may update this Privacy Policy from time to time. The updated version will be published on this page.