Privacy Policy

Privacy Policy

This policy explains what personal data we collect when you book a ride, for what purposes and on what legal basis, and what your rights are under the General Data Protection Regulation (GDPR).

Last updated: July 2026

1. Data controller

The controller of your personal data is PLAVA LAGUNA d.o.o. Contact details are shown at the bottom of this page.

2. What we collect

When you book online we collect only the data needed to run the ride:

  • the name of the person making the booking,
  • an email address (to send the ticket and receipt) or a phone number,
  • ride details: date, departure, number and type of seats and any note,
  • technical data needed for abuse protection (e.g. Google reCAPTCHA / App Check).

3. Purposes and legal basis

  • performance of the ride booking contract (Art. 6(1)(b) GDPR),
  • compliance with legal obligations, e.g. issuing and keeping invoices (Art. 6(1)(c)),
  • legitimate interest in preventing fraud and abuse of the booking system (Art. 6(1)(f)).

4. Card payment

Card payments are processed by the payment provider CorvusPay. You enter card details directly on their secure page; we never see or store your full card number.

5. Recipients and processors

We process your data with the help of trusted service providers, solely for the purposes stated:

  • Google Firebase (Google Ireland Ltd.) — hosting and server logic, in the EU region (europe-west3),
  • CorvusPay — card payment processing,
  • email delivery provider — sending the ticket and receipt.

6. Data retention

We keep booking data and invoices for as long as required by Croatian tax and accounting law (generally up to 11 years). Other data is kept only as long as needed for the purposes above.

7. Cookies

The site uses only strictly necessary cookies, including those set by Google reCAPTCHA / App Check for abuse protection. We use no advertising cookies and no visitor-analytics tools.

8. Your rights

You have the right at any time to:

  • access your data and have it corrected or erased,
  • restrict or object to processing, and to data portability,
  • lodge a complaint with the supervisory authority — the Croatian Personal Data Protection Agency (AZOP), https://azop.hr.

9. Changes and contact

We may update this policy from time to time; the new version is published on this page. To exercise your rights or for privacy questions, contact us at the email in the company details.