Privacy policy

Who processes your data

This website is run by Osmijeh d.o.o., Kuzmanićeva 3, 21000 Split, Croatia, company ID (OIB) 78387116184, trading as Hotel Villa Diana and Pizzeria Villa Diana.

For any question about privacy, write to info@villadiana.hr or call +385 21 482 460. Reception is open around the clock.

What we do not ask of you

This website has no enquiry form, no login, no user account and no newsletter. We do not ask for your name, e-mail or phone number, and we have nowhere to record them.

There is no profiling and no automated decision-making about you. We count visits with a tool that sets no cookies; tools that do set cookies and serve advertising are used only with your consent. Both are explained in the section “Analytics and advertising”.

The fonts the site is set in are served from our own domain, so your browser does not contact any third party because of them.

Server logs

The site is served by Vercel Inc. Like any server anywhere, it records technical details of every request: IP address, browser type, the address requested, the time and the server's response.

This happens so that the site can work at all and so that an attack or a fault can be spotted. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. We do not combine these logs with anything else, we do not use them to measure traffic and we do not pass them to anyone.

Vercel acts as our processor and keeps the logs briefly, in line with its own terms.

Analytics and advertising

We count visits with Vercel Web Analytics, which works **without cookies**: it stores nothing on your device and does not recognise you across pages or between visits. A visitor is derived from a hash of the IP address and browser details, and that hash changes every day. This tells us how many people opened which page, and nothing more. The processor is Vercel Inc., the same company that hosts the site, and the legal basis is our legitimate interest under Article 6(1)(f) GDPR, the same basis as the server logs. No consent is asked for it because nothing is stored on your device.

In addition, and **only if you consent**, the website uses Google Tag Manager and, through it, Google Analytics 4, Google Ads and the Meta pixel. None of it switches itself on: until you answer the question that appears at the bottom of the screen, every consent category is set to “denied” and none of these tools may set a cookie or send any identifier about you.

If you consent, we measure which pages you open, in what order and where you came from, along with clicks on booking, phone, WhatsApp and directions. Some of these events are also sent to Meta from our own server, so that measurement still works when a browser blocks scripts; both paths carry the same random event number, so the same click is not counted twice.

The recipients are Google Ireland Limited and Meta Platforms Ireland Limited. They receive your IP address, browser information, the address of the page you were on, and their own cookies. We do not send them your name, e-mail or phone number, because we do not have them. The data may be transferred to the United States on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework).

For those tools the legal basis is your consent, Article 6(1)(a) GDPR. You may withdraw it at any time, as easily as you gave it: the button at the bottom of this page brings the question back and lets you choose again. Withdrawal does not affect the lawfulness of processing that took place before it.

The map on the Contact page

The Contact page has a Google Maps map, but it **does not load by itself**. Until you click the “Show the map” button there is only a still panel and nothing goes to Google.

When you click, your browser requests the map from Google and thereby sends it your IP address, browser details and the time. Google Ireland Limited then becomes the recipient of that data, and the data may also be transferred to the United States. The legal basis is your consent under Article 6(1)(a) GDPR, and you give that consent by that very click.

If you do not open the map, nothing is sent. How Google handles the data is set out in its privacy policy at policies.google.com/privacy.

When you book a room

On the site you choose dates and the number of adults, children and rooms. Those choices **do not come to us**: clicking “Check availability” opens the Rentlio reservation system and passes your choices to it in the address.

You complete the booking itself (name, e-mail, payment details) with Rentlio, on its site and under its privacy policy. We receive your booking details from Rentlio because we need them to receive you, and we then process them to perform the accommodation contract under Article 6(1)(b) GDPR, and to meet the legal duties of registering guests and issuing invoices.

A table at the pizzeria is booked by phone or on WhatsApp. If you write to us on WhatsApp, the message travels through WhatsApp and is subject to that service's terms.

Cookies

Without your consent the website sets **one** cookie: NEXT_LOCALE. It holds nothing but the language you chose, for example “hr” or “de”, so that your next visit does not start in the wrong language. That cookie does not track you, contains nothing about you and is not shared with anyone.

Your answer to the measurement question is not kept in a cookie but in browser storage, under the key vd-consent. It holds only “granted” or “denied” and is never sent anywhere. It exists so that you are not asked the same question on every page.

If you consent to measurement, Google and Meta set their own cookies as well: Google Analytics usually _ga, Meta _fbp. They serve to recognise the same browser between visits. Without your consent there are none of them.

You can delete any cookie in your browser settings, as with any other website.

Your rights

You have the right to know what data we hold about you and to receive a copy of it, to have inaccurate data corrected, to ask for erasure or for processing to be restricted, to take your data elsewhere, and to object to processing based on our legitimate interest.

Where processing rests on consent, and that is only the map on the Contact page, you may withdraw it at any time, quite simply by not opening the map or by reloading the page.

Send your request to info@villadiana.hr. We reply within one month. If you believe we are not handling your data properly, you may contact the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

Changes to this policy

We change this policy when what the website does changes. The last substantial change is dated 11 August 2026, when analytics and advertising were introduced subject to consent; until then the site sent nothing to any third party without an action of yours.

If one day we add a tool that is not named here, we will add a section about it and ask for consent before it is switched on.

The date of the last change is shown at the top.