Last updated: July 10th 2026.

​

This Privacy Policy explains how personal data is collected and processed when you visit the website www.villa-lapis-vis.com (the "Website") or book a stay at Villa Lapis Vis, Croatia (the "Villa").

​

Data controller:

Stjepan-Nedjelko Tičinović

Luka 46, Rukavac, Vis, Croatia

​​

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Croatian law.

​

​

1. What Data We Collect and Why

​

1.1. Contact and booking form

When you fill out the form on the Website, we collect the data you provide, such as your name, email address, phone number, and the content of your message. We use this data to respond to your inquiry and to arrange and manage your booking.

Legal basis: taking steps at your request prior to entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR); responding to general inquiries is based on our legitimate interest (Art. 6(1)(f) GDPR).

​

1.2. WhatsApp contact

The Website includes a WhatsApp button that lets you contact us directly via WhatsApp. If you use it, your communication is processed through WhatsApp (Meta Platforms), and WhatsApp's own privacy policy applies in addition to this one. We see and use only the information you send us (e.g., your name, phone number, and message content) for the purpose of handling your inquiry or booking.

Legal basis: as in 1.1.

​

1.3. Guest registration (legal obligation)

Croatian law requires us to register all guests with the competent authorities through the eVisitor system. For this purpose, we collect identification data of all members of your party upon arrival (e.g., name, date of birth, citizenship, and passport or ID card number).

Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

​

1.4. Payment data

Payments are made by deposit and payment of the balance as agreed (e.g., bank transfer). We process only the data necessary to receive and record your payment, and we retain payment records as required by tax and accounting regulations.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR).

​

1.5. Website usage statistics

The Website is hosted on the Wix platform, which collects technical data about visits (such as pages viewed, approximate location, device and browser type) and provides us with aggregated visitor statistics. This may involve the use of cookies (see Section 3).

Legal basis: our legitimate interest in understanding and improving the Website (Art. 6(1)(f) GDPR), and your consent where required for non-essential cookies (Art. 6(1)(a) GDPR).

​

​

2. Third-Party Services on the Website

​

2.1. Wix

The Website is built and hosted on Wix.com Ltd. Wix processes technical visitor data as our hosting and website platform provider. More information: Wix Privacy Policy (www.wix.com/about/privacy).

​

2.2. Google Maps

The Website embeds a Google Maps map so you can see the Villa's location and directions. When the map is loaded or used, Google may collect data about your visit (such as your IP address) under its own privacy policy (policies.google.com/privacy).

​

2.3. WhatsApp

If you contact us via the WhatsApp button, Meta Platforms processes your data under WhatsApp's privacy policy (www.whatsapp.com/legal/privacy-policy).

​

2.4. Social media links

The Website contains links to the Villa's social media pages. Clicking a link takes you to the respective platform, which processes your data under its own privacy policy. Simply viewing our Website does not transfer your data to these platforms.

​

2.5. Booking platforms

If you book the Villa through a third-party platform (such as Booking.com or Airbnb), that platform collects and processes your data under its own privacy policy. We receive from them only the data necessary to manage your booking and comply with our legal obligations (such as guest registration).

​

​

3. Cookies

​

The Website uses cookies placed by the Wix platform. These include essential cookies necessary for the Website to function, and statistical cookies used to generate visitor statistics. Embedded services such as Google Maps may also set cookies when used. You can manage or delete cookies at any time through your browser settings; blocking essential cookies may affect how the Website functions.

​

​

4. Who We Share Data With

​

We do not sell or rent personal data. We share personal data only:

• with the competent Croatian authorities via the eVisitor system, as required by law

• with service providers that make the Website and our communication possible (Wix, Google, WhatsApp/Meta), as described above

• where we are otherwise legally required to do so (e.g., tax authorities).

​

​

5. International Data Transfers

​

Some of the service providers named above (Wix, Google, Meta) may process data outside the European Economic Area. In such cases, transfers are carried out on the basis of safeguards provided for by the GDPR, such as adequacy decisions or standard contractual clauses.

​

​

6. How Long We Keep Data

​

• Inquiry data: as long as necessary to handle your inquiry and for a reasonable period afterwards.

• Booking, guest registration, and payment records: for the periods required by Croatian law (including tax, accounting, and tourism regulations).

• Website statistics: in aggregated form, in accordance with Wix's retention practices.

​

​

7. Your Rights

​

Under the GDPR, you have the right to:

• request access to your personal data

• request rectification of inaccurate data

• request erasure of your data ("right to be forgotten")

• request restriction of processing

• data portability

• object to processing based on legitimate interest

• withdraw consent at any time, where processing is based on consent (this does not affect the lawfulness of processing before withdrawal).

​

To exercise these rights, contact us using the details at the top of this Policy. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka — AZOP, www.azop.hr) or your local supervisory authority.

​

​

8. Data Security

​

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse.

​

​

9. Changes to This Policy

​

We may update this Privacy Policy from time to time. The current version, with the date of the last update, is always published on the Website.

​

​

10. Language

​

This Privacy Policy is published in English and Croatian. In the event of any discrepancy between the two language versions, the Croatian version shall prevail.