Privacy Policy

Last updated: November 2026

This Privacy Policy informs you about which personal data we process when you use adrialo.eu, for what purposes this occurs, and what rights you have as a data subject.

1. Controller

The controller responsible for data processing is SALTY SOUL CREATIVES, email: support@adrialo.eu.

2. Guest data upon booking

When you make a booking, we process the data you enter (name, email address, address, phone number, travel period, number and age of guests, and your message to the host) in order to process and forward your booking to the respective host, and to create the booking confirmation, invoice and - in the event of cancellation - credit note. The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).

This data is passed on to the relevant host, since the accommodation contract is concluded exclusively between you and the host (see our GTC). Three days after the end of your stay, you will also automatically receive a brief email asking for voluntary feedback on the accommodation; you can simply reply to this or ignore the email.

3. Travel data of fellow travelers (eVisitor reporting obligation)

Croatian law obliges hosts to register all guests in the official eVisitor system. For this purpose, you can voluntarily provide the travel data of all fellow travellers (first and last name, gender, date of birth, country of birth, nationality, country of residence, and, in the case of Croatian residence, additionally the place of residence, ID type and document number) via an individual link sent by email. This data is passed on to the respective host so that they can fulfil their statutory reporting obligation.

If the host has activated the corresponding voluntary option in their dashboard, adrialo additionally transmits this travel data automatically via the official interface (Web API) of the eVisitor system to the Hrvatska turistička zajednica (Croatian National Tourist Board) - using the eVisitor access data provided by the host themselves and on their behalf, in order to fulfil their statutory reporting obligation. This function is deactivated by default and is only used after explicit activation by the host. For error diagnosis in connection with this transmission, we internally log the date, time and success or error message of the respective request - but never the eVisitor password. The legal basis is Art. 6(1)(c) GDPR (the host's legal obligation) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in technically enabling this report).

4. Host data

When registering as a host, we process the data you provide (including name, company, contact and address data, OIB [Croatian tax number], legal form, bank details insofar as required for payment processing, information about your accommodation, and uploaded photos) in order to provide your user account, process the brokerage commission, and display your accommodation on the platform. The legal basis is Art. 6(1)(b) GDPR.

To prove that you are actually authorized to rent out accommodation, we also process your Croatian business licence (Rješenje) or your eVisitor proof. These documents are used exclusively for internal review by adrialo, stored in a separate area not accessible from the outside, and are not published. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing fraudulent listings to protect all users).

5. eVisitor access data

So that your accommodation can be activated, you store your access data (username, password, property/unit code) for the official eVisitor system in your host dashboard. Your eVisitor password is stored encrypted (AES-256) in our database and is only decrypted internally for the purpose of reviewing your accommodation.

If you additionally activate the voluntary option for automated guest registration (see clause 3), this access data is also used to register your guests' travel data via the official eVisitor interface on your behalf. This function is deactivated by default; without your explicit activation, no automated registration takes place. Access to our database and to the decryption key is technically and organizationally restricted to a small circle of persons. The legal basis is Art. 6(1)(f) GDPR.

6. Cancellations and voiding of bookings

If a host reports a guest's wish to cancel, we process the evidence voluntarily uploaded for this purpose (e.g. screenshots of emails or messages from the guest) as well as the date and reason for the cancellation, in order to assess the validity of the cancellation and calculate the cancellation fee. These documents are likewise not publicly visible and are used exclusively internally.

If a booking is instead voided by adrialo itself (e.g. in the event of a violation of our terms of use), the associated booking data remains visible to the affected host for documentation purposes but can no longer be changed. The legal basis in each case is Art. 6(1)(f) GDPR (legitimate interest in clarifying disputes and misuse).

7. Internal notes on host accounts

Our staff may add internal notes to individual host accounts that are not visible to hosts (e.g. notes on conversations or irregularities). These serve exclusively for the internal traceability of our communication and decisions. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in consistent, traceable account management).

8. Payment processing

The guest's rental payment to the respective host and the brokerage commission are processed via our payment service provider Stripe. Your payment data is processed directly by Stripe; we ourselves do not receive or store complete payment card data. Stripe's Privacy Policy (stripe.com/privacy) applies additionally.

9. Support contact form

If you use our support contact form, we process the data you provide (name, email address, message, and any uploaded file attachment) exclusively to process your enquiry. The simple arithmetic question asked in the form serves solely to protect against automated spam and is not stored. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries) or Art. 6(1)(b) GDPR, insofar as the enquiry relates to an existing or prospective contract.

10. Anonymous visitor statistics

In order to gain a rough understanding of how our platform is used (e.g. total number of page views, how often a particular accommodation was viewed), we store an entry with the date, the accommodation viewed (if applicable), and a randomly generated, anonymous identifier for each page view. This identifier is stored locally in your browser (Local Storage) and merely allows us to roughly distinguish returning visits from new visits. There is no association with your name, IP address, or other identifying features, and the data is not passed on to third parties. The legal basis is Art. 6(1)(a) GDPR (your consent via the cookie banner, see clause 13).

11. Security measures

To protect against abusive access attempts (e.g. automated password guessing), we temporarily store the requesting IP address or the affected email address in the event of failed login attempts and for certain email functions. These entries automatically become insignificant again after a short time, since only the last 15 minutes are used for the blocking check. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the IT security of our platform).

12. Disclosure to third parties / processors

For the technical provision of the platform, we use the following service providers, with each of whom a data processing agreement is in place: our hosting provider (ALL-INKL.COM - Neue Medien Münnich, Germany) for server, database, and email delivery, and our payment service provider Stripe for payment processing (see clause 8).

If a host activates automated eVisitor registration (see clause 3), their guests' travel data is additionally transmitted to the Hrvatska turistička zajednica (Croatian National Tourist Board) as the operator of the eVisitor system. This does not constitute conventional data processing on our behalf, but rather a legally mandated report made in the name of and using the access data of the respective host, for the fulfilment of their own statutory reporting obligation. Personal data is not disclosed beyond the purposes stated in this policy.

13. Cookies and Local Storage

Our platform uses technically necessary storage technologies (including Local Storage) to store your language setting and - subject to your consent - for the anonymous visitor count described in clause 10. No cookies are used for third-party advertising or tracking purposes.

On your first visit to our site, you will be asked via a banner to consent to or decline the anonymous visitor count. Your decision is stored locally in your browser. You can change it at any time by deleting the corresponding entry in your browser's site data, after which the banner will appear again.

In addition, we store the language you have selected in a technically necessary cookie ("adrialo_lang", content: only the language code, storage period: 1 year), so that the site is shown directly in your language on your next visit. The legal basis is Section 25(2) No. 2 of the German TDDDG in conjunction with Art. 6(1)(f) GDPR (legitimate interest in a user-friendly presentation).

14. Retention period

We only store personal data for as long as necessary for the stated purposes or as required by statutory retention obligations (in particular tax and commercial law provisions, in Croatia typically 10 or 11 years for invoicing documents). Booking-related data is therefore regularly retained beyond the end of the stay.

15. Your rights

Under the GDPR, you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). To exercise these rights, an informal message to support@adrialo.eu is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority responsible for Bavaria (Bavarian State Office for Data Protection Supervision) or the supervisory authority of your own habitual residence.

16. Amendment of this Privacy Policy

We reserve the right to amend this Privacy Policy in order to adapt it to changed legal frameworks or new platform functions. The version current at the time of your visit applies.

17. Contact

For questions regarding data protection, you can reach us at support@adrialo.eu.