TOŠIĆ ESTATE
Privacy policy.
Last updated: 25 September 2026
1. Who is responsible for your information?
Ivan Tošić, the accommodation provider for Tošić Estate, is responsible for deciding how your personal information is used.
- Email:
- Telephone:
- Contact address: Donji Tošići 1, 22303 Razvođe, Croatia
Please use these details for privacy questions or requests concerning your information.
2. Information we use and why
Enquiries and accommodation. We use your name, email address, requested dates, guest numbers, correspondence and any optional telephone number or country you provide to answer enquiries and arrange and deliver your stay. The basis is taking steps at your request before a contract and performing the accommodation contract (GDPR Article 6(1)(b)). We use necessary information about accompanying guests to administer the group booking, based on our legitimate interest in providing the booked accommodation (Article 6(1)(f)), and for legal registration where applicable.
Guest registration and financial records. We collect identity and stay details required for Croatia's eVisitor registration system, including for accompanying children where required, and information needed for invoices, taxes and other mandatory records. This processing fulfils legal obligations (Article 6(1)(c)). Identity information should be provided through the registration process, rather than in the website's general enquiry field.
Security and disputes. Necessary correspondence, transaction records and relevant incident information may be used to investigate problems, protect property and establish, exercise or defend legal claims. The basis is our legitimate interest in managing and protecting the accommodation business (Article 6(1)(f)), or a legal obligation where applicable.
Website operation. Technical information such as IP addresses, request times and browser information may be processed to deliver and secure the website. The basis for necessary operational processing is our legitimate interest in maintaining a reliable, secure website (Article 6(1)(f)).
Required form fields are marked. Without sufficient contact and stay information, we cannot process an enquiry or arrange a booking. We must obtain legally required guest registration details to fulfil our registration duties. Optional fields may be left blank. Please avoid sending medical information, passport copies or other sensitive details through the general enquiry form; contact Ivan to discuss an appropriate method if additional information is needed.
Spam prevention and contact verification. When activated, Cloudflare Turnstile checks requests to submit an inquiry or reveal our email address and telephone number. It loads when you use these actions and processes technical signals such as your IP address and browser information to distinguish visitors from bots. Our server checks the verification result before accepting the request. We do not send the inquiry message or guest contact fields to the verification service. See the Cloudflare Turnstile Privacy Addendum. Revealed contact details are remembered in this page’s memory for up to ten minutes to avoid repeated checks; this memory is cleared when the page is reloaded or closed.
3. Where information comes from
We receive information directly from you, from the person arranging your group booking and, where you book through an intermediary, from that booking platform or agent. This can include contact details, names of accompanying guests, dates, guest numbers and booking messages. We also obtain outdoor camera footage and technical website information as described in this notice. Please share this notice with the other people in your booking; we will make it available to them when communicating or registering their stay.
When you submit an enquiry, your contact details, requested stay, guest numbers, message and quoted price are stored in the website’s protected estate manager. Your enquiry does not create a confirmed reservation. Once the email service is connected, the website also sends a notification to the estate’s designated recipient and, if configured, one additional authorised recipient, and an acknowledgement to you. Email delivery records are kept so failed notifications can be reviewed and retried.
4. Who receives information?
Ivan handles enquiries and guest administration. Information may also be accessible to providers supporting website hosting, email and CMS operation to the extent needed for their services. Legally required guest registration data is submitted to eVisitor and made available to the competent tourism and public authorities under the applicable rules. Relevant information may be disclosed to competent authorities when required by law, or to professional advisers where necessary to handle a claim.
Booking platforms used by you also process information under their own privacy notices. We do not sell guest contact information.
The estate email service is hosted by Cyberfolks in Croatia. This website and its estate manager run on OpenAI Sites and its hosting infrastructure, including Cloudflare. These providers process technical connection information and the enquiry and booking data stored in the estate manager to operate and protect the service. When connected, the estate’s email sending service processes the information included in notification and acknowledgement messages.
5. How long information is kept
Our retention policy is:
| Information | Retention |
|---|---|
| Enquiries that do not become bookings | Delete or anonymise within 12 months after the last substantive contact. |
| Routine booking correspondence and operational CMS records | Delete or anonymise within 3 years after checkout or cancellation, except records still required for the purposes below. |
| Invoices, tax records and mandatory guest registration records | Retain for the period required by the Croatian rules applicable to the provider and each record type. The period is determined by the record type, the applicable tax or registration rules and their start date; eVisitor's statutory records follow its applicable retention rules. Contact us for the period applicable to a particular record. |
| Outdoor camera recordings | Normally 14 days. Preserve relevant extracts longer only where necessary for an identified incident or legal proceedings. |
| Records relevant to a dispute or legal claim | Retain the necessary records until the matter and applicable claim/enforcement periods have ended; review and remove unrelated information. |
| Website/server logs and backups | Keep only for the operational recovery and security-investigation period needed for the relevant system, taking account of an identified incident or legal preservation requirement. Backup copies are restricted to recovery and expire through the hosting backup cycle; contact us for the schedule applicable to your information. |
When a retention period ends, we delete or anonymise the information unless a specific legal obligation or unresolved claim requires necessary records to be kept longer. Routine records are not kept indefinitely for possible marketing.
6. Outdoor video surveillance
Outdoor cameras are used to protect people and property, based on our legitimate interest in security (Article 6(1)(f)). They cover the estate entrance, the pool area and the outdoor area between Guest house 1 and Guest house 2. They do not record sound or cover indoor areas. Cameras are visible and surveillance notices are displayed. Recordings are stored locally on a server at the estate. Ivan Tošić is the only person with routine access to recordings. Normal retention is 14 days; relevant footage may be preserved for an incident or legal proceedings and disclosed to competent authorities where legally required.
You may contact Ivan about the camera coverage or request access to footage relating to you. Please provide the approximate date, time and location so we can locate it. Other people's rights must also be protected when responding.
7. Newsletters
We do not currently operate a newsletter. If one is introduced, subscription will require a separate, optional choice. Accepting booking terms or making a booking will not subscribe you. The legal basis will be consent (Article 6(1)(a)). You will be able to withdraw consent at any time by using the unsubscribe link or contacting , without affecting your booking or the lawfulness of processing before withdrawal. We will update this notice with the newsletter provider and retention arrangements before subscription starts.
8. Cookies, local storage and optional Google Maps
Cookies and local storage save information in your browser. We use essential storage for your requested preferences and administrator security. Optional Google Maps content stays disabled until you give permission. You can use the gallery, availability calendar and enquiry forms without accepting optional services.
Choose Accept all, Reject non-essential or Settings in the banner. You can also change or withdraw your choice at any time using . External media is off unless you enable it. Closing the settings window does not give consent.
| Storage or service | Purpose and provider | Duration and choice |
|---|---|---|
Privacy choicetosic-estate-cookie-consent | Tošić Estate first-party local storage remembers your permission or rejection, the notice version and the time of your choice. It does not store your enquiry details. | Valid for 180 days from your last choice. Expired records are removed when the site checks them on a subsequent visit or while open. Essential to remember and respect your choice. |
Language preferencetosic-estate-language-preference | Tošić Estate first-party local storage remembers the language flag you explicitly select. Content currently remains in English while translations are prepared. | Until you clear this website’s storage or choose another language. Written only when you select a language. |
Administrator session__Host-estate_session | Tošić Estate secure, HttpOnly cookie supports authenticated estate-manager access. It is not required for guests to enquire. | 10 minutes during incomplete sign-in, or up to 12 hours for a verified session; removed on logout. Essential for administrator login. |
| Google Maps — optional external media | The embedded map is provided by Google; for EEA users, services are generally provided by Google Ireland Limited. When enabled, Google receives your IP address and browser information and may read or set its own cookies and similar storage. | Disabled before consent. Google’s storage names and periods vary with browser, account and service settings; see Google’s cookie information for its identifiers, purposes and durations. |
After you allow external media, the map loads automatically on the homepage, including on later visits while your choice remains valid. Disabling external media removes the embedded map and stops it loading again on this website. Withdrawal does not undo earlier processing or erase Google’s existing cookies; these can be managed through your browser and Google’s controls. See Google’s privacy policy.
We remember choices only in this browser on this website address. Clearing site data or using another browser or website address may show the banner again. If browser storage is unavailable, your choice lasts only while the page remains open. You can remove saved language and privacy preferences through your browser’s site-data controls.
Fonts and estate photographs are served by this website. We have not added Google Analytics, Meta Pixel or advertising trackers. Accepting today’s choices does not authorise a future analytics or advertising service: we will describe new services and obtain the necessary separate consent before activating them. Booking terms and newsletter choices are separate from these settings.
Links for directions, reviews, WhatsApp and other external services connect you to those services when you choose to follow them. Their own privacy and cookie controls then apply.
Cyberfolks hosts the estate email in Croatia. The website and estate manager use OpenAI Sites and its hosting infrastructure, including Cloudflare. Website connection information and stored enquiry or booking information may be processed outside the EEA, including in the United States, by the relevant providers. Google may also process map-related connection information outside the EEA. Their published transfer arrangements include applicable adequacy decisions, the EU–US Data Privacy Framework for covered certified organisations and standard contractual clauses where required. Details and ways to obtain information about safeguards are provided in Google's transfer information, OpenAI's European privacy policy and Cloudflare's privacy policy. You may also contact Ivan for information about relevant recipients and safeguards. We do not claim that all website-related processing takes place in Croatia.
9. Your rights
Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability of your information. You may object to processing based on legitimate interests on grounds relating to your situation. You may object to direct marketing at any time. Where we rely on consent, you may withdraw it without affecting earlier lawful processing.
Contact . We may request proportionate information to verify your identity. We normally respond within one month; if a permitted extension is necessary, we will explain it within that month. Some records cannot be deleted while a legal retention obligation or justified claim-related need applies.
You may complain to the Croatian Personal Data Protection Agency (AZOP) at azop.hr, or to the competent supervisory authority where you live, work or consider an infringement occurred. You do not have to contact us first.
We do not use automated decisions producing legal or similarly significant effects on you in the current enquiry process.
10. Changes
We will update this notice when our practices change, including before activating a new booking system, newsletter or analytics service. Where required, we will provide additional information or obtain consent before the new processing begins.