Privacy policy

Updated 28 August 2026.

This policy explains which personal data we process when you visit this website, why we process it, how long we keep it and what rights you have. It is written in line with the General Data Protection Regulation (GDPR) and the Croatian act implementing it.

Data controller

The controller of personal data is Sconium d.o.o., Franjevački Square 17, 42000 Varaždin, Croatia, company ID (OIB) 09127769488, trading as P'alapassion. For any questions about the processing of personal data, write to info@palapassion.com.

What data we process

The site has no visitor accounts and no ordering system. We process only the following:

• Data from the contact form. When you send us a message we process your full name, e-mail address, phone number if you enter one, and the content of the message. The phone number is optional.
• Technical data about your visit. The server hosting the site records the IP address, the date and time of access, the browser and operating system, and the address of the requested page. These records are created automatically and serve the security and stability of the site.
• Data you send us directly. If you write to us by e-mail or call us, we process what you provide in that message - your name, contact details and the content of your enquiry.

Purposes and legal bases

• Replying to messages from the form and to enquiries - steps taken at your request before entering into a contract, and our legitimate interest in communicating with guests, Article 6(1)(b) and (f) GDPR.
• Displaying and securing the site - our legitimate interest under Article 6(1)(f) GDPR in keeping the site working correctly and protected from misuse.
• Remembering the language you chose, in the cookie "jezik" - our legitimate interest under Article 6(1)(f) GDPR in greeting you in the language you picked yourself. The cookie serves only a service you explicitly requested, so under the Croatian Electronic Communications Act it requires no consent.

Cookies

The site sets one functional cookie, and only once you switch the language in the header yourself. The locations map is drawn without cookies, so no third party sets any. Details are described in the Cookie policy.

Who else has access to the data

We do not sell personal data and do not pass it to third parties for their own purposes. In the course of providing their services, the following may access the data:

• Vercel Inc. (United States) - hosting and delivery of the site, and storage of photographs (privacy policy).
• Databricks, Inc. (United States), through the Neon service with servers in Frankfurt - the database holding the site content and the messages from the form (privacy policy).
• Resend (United States), processing in Ireland - delivery of messages from the form to our e-mail address (privacy policy).
• Google Ireland Limited (Google Workspace) - our e-mail inbox, if you contact us by e-mail or through the form (privacy policy).

Transfers outside the European Economic Area

Some of our service providers are established outside the European Economic Area. Vercel, Databricks, Resend and Google are certified under the EU-US Data Privacy Framework, so transfers to the United States rely on the European Commission's adequacy decision; where the certification does not apply, the Commission's standard contractual clauses under Chapter V GDPR are used.

How long we keep the data

• Messages from the contact form are kept for as long as the exchange lasts and for at most one year afterwards, unless the law requires us to keep them longer.
• Technical records of visits are kept by the hosting provider for at most 30 days, as needed to detect misuse and diagnose outages; we do not access them individually and do not link them to you.
• E-mail messages are kept for as long as the exchange lasts and for at most one year afterwards, unless the law requires us to keep them longer.

Your rights

At any time you have the right to request access to your data, its correction or erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. Send your request to info@palapassion.com. We will reply within one month of receiving it at the latest.

Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska Road 136, 10000 Zagreb, azop@azop.hr.

Changes to this policy

We update this policy when the way the site works changes, or when the law changes. The version date is given at the top of the document.

The Croatian version of this document prevails. The English translation is provided for ease of understanding.