Slavina VrelaAPARTMENTS

Privacy

This English version is a translation for your convenience; only the German version is legally binding.

Controller

The controller responsible for processing your data on this website is:
Slavina Vrela Apartments, Gornji Orašac BB, 70210 Dobretići, Bosnia and Herzegovina
E-mail: slavinavrela@gmx.de

You will find the full provider details in our legal notice. We have not currently appointed a representative in the EU under Art. 27 GDPR; please contact us directly.

Visiting the website

To deliver a page to you, our server necessarily processes your IP address, the date and time, the address requested and the information your browser sends automatically (for example browser type, language and the page you came from). We do not keep a log of all page views. Only when a technical error occurs, such as an interrupted connection, does the web server in front of the site record these details in an error log, which we use solely to find faults and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. The connection is encrypted via HTTPS. We use no analytics, tracking or advertising services and no social media plugins; fonts and images come from our own domain.

Cookies

When you visit our pages, we set no cookies and store nothing else in your browser’s storage (such as local storage). Only if you change the language with the language switcher does your browser create the cookie “NEXT_LOCALE”, which holds nothing but the chosen language code for one year (Section 25(2) no. 2 of the German TDDDG). The password-protected admin area uses a login cookie for administrators only.

Enquiry form

When you send us a non-binding enquiry with the form, we process your name, your e-mail address and, if you provide them, your phone number, the accommodation, your travel dates, the number of adults and children and your message, as well as the language of the page. Name, e-mail address and either travel dates or a message are required; without them the enquiry can be neither sent nor answered. All other details are voluntary; there is no legal or contractual obligation to provide any data.

The purpose is to answer your enquiry and, where applicable, to prepare a booking. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) or, for general questions, Art. 6(1)(f) GDPR, based on our legitimate interest in answering enquiries. We do not ask for your consent. You receive an automatic confirmation and we receive a notification, both by e-mail; every e-mail is stored with its recipient address and content in a delivery log so that we can check delivery (Art. 6(1)(f) GDPR).

To protect against spam, we store with each enquiry, instead of your IP address, only a hash value (a kind of checksum) calculated from it with a secret additional value, a hash value of your browser identification formed in the same way, and the time taken to fill in the form. With these we limit the number of enquiries per hour and per day and, together with a hidden form field, recognise automated submissions, which are not forwarded but stored with a spam flag. We also store the version of the privacy notice beside the form that applied when you sent it, so that we can show how we informed you. The legal basis in each case is Art. 6(1)(f) GDPR (legitimate interest: spam protection without cookies or third-party services, and proof that we met our information duties).

Contact by e-mail, phone or WhatsApp

If you write to us or call us directly, we process your details to answer you (Art. 6(1)(b) or (f) GDPR); for messages sent via WhatsApp, WhatsApp’s privacy policy also applies.

Map (Google Maps)

On the “Getting here” and “Contact” pages you first see only a placeholder image. Google Maps is embedded only after you click “Load map” (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google then receives your IP address and technical details of your browser, may store or read information on your device and may transfer data to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The map is loaded for the current page view only; you withdraw your consent for the future by not loading the map again and deleting cookies set by Google in your browser.

Links to other providers

Links, for example to Airbnb, Booking.com, Instagram, TikTok, Linktree, WhatsApp, Google Maps or places to visit, connect only when you click them; from then on the provider concerned is responsible.

Recipients and processors

We use the following processors:

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: server, database, backups and object storage for the images, in the Nuremberg data centre.
  • 1&1 Mail & Media GmbH (GMX), Brauerstraße 48, 76135 Karlsruhe, Germany: our e-mail mailbox and the sending of the e-mails about your enquiry.

The website is looked after technically by an IT service provider with access to the server, who uses the hosting management platform Sproobo (cp.sproobo.com); its control server is also located in a Hetzner data centre in Nuremberg. Beyond this, we do not pass your data on to third parties and do not use it for advertising.

Transfer to Bosnia and Herzegovina

We are based in Bosnia and Herzegovina and also access your enquiry and your e-mails from there. There is no adequacy decision of the European Commission for this third country outside the EU and the EEA, so the level of data protection may be lower than in the EU. The transfer is based on Art. 49(1)(b) GDPR because it is necessary for the pre-contractual measures you initiate with your enquiry.

How long we keep your data

  • We delete unanswered and declined enquiries six months after receipt.
  • We anonymise answered and booked enquiries 24 months after receipt: name, e-mail address, phone number, message, internal notes and hash values are removed; only details without personal reference, such as the period, accommodation, number of guests and status, remain for statistics.
  • We delete submissions recognised as spam after 30 days.
  • In the delivery log we remove the recipient address and content after twelve months.

Deletion and anonymisation run automatically. So that we can restore the website after a failure, the database is backed up every night on the same server (Art. 6(1)(f) GDPR); the backups also contain enquiries and are deleted in a 14-day rotation, so deleted data may remain in them until then. We delete e-mails in our mailbox and direct messages as soon as we no longer need them for your enquiry or a booking.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 18 and 20 GDPR), and you can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). An informal message to slavinavrela@gmx.de is enough.

Right to object: Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). No automated decision-making, including profiling (Art. 22 GDPR), takes place.

Last updated: September 2026