Privacy Policy

The accommodation XY Suites – Design Apartments, Eugena Kvaternika 15, 22000 Šibenik, Croatia, is provided by Stipe Grubišić, Bana Josipa Jelačića 13 F, 22000 Šibenik. The data controller for this website and for guests’ booking data is Edi Grubišić, Bana Josipa Jelačića 13 F, 22000 Šibenik, Croatia. Your host and contact is Edi: thexysuites@gmail.com or +385 99 808 4089.

For questions about privacy and your personal data, write to thexysuites@gmail.com.

• When you book online: your name, e-mail address, phone number, optional message, the apartment, dates, number of guests and the payment status.
• Card payments are made on Stripe’s secure page. We never see or store your card details – Stripe only tells us whether the payment succeeded.
• At check-in: the identity-document details required by Croatian law to register your stay in eVisitor, the national guest registration system.
• When you e-mail, call or message us: the details you share and your message. If you message us on WhatsApp, the conversation is also processed by WhatsApp (Meta) under its own privacy policy.
• When you use the contact form: your name, e-mail address, optional phone number and dates, and your message. We use them only to answer you and keep them for the same 5 years as other messages.
• The public pages set no cookies until you decide: with your consent we use Google Analytics (Google Ireland Ltd.) to measure visits – it sets cookies and receives anonymous usage data (pages viewed, approximate location, device, whether you used WhatsApp, the contact form or started a booking). Without your consent nothing is loaded. You can withdraw consent at any time under “Cookie settings” in the footer. A strictly necessary login cookie is used only in the private owner area. Our hosting provider records technical server data (for example IP address and time of a request).

To make and manage your booking, take payments, send booking and payment confirmations and reminders, answer your questions, and keep the records the law requires (for example for invoices).

Only the services we need to run the booking: Hostinger (website hosting and database), Stripe (card payments), Resend (booking e-mails) and Google (our Gmail mailbox). Guest registration data goes to the local tourist board through eVisitor, as required by law. Booking.com only receives that dates are no longer available – never your name or contact details. Breakfast is ordered in a separate app; the information shown in the app applies there.

We keep booking and payment data for 5 years after your stay. Where the law requires particular records (for example accounting or tax records) to be kept longer, we keep those records for the period the law requires. E-mails and messages are kept for the same 5 years.

Under the General Data Protection Regulation (GDPR) you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing and to data portability, where these rights apply. To use them, contact us at thexysuites@gmail.com.

You also have the right to lodge a complaint with the Croatian supervisory authority: Personal Data Protection Agency (AZOP) (opens in a new tab)

Some links lead to other services, such as Google Maps, Booking.com, Black & White Taxi, UNESCO and Krka National Park. They open only when you click them, in a new tab, and the privacy policy of that service then applies.