Hrvatska verzija

Privacy Policy

Last updated: 30 October 2026

This Privacy Policy explains how we collect and use your personal data when you visit www.zagrebwalkingtours.com, contact us or book a tour, and what rights you have. We process personal data in line with the EU General Data Protection Regulation (GDPR) and Croatian law.

1. Who we are

The controller responsible for your personal data is:

LOREA, obrt za putničku agenciju, trading as Zagreb Walking Tours
Owner: Marko Miloš
Palmotićeva 10, 20000 Dubrovnik, Croatia
OIB: 12417479914
Email: info@zagrebwalkingtours.com
Phone: +385 97 681 3112

For any question about your personal data, or to exercise your rights, write to info@zagrebwalkingtours.com. We have not appointed a Data Protection Officer, as this is not required for a business of our size.

2. What data we collect and why

Enquiry and reservation forms

When you use the contact form, the corporate enquiry form or the tour reservation form, we collect your name, email address and message, and where relevant the subject, company name, group size and the tour you are interested in.

• Purpose: to answer your enquiry and, if you wish, arrange a tour.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to messages (Art. 6(1)(f) GDPR).

Your message is sent to us by email through our own email provider. It is not stored on the website.

Bookings and payment

When you book a tour, through the booking calendar or after an enquiry, we process the details needed to organise it: your name, contact details, tour date, number of participants and any information you choose to give us. After we confirm your booking, we send you a secure payment link by email.

• Payments are processed by our licensed payment provider Monri Payments d.o.o. (Zagreb, Croatia). You enter your card details directly on Monri’s secure payment page; we never see or store your full card details.
• Purpose: to perform the tour contract, take payment and issue invoices.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legal obligations under Croatian accounting and tax law (Art. 6(1)(c) GDPR).

On the day of your tour

We use the phone number you gave us to reach you on the day of the tour, for example if you are late at the meeting point. We may contact you by phone or WhatsApp (provided by WhatsApp Ireland Limited).

• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Photos taken on tours

Your guide may take photos of your group and send them to you. We use photos in which you can be identified on our website or social media only with your separate consent, which we ask for on the day or by email. Booking a tour does not count as consent.

• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing us, and we will remove the photos from our channels.

Spam protection (Google reCAPTCHA)

Our forms are protected by Google reCAPTCHA v3, which checks that a form is sent by a person and not an automated program. To do this, it analyses technical information such as your IP address, browser and device details, and how you interact with the page. reCAPTCHA loads only when you start filling in one of our forms.

• Legal basis: our legitimate interest in protecting the website and our inbox from spam and abuse (Art. 6(1)(f) GDPR). The technical storage involved is strictly necessary to provide the form you are using.
• Google processes this data as our processor and may not use it for other purposes such as advertising.

Website visits and analytics (Google Analytics)

Only if you click “Accept” in our cookie banner, we use Google Analytics 4 to understand how visitors use the website: for example which pages are visited, how visitors found us, their approximate location (country/city), device and browser. Google Analytics does not store full IP addresses for users in the EU, and we have turned off its advertising features.

• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via Cookie settings at the bottom of every page.
• Analytics data is kept for up to 14 months.

Map (Google Maps)

The meeting-point map on our homepage is provided by Google Maps, which sets Google cookies. The map loads only if you accept cookies or click “Show map”.

• Legal basis: your consent (Art. 6(1)(a) GDPR).

Server and security logs

When you visit the website, our hosting provider automatically processes technical data such as your IP address, date and time of the request, the page requested and your browser type. This is necessary to deliver the website securely.

• Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

Newsletter and marketing emails

We do not currently send newsletters. If we offer one in the future, we will only send you marketing emails if you sign up and give your explicit consent (Art. 6(1)(a) GDPR). You will be able to unsubscribe at any time with one click, and we will never add you to a mailing list just because you made an enquiry or booking.

3. Cookies

Cookies are small text files stored on your device. We use as few as possible.

You can change your choice at any time via Cookie settings at the bottom of every page. If you change from “Accept” to “Reject”, we delete the Google Analytics cookies. You can also delete or block cookies in your browser settings.

4. Who receives your data

We share your data only as far as needed for the purposes above:

• Our team: the owner and our tour guides see reservation details needed to run your tour. Everyone with access is bound by confidentiality.
• EXTREME HOSTING d.o.o. (xHosting), Varaždinska 16A, Sesvete, Zagreb, Croatia: email hosting. Form messages and email correspondence are stored in our mailbox.
• Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA: website hosting and the function that sends our form messages.
• Google (Google Ireland Limited and Google Cloud EMEA Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with their affiliate Google LLC, USA): reCAPTCHA (spam protection), Google Analytics (only with consent) and Google Maps (only with consent).
• Experience Solutions d.o.o. (Expiriento / EZ Booker), Strojarska cesta 20, 10000 Zagreb, Croatia: our online booking calendar and booking system.
• Monri Payments d.o.o., Ulica grada Vukovara 269D, Zagreb, Croatia: card payments.
• WhatsApp Ireland Limited, if we contact you via WhatsApp on the day of your tour.
• Our accountant and public authorities, where required by law (for example tax records).

Our service providers act on our behalf under data processing agreements, except Monri Payments, which as a licensed payment institution is also independently responsible for payment data under financial regulations. We never sell your personal data.

5. Transfers outside the EU

Some providers (Netlify, Google and, if used, WhatsApp/Meta) are based in the United States or may process data there. These transfers are protected by the EU–U.S. Data Privacy Framework, under which both companies are certified, and/or the European Commission’s Standard Contractual Clauses (Art. 45 and Art. 46 GDPR).

6. How long we keep your data

• Enquiries that do not lead to a booking: up to 2 years after our last contact, then deleted.
• Booking, payment and invoice records: as long as Croatian accounting and tax laws require (currently up to 11 years for accounting documents).
• Analytics data: up to 14 months.
• Photos used with your consent: until you withdraw your consent.
• Your cookie choice: 6 months, after which we ask again.
• Server logs: a short period as set by our hosting providers, for security purposes.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• rectification of inaccurate data;
• erasure (“right to be forgotten”), unless we must keep the data by law;
• restriction of processing;
• data portability, for data you gave us under a contract or consent;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing before withdrawal (for cookies: via Cookie settings).

To exercise any of these rights, email info@zagrebwalkingtours.com. We will reply within one month. We may ask you to confirm your identity.

You also have the right to lodge a complaint with the Croatian supervisory authority:

Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136, 10000 Zagreb, Croatia
azop.hr

We would, however, appreciate the chance to deal with your concerns first.

8. Children

Our tours are for participants aged 12 and over. Bookings and enquiries should be made by an adult. We do not knowingly collect personal data directly from children. If you believe a child has sent us personal data, please contact us and we will delete it.

9. Security

We protect your data with appropriate technical and organisational measures: the whole website is served over encrypted HTTPS, form messages are sent over encrypted connections, access to booking data is limited to people who need it, and card payments are handled entirely by Monri on its secure, certified payment page.

10. Changes to this policy

We may update this Privacy Policy when our services or the law change. The current version is always on this page, with the date of the last update at the top.

This policy is also available in Croatian (Politika privatnosti).