Privacy policy

CROATIAUP / VANADIS TRAVEL j.d.o.o.

Last updated: September 2026

Vanadis Travel j.d.o.o., a travel agency, respects the privacy of its customers, users and website visitors and is committed to protecting their personal data.

This Privacy Policy explains what personal data we collect and process, the purposes for which we process it, the legal grounds for such processing, who we may share it with, how long we retain it, and what rights you have in relation to your personal data.

Personal data is processed in accordance with applicable data protection legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “General Data Protection Regulation” or “GDPR”) and applicable Croatian legislation.

1. DATA CONTROLLER

The controller responsible for the processing of your personal data is:

Vanadis Travel j.d.o.o. – Travel Agency
Palmotićeva ulica 27
HR-10000 Zagreb
Croatia

OIB: 98589009005
MBS: 02969602
Travel Agency Identification Number: HR-AB-01-080827347

E-mail: info@croatiaup.com
Telephone: +385 91 548 0965
Website: CroatiaUp.com

CroatiaUp is the name and brand under which Vanadis Travel j.d.o.o. provides and promotes travel services through CroatiaUp.com.

Vanadis Travel j.d.o.o. is the data controller for personal data collected and processed through CroatiaUp.com and in connection with enquiries, bookings and travel services that it provides, arranges or intermediates.

2. PERSONAL DATA WE COLLECT

Depending on the type of service you request, book or use, we may process the following categories of personal data.

2.1. Identification and contact details

We may process:

• first and last name;
• address;
• e-mail address;
• telephone number;
• nationality, where required for the provision of a service;
• date of birth, where required to arrange a particular travel service;
• other information that you voluntarily provide to us and which is necessary to process your enquiry or booking.

2.2. Travel and booking information

Depending on the service booked, we may process:

• booking details;
• travel dates;
• destination and itinerary;
• accommodation details;
• cabin details;
• number of travellers;
• passport or identity document details where required for the provision of a particular service or by the relevant service provider or applicable law;
• special travel-related requests;
• transfer details;
• excursion and activity details;
• other information necessary to arrange and provide the contracted travel service.

2.3. Payment and transaction information

We may process:

• information relating to payments;
• invoice information;
• payment status;
• booking numbers;
• transaction numbers and other information relating to completed transactions.

Where payment is made through an external payment service provider, payment card details will generally be processed directly by that provider.

Vanadis Travel j.d.o.o. does not need to store complete payment card details where such processing is carried out directly by an authorised payment service provider.

2.4. Communications

We may process and retain communications between you and the Agency, including:

• e-mail correspondence;
• enquiries;
• booking requests;
• communications relating to bookings;
• customer support communications;
• complaints and claims;
• other correspondence relating to the provision of our services.

2.5. Marketing information

Where you have provided the required consent, we may process your e-mail address and marketing preferences for the purpose of sending:

• newsletters;
• special offers;
• travel information;
• promotional offers;
• other marketing communications.

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

• directly from you when you submit an enquiry;
• when you request a quotation;
• when you make a booking;
• when you communicate with us by e-mail or telephone;
• when you complete a form on CroatiaUp.com;
• when you make a payment;
• when you use our website;
• from a person making a booking on your behalf;
• from travel service providers or other business partners where necessary to provide a service you have requested;
• through cookies and similar technologies, in accordance with our Cookie Policy and applicable data protection requirements.

If a booking or service is made by one person on behalf of several travellers, the person providing the personal data is responsible for ensuring that they have an appropriate legal basis or authorisation to provide the personal data of the other travellers.

4. PURPOSES OF PROCESSING

We process personal data only for specified, explicit and legitimate purposes.

4.1. Enquiries and bookings

We process personal data in order to:

• respond to your enquiries;
• prepare and send quotations;
• process and confirm bookings;
• arrange travel;
• arrange accommodation, cruises, transportation, transfers, excursions and other travel services;
• issue travel and other relevant documentation;
• communicate with you before, during and after your trip;
• provide customer support.

4.2. Performance of contractual obligations

We process personal data where necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

4.3. Compliance with legal obligations

We may process personal data in order to:

• comply with tax and accounting obligations;
• issue and retain invoices;
• comply with legislation governing tourism and travel services;
• comply with other legal and regulatory obligations;
• respond to lawful requests from competent authorities.

4.4. Customer support and complaints

We may process personal data in order to:

• respond to questions;
• provide assistance;
• handle complaints and claims;
• communicate with you regarding your booking;
• protect the rights and interests of our customers and the Agency.

4.5. Protection of rights and legitimate business interests

Where necessary and where permitted by applicable law, we may process personal data in order to:

• protect our property and business;
• prevent fraud and misuse;
• maintain information and network security;
• establish, exercise or defend legal claims;
• pursue other legitimate business interests.

Where processing is based on legitimate interests, we consider the interests, rights and freedoms of the data subject and ensure that our legitimate interests do not override those rights and freedoms.

4.6. Marketing

Where consent is required for a particular type of marketing communication, we will send such communication only where you have provided the appropriate consent.

You may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

5. LEGAL BASES FOR PROCESSING

Depending on the specific purpose of processing, we may process personal data on one or more of the following legal bases under Article 6 of the GDPR:

5.1. Performance of a contract – Article 6(1)(b) GDPR

Where processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

5.2. Compliance with a legal obligation – Article 6(1)(c) GDPR

Where processing is necessary for compliance with a legal obligation to which Vanadis Travel j.d.o.o. is subject.

5.3. Consent – Article 6(1)(a) GDPR

Where you have given consent to the processing of your personal data for one or more specific purposes, for example for certain marketing communications.

You may withdraw your consent at any time.

5.4. Legitimate interests – Article 6(1)(f) GDPR

Where processing is necessary for the purposes of the legitimate interests pursued by Vanadis Travel j.d.o.o. or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

Legitimate interests may include, for example, security, fraud prevention, protection of information systems, business administration, customer support and the establishment, exercise or defence of legal claims.

Where personal data is processed for different purposes, the applicable legal basis will be determined for each purpose separately.

6. RECIPIENTS OF PERSONAL DATA

We do not sell or rent your personal data to third parties.

We may disclose personal data to third parties where this is necessary to provide a travel service, perform a contract, comply with a legal obligation or pursue a legitimate interest.

Depending on the particular service, recipients may include:

• cruise operators and ship owners;
• hotels and other accommodation providers;
• transportation providers;
• transfer providers;
• excursion and activity providers;
• local destination partners;
• insurance providers where insurance has been arranged;
• payment service providers and banks;
• accounting service providers;
• lawyers and other professional advisers;
• IT, hosting and technical service providers;
• e-mail and communication service providers;
• other service providers necessary to fulfil a booking or provide a contracted service;
• competent public authorities where disclosure is required by law.

Personal data is disclosed only to the extent reasonably necessary for the relevant purpose.

Where a third party processes personal data on our behalf, the relationship with that processor will be governed by an appropriate contract or other legal act in accordance with the GDPR.

7. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Due to the nature of certain travel services or the use of particular service providers, personal data may in certain circumstances be transferred outside the European Economic Area (EEA).

Where such a transfer takes place, we will take appropriate measures to ensure that the transfer complies with applicable GDPR requirements.

Depending on the circumstances, appropriate safeguards may include:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses;
• other appropriate safeguards recognised under the GDPR.

8. DATA SECURITY

Vanadis Travel j.d.o.o. implements appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure.

Access to personal data is restricted to persons and service providers who require such access for authorised business or contractual purposes.

However, no method of transmitting information over the Internet or storing information electronically can be guaranteed to be completely secure.

9. DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, unless we are legally required or otherwise permitted to retain it for a longer period.

The applicable retention period depends on the type of data, the purpose of processing and the legal obligations applicable to us.

Booking, invoicing, payment and accounting information will be retained for the period required by applicable tax, accounting and other legislation.

Information relating to customer support, contractual relationships and legal claims may be retained for as long as reasonably necessary to establish, exercise or defend legal claims.

Personal data processed solely for marketing purposes on the basis of consent will generally be retained until you withdraw your consent or the purpose for which the data was collected ceases to apply, unless another legal basis or legal obligation permits or requires further retention.

When there is no longer a legitimate purpose or legal basis for retaining personal data, the data will be deleted, destroyed or otherwise rendered non-identifiable, in accordance with applicable requirements.

10. YOUR RIGHTS

Subject to the applicable conditions and limitations under the GDPR, you have the following rights:

Right to be informed

You have the right to receive clear and understandable information about the processing of your personal data.

Right of access

You have the right to request confirmation as to whether your personal data is being processed and, where applicable, to obtain access to your personal data and information about its processing.

Right to rectification

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to erasure

In circumstances provided for by the GDPR, you have the right to request the deletion of your personal data.

The right to erasure is not absolute and does not apply where there is a legal or other lawful basis for continuing to process the data.

Right to restriction of processing

In circumstances provided for by the GDPR, you have the right to request restriction of the processing of your personal data.

Right to object

You have the right to object to processing based on legitimate interests, subject to the conditions set out in the GDPR.

You may object to the processing of your personal data for direct marketing purposes at any time.

Right to data portability

Where the conditions under the GDPR are met, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible and applicable, to request that the data be transmitted to another controller.

Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Rights relating to automated decision-making

Where a decision concerning you is based solely on automated processing, including profiling, and produces legal effects or similarly significantly affects you, you have the rights provided for under Article 22 of the GDPR, subject to the conditions and exceptions set out in the GDPR.

Vanadis Travel j.d.o.o. does not intend to make decisions producing legal or similarly significant effects solely on the basis of automated processing, unless an appropriate legal basis exists and the applicable safeguards are implemented.

11. HOW TO EXERCISE YOUR RIGHTS

To exercise your rights or ask questions concerning the processing of your personal data, you may contact us at:

Vanadis Travel j.d.o.o.Palmotićeva ulica 27HR-10000 ZagrebCroatia

E-mail: info@croatiaup.comTelephone: 091 548 0965

Requests may be submitted in writing or electronically.

To protect your personal data against unauthorised access, we may, where appropriate, request additional information necessary to verify your identity.

We will respond to your request without undue delay and, in any event, within the time limits prescribed by the GDPR.

12. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you believe that your personal data is being processed in breach of applicable data protection legislation, you have the right to lodge a complaint with a competent supervisory authority, in particular in the EU Member State where you have your habitual residence, place of work or where the alleged infringement took place.

In Croatia, the competent supervisory authority is:

Croatian Personal Data Protection Agency (AZOP)Ulica Metela Ožegovića 16HR-10000 ZagrebCroatia

E-mail: azop@azop.hrTelephone: +385 (0)1 4609-000Website: www.azop.hr

13. MARKETING COMMUNICATIONS

Where you have provided the required consent, or where another appropriate legal basis applies, CroatiaUp may send you:

• newsletters;
• special offers;
• travel information;
• information about travel services;
• promotional communications.

You may unsubscribe from marketing communications at any time by:

• using the unsubscribe link included in the relevant marketing communication; or
• contacting us at info@croatiaup.com.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

14. COOKIES AND SIMILAR TECHNOLOGIES

CroatiaUp.com may use cookies and similar technologies for the purposes of:

• ensuring the proper functioning of the website;
• remembering user preferences;
• analysing website usage;
• improving the user experience;
• carrying out marketing activities, where applicable.

The use of non-essential cookies is subject to applicable privacy and consent requirements.

Further information regarding the types of cookies used, their purposes, retention periods and available cookie-management options will be provided in a separate Cookie Policy and/or through an appropriate consent-management mechanism.

15. CHILDREN’S AND MINORS’ PERSONAL DATA

CroatiaUp may process personal data relating to children and minors where this is necessary to arrange and provide a travel service booked by a parent, legal guardian or other authorised person.

Where required under applicable law, information relating to a minor should be provided by a parent or legal guardian or with their appropriate authorisation.

We pay particular attention to the protection of children’s and minors’ personal data and process such data only to the extent necessary for the relevant purpose.

16. THIRD-PARTY WEBSITES

CroatiaUp.com may contain links to websites operated by third parties, including:

• hotels;
• cruise operators;
• transportation providers;
• excursion providers;
• other travel partners;
• payment and other service providers.

Vanadis Travel j.d.o.o. is not responsible for the content, security or privacy practices of third-party websites.

We recommend that you review the privacy policy and other relevant data protection information of any third-party website before providing personal data through such website.

17. CHANGES TO THIS PRIVACY POLICY

Vanadis Travel j.d.o.o. may amend or update this Privacy Policy from time to time to reflect:

• changes in applicable legislation;
• changes to our services;
• changes in our personal data processing activities;
• technological developments;
• other relevant circumstances.

The updated version of this Privacy Policy will be published on CroatiaUp.com.

The “Last updated” date at the beginning of this Privacy Policy indicates when it was most recently amended.

18. CONTACT

For any questions, requests or concerns regarding this Privacy Policy or the processing of your personal data, please contact:

Vanadis Travel j.d.o.o. – Travel Agency
Palmotićeva ulica 27
HR-10000 Zagreb
Croatia

OIB: 98589009005
MBS: 02969602
Travel Agency Identification Number: HR-AB-01-080827347

E-mail: info@croatiaup.com
Telephone: +385 91 548 0965
Website: CroatiaUp.com

Last updated: September 2026