PRIVACY POLICY

1. General Information

This Privacy Policy explains how Full of Joy d.o.o. , OIB: 10537885836 , with its registered office at Peteranečki put 26, Zagreb, Croatia , as the data controller, collects, uses, stores and protects the personal data of its clients, guests and visitors to the website www.full-of-joy.com .

This Privacy Policy applies to personal data collected through our website, by email, telephone, messaging applications and during the enquiry, booking and delivery of our services.

For any questions concerning the processing of your personal data, you may contact us at:

Full of Joy d.o.o. Peteranečki put 26 Zagreb, Croatia Email: info@full-of-joy.com

We respect your privacy and are committed to processing personal data lawfully, fairly, transparently and only for clearly defined purposes, in accordance with the General Data Protection Regulation – GDPR and other applicable Croatian and European Union legislation.

2. Personal Data We May Collect

Depending on how you contact us and which services you request, we may collect the following categories of personal data:

Please do not provide personal data that is not reasonably necessary for the preparation, organisation or delivery of your service.

• first and last name;

• email address;

• telephone number;

• residential address, billing address, pick-up location or destination;

• information about the number, names and ages of passengers;

• information concerning children travelling as part of a family or group;

• arrival and departure details, including flight number, arrival time and airport;

• information concerning requested or confirmed tours, transfers, accommodation, activities and other travel services;

• information necessary for preparing quotations, booking confirmations, invoices and other business documentation;

• records of enquiries, correspondence and communication with us;

• dietary requirements, reduced mobility or other specific travel-related needs voluntarily provided by the guest;

• IP address, browser type, device information and basic technical data generated when visiting our website;

• any other information voluntarily provided for the purpose of organising or delivering the requested service.

3. How We Collect Personal Data

We may collect personal data when you:

Personal data may also be provided by the person making a booking on behalf of a family, group or other travellers.

A person who provides us with the personal data of other travellers confirms that they are authorised to do so and that those travellers have been informed about the processing of their personal data under this Privacy Policy.

• contact us to request information or a quotation;

• make or confirm a reservation;

• communicate with us by email, telephone, WhatsApp or another agreed communication channel;

• provide passenger, travel or flight information;

• enter into an agreement with us or make a payment;

• participate in a tour, transfer or another service organised by Full of Joy;

• voluntarily provide additional information required for the organisation of your trip;

• use our website, where limited technical information may be collected automatically.

4. Purposes of Processing

We may process personal data for the following purposes:

Responding to Enquiries

We use personal data to respond to questions, prepare personalised quotations, provide travel information and recommend suitable tours, transfers and other services.

Preparing and Confirming Reservations

We process personal data to prepare an itinerary, issue a quotation, confirm availability, arrange payment and complete the reservation process.

Delivering Agreed Services

Personal data may be used to organise and provide private tours, transfers, day trips, multi-day tours, accommodation, entrance tickets, activities and other agreed services.

Travel Organisation

We may process information concerning pick-up locations, flights, accommodation, destinations, passenger numbers, ages and special requirements to ensure that the agreed service is properly organised.

Communication with Guests

We use personal data to send booking confirmations, itineraries, payment instructions, meeting-point information and important updates concerning the confirmed service.

Accounting and Legal Obligations

Certain information is processed and retained for invoicing, accounting, taxation, record-keeping and compliance with other legal obligations.

Service and Website Security

Limited data may be processed to protect our website, prevent misuse, respond to complaints, establish or defend legal claims and safeguard our legitimate business interests.

Marketing Communications

We will send promotional messages or information about special offers only where you have given your consent or where another lawful basis applies.

You may withdraw your consent to receive marketing communications at any time by contacting us at info@full-of-joy.com .

5. Legal Basis for Processing

We process personal data only where an appropriate legal basis exists.

Depending on the circumstances, processing may be based on:

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

• taking steps at your request before entering into a contract , such as preparing an offer or answering a booking enquiry;

• performance of a contract , including organising and delivering the services you have booked;

• compliance with a legal obligation , including accounting, taxation and record-keeping requirements;

• your consent , where consent is required;

• our legitimate interests , including protecting our business, maintaining the security of our website, handling complaints and establishing or defending legal claims;

• protection of vital interests , where processing is exceptionally necessary to protect the health or safety of a guest.

6. Special Categories of Personal Data

As a general rule, we do not request or collect special categories of personal data.

However, guests may voluntarily provide information concerning health conditions, allergies, dietary requirements, reduced mobility or other specific needs where such information is relevant to the safe and appropriate delivery of a service.

Such information will be processed only when necessary, on an appropriate legal basis and with access limited to persons who require the information to organise or provide the service.

Guests should provide only the minimum information necessary for the requested accommodation or assistance.

7. Personal Data Relating to Children

Our services may include children travelling with parents, legal guardians or other responsible adults.

We may collect limited information about a child, such as their name, age or relevant travel requirements, where this is necessary to organise transportation, accommodation, entrance tickets, activities or another agreed service.

Personal data relating to children must be provided by a parent, legal guardian or a person authorised to arrange the trip on the child’s behalf.

We do not knowingly collect personal data directly from children for marketing purposes.

8. Sharing Personal Data

We do not sell, rent or trade personal data.

We may share personal data only where this is necessary to provide a confirmed service, meet a legal obligation or protect our legitimate rights and interests.

Recipients may include:

We disclose only the information reasonably necessary for the recipient to provide the relevant service.

Where a service provider processes personal data on our behalf, they must process it only in accordance with our instructions, maintain confidentiality and apply appropriate security measures.

Independent providers may also process personal data under their own privacy policies where they act as separate data controllers.

• drivers and licensed tour guides;

• accommodation providers;

• transport providers and boat operators;

• organisers of excursions, activities and tastings;

• national parks, museums and other ticket providers;

• restaurants and other service providers included in the itinerary;

• accounting service providers;

• IT, website hosting and communication service providers;

• legal advisers, insurers and professional consultants;

• competent public authorities where disclosure is required by law.

9. International Data Transfers

Some communication, hosting or digital service providers may process data outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we take reasonable steps to ensure that the transfer is made in accordance with applicable data protection legislation and that appropriate safeguards are in place.

Such safeguards may include an adequacy decision issued by the European Commission, standard contractual clauses or another legally recognised transfer mechanism.

10. Cookies

Our website may use strictly necessary technical cookies required for its proper operation, security and basic functionality.

We do not currently use Google Analytics, Meta Pixel, marketing cookies or similar analytics and advertising tools.

Strictly necessary cookies do not ordinarily require consent because the website cannot function properly without them.

You can control or delete cookies through your browser settings. However, disabling necessary cookies may affect the operation or availability of certain website functions.

Should we introduce optional analytical, functional or marketing cookies in the future, they will not be activated without the appropriate information and consent where required by law.

11. Retention of Personal Data

We retain personal data only for as long as necessary for the purpose for which it was collected or for the period required by applicable law.

In particular:

When personal data is no longer required, it will be deleted, anonymised or securely destroyed.

• data relating to enquiries that do not result in a booking is retained only for as long as reasonably necessary to respond and manage possible follow-up communication;

• data relating to confirmed bookings is retained for the duration of the contractual relationship and afterwards for as long as necessary to resolve complaints, protect legal rights or comply with statutory limitation periods;

• invoices, accounting records and business documentation are retained for the periods required by accounting, tax and other applicable legislation;

• data processed on the basis of consent is retained until consent is withdrawn, unless another lawful basis requires or permits continued retention;

• data relating to special travel requirements is retained only for as long as it is necessary for the organisation and completion of the relevant service, unless longer retention is required for a legal reason.

12. Data Security

We apply appropriate technical and organisational measures designed to protect personal data against:

Access to personal data is limited to persons who require it for legitimate business purposes or for the delivery of an agreed service.

Persons with access to personal data are required to maintain its confidentiality.

Although we take reasonable measures to protect personal data, no method of internet transmission or electronic storage can be guaranteed to be completely secure.

• unauthorised access;

• unlawful use or disclosure;

• accidental loss;

• unauthorised alteration;

• destruction or damage;

• other forms of unlawful processing.

13. Your Data Protection Rights

Subject to the conditions prescribed by applicable law, you may have the right to:

These rights are not absolute and may be limited where continued processing is required or permitted by law, including for compliance with legal obligations or the establishment, exercise or defence of legal claims.

• obtain confirmation as to whether we process your personal data;

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data;

• request restriction of processing;

• object to processing based on our legitimate interests;

• object at any time to processing for direct marketing purposes;

• request data portability where applicable;

• withdraw consent at any time where processing is based on consent;

• lodge a complaint with the competent supervisory authority.

14. Exercising Your Rights

To exercise your rights or request further information about the processing of your personal data, please contact:

Full of Joy d.o.o. Peteranečki put 26 Zagreb, Croatia Email: info@full-of-joy.com

Your request should clearly state which right you wish to exercise and provide sufficient information for us to identify the relevant personal data.

To protect your privacy, we may request additional information necessary to verify your identity before responding.

We will respond within the time limits prescribed by applicable data protection legislation.

15. Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully or that your data protection rights have been infringed, you have the right to lodge a complaint with the competent supervisory authority:

Croatian Personal Data Protection Agency Agencija za zaštitu osobnih podataka – AZOP

You may contact us first at info@full-of-joy.com so that we have an opportunity to review and address your concern.

16. Third-Party Websites

Our website may contain links to websites operated by third parties.

Full of Joy does not control those websites and is not responsible for their content, security practices or handling of personal data.

We recommend reviewing the privacy policy of each third-party website before providing personal information or using its services.

17. Changes to This Privacy Policy

Full of Joy reserves the right to amend or update this Privacy Policy when necessary to reflect changes in legislation, our business operations, technology or the services we provide.

Any updated version will be published on this website together with a revised date of the latest update.

We recommend reviewing this Privacy Policy periodically to remain informed about how we collect, use and protect personal data.