Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

For any questions about data protection, please write to info@firstclass-holidays.org.

2. Overview

We process personal data only to the extent necessary to provide a working website, to answer your enquiries and, with your consent, to understand how the website is used and to measure our advertising. The legal bases are mainly Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (b) GDPR (steps prior to entering into a contract) and Art. 6 (1) (f) GDPR (legitimate interests). Storing information on your device or accessing it is based on § 25 TDDDG.

3. Hosting and server log files

This website is hosted by Lovable Labs AB, Stockholm, Sweden. When you visit the website, the hosting provider automatically collects information that your browser transmits: IP address, date and time of the request, the page requested, the referring page, browser type and version, operating system. This data is required to deliver the website securely and reliably and to detect misuse. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and error-free operation of the website. Log files are stored only for as long as necessary for these purposes and are then deleted, unless longer storage is needed to investigate a specific security incident.

Lovable may use sub-processors for hosting and content delivery, some of which may be located outside the EU. Where this is the case, transfers are based on an adequacy decision (including the EU-U.S. Data Privacy Framework) or on the EU Standard Contractual Clauses. We have concluded a data processing agreement with Lovable in accordance with Art. 28 GDPR.

4. Database (Lovable Cloud)

Enquiries submitted through the website are stored in a database provided through Lovable Cloud, which is based on Supabase (Supabase Inc., USA). The database is hosted in a data center in the European Union. Access is restricted to authorised members of our team. Where support or maintenance access from outside the EU cannot be excluded, transfers are based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

5. Enquiry form

When you send us an enquiry, we process the data you enter: first and last name, email address, phone number, arrival and departure dates, number of adults and children, whether you are travelling with a pet, the services you are interested in, your message and how you heard about us. We also store the date and time of the enquiry, the language of the form and the page from which it was sent.

We use this data to answer your enquiry and to prepare an offer. The legal basis is Art. 6 (1) (b) GDPR. Where necessary to prepare your stay, we share the relevant details with the owner and the on-site team of Villa Magran in Croatia.

To protect the form against spam and misuse, we use a hidden field, a minimum completion time and a limit on the number of submissions per IP address. The IP address is used only for this purpose and is not stored with your enquiry. The legal basis is Art. 6 (1) (f) GDPR.

Enquiries that do not lead to a booking are deleted automatically 12 months after receipt. If a booking is made, we store the data for as long as required by statutory retention obligations under commercial and tax law (generally six to ten years).

6. Emails

When you submit an enquiry, we automatically send a notification to our team and a confirmation to the email address you provided. These emails are sent through the email service integrated in Lovable Cloud, provided by Lovable Labs AB and its sub-processors as our processors. The legal basis is Art. 6 (1) (b) GDPR.

7. Cookies and consent

We only use cookies and similar technologies that are not strictly necessary if you have given your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Strictly necessary storage, such as saving your consent choice, is based on § 25 (2) TDDDG.

When you first visit the website, a banner lets you accept all, reject all or choose individual categories:

• Necessary: stores your consent choice in your browser's local storage. Always active.
• Statistics: Google Analytics 4.
• Marketing: Google Ads conversion tracking and Meta Pixel.
• External media: the interactive map from OpenStreetMap.

No statistics, marketing or external media services are loaded before you consent. You can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. We ask for your consent again after 12 months or when our services change.

8. Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics helps us understand how visitors use the website, for example which pages are viewed, how long visits last and whether an enquiry was sent, so that we can improve the website.

Google Analytics uses cookies (_ga and _ga_<ID>, storage period up to 2 years) and processes information such as pages visited, time of the visit, approximate location (country, region, city derived from the IP address), device, browser and the website you came from. Google Analytics 4 does not log or store full IP addresses. We have set the retention period for user-level data to 14 months. Google signals and the sharing of data with other Google products are deactivated.

We use Google Consent Mode v2. The default setting for all Google services is "denied"; Google tags are only loaded once you have consented to Statistics or Marketing, and only for the categories you have accepted.

Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; on this basis, the European Commission has determined an adequate level of data protection. We have concluded a data processing agreement with Google.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. More information: https://policies.google.com/privacy and https://business.safety.google/privacy/

9. Google Search Console

We use Google Search Console, a service of Google Ireland Limited, to see how our website appears in Google Search: which search terms lead to it, how often it is shown and clicked, and whether Google can read our pages without errors. Search Console does not place any cookies or scripts on this website and does not collect data from your visit here. We only receive aggregated, anonymous statistics that Google generates from searches on its own search engine, plus a verification tag in the code of our home page. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is making the website easy to find and technically sound. More information: https://policies.google.com/privacy

10. Google Ads conversion tracking

With your consent to Marketing, we use Google Ads conversion tracking by Google Ireland Limited. If you reach our website through a Google ad, a cookie (_gcl_au, storage period up to 90 days) is set. This lets us and Google see that someone clicked an ad and later sent an enquiry. We do not receive any information that identifies you personally, and no personal data from the enquiry form is passed to Google. The legal basis is Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Data transfers to the USA are based on the EU-U.S. Data Privacy Framework.

11. Meta Pixel

With your consent to Marketing, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The pixel helps us measure the effectiveness of our advertising on Facebook and Instagram and show our ads to people who may be interested. The pixel sets a cookie (_fbp, storage period up to 90 days) and records page views and the fact that an enquiry was sent. No personal data from the enquiry form is passed to Meta. If you are logged in to a Meta service, Meta may link this information to your account; Meta is responsible for that processing.

We and Meta are joint controllers for the collection and transmission of the data (Art. 26 GDPR); the joint controller addendum is available at https://www.facebook.com/legal/controller_addendum. Data may be transferred to Meta Platforms Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis is Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. More information: https://www.facebook.com/privacy/policy

12. OpenStreetMap

On the page about Novalja and Pag, you can load an interactive map. The map is only loaded after you click on it and have consented to External media. When it loads, your browser connects to the servers of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, and transmits your IP address and technical information. The European Commission has issued an adequacy decision for the United Kingdom. The legal basis is Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. More information: https://osmfoundation.org/wiki/Privacy_Policy

The map software (Leaflet) is stored on our own server; no connection to third parties is made for it.

13. Fonts and video

All fonts are stored on our own server. No connection to Google Fonts or other font services is made. The videos on this website are also stored on our own server and are not loaded from YouTube, Vimeo or similar platforms.

14. Your rights

You have the right to:

• obtain information about your personal data that we process (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• restrict the processing of your data (Art. 18 GDPR)
• receive your data in a structured, machine-readable format (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, please contact info@firstclass-holidays.org.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de

16. Changes to this privacy policy

We update this privacy policy when the website or the legal requirements change. The current version is always available on this page.