Last updated: 15 March 2026
1. Who we are
Boris Boats, obrt za usluge, trading as Boka Boats ("we", "us", "our"), is a family-run boat rental and tour business based in Hvar, Croatia. We are the data controller for the personal data described in this policy.
- Business name: Boris Boats, obrt za usluge (trading as Boka Boats)
- Address: Šetalište Put Križa 3, 21450 Hvar, Croatia
- Email: info@boatrenthvar.com
- Website: boatrenthvar.com
2. What data we collect
We collect personal data only when necessary to provide our services:
2.1 Booking & contact forms
- Full name
- Email address
- Phone number (optional)
- Preferred dates, group size, and special requests
- Boat licence photo (for self-drive rentals — required by Croatian maritime law)
2.2 Payment data
Payment processing is handled by Stripe and PayPal. We do not store credit card numbers or full payment details on our servers. When you pay online, you are redirected to a secure payment page provided by Stripe (which also supports Apple Pay and Google Pay) or PayPal to complete your transaction.
2.3 Automatically collected data
When you visit our website, our hosting provider may collect standard server logs including your IP address, browser type, referring page, and pages visited. This data is used for security and performance purposes only.
3. Why we process your data (legal basis)
Under the EU General Data Protection Regulation (GDPR), we process your data based on:
- Contract performance (Art. 6(1)(b)): To process your booking, confirm reservations, and provide the boat rental or tour service you requested.
- Legal obligation (Art. 6(1)(c)): To comply with Croatian maritime regulations (e.g., verifying your boat licence for self-drive rentals).
- Legitimate interest (Art. 6(1)(f)): To respond to your enquiries, improve our services, and maintain website security.
- Consent (Art. 6(1)(a)): For any optional cookies or marketing communications — you can withdraw consent at any time.
4. How we use your data
- Processing and confirming your bookings
- Communicating with you about your reservation (email, WhatsApp)
- Verifying your boat licence as required by law
- Responding to enquiries submitted via our contact form
- Improving our website and services
- Complying with legal and regulatory obligations
5. Who we share your data with
We only share your data with trusted third parties who help us deliver our services:
- Booking system provider: To process reservations and send confirmations.
- Payment processors: Stripe and PayPal — to securely handle online payments. Subject to Stripe's Privacy Policy and PayPal's Privacy Policy.
- Hosting & infrastructure: Vercel (website hosting), Sanity (content management) — both with servers in the EU/EEA or with adequate safeguards.
- Google Maps: Embedded maps on our contact and about pages. Subject to Google's Privacy Policy.
We do not sell your personal data to third parties.
6. Data retention
- Booking data: Retained for up to 5 years after your last booking, as required for accounting and legal purposes under Croatian law.
- Contact form submissions: Retained for up to 12 months after your enquiry is resolved.
- Boat licence photos: Deleted within 30 days after the rental period ends, unless required for an ongoing legal matter.
- Server logs: Automatically deleted after 30 days.
7. Your rights under GDPR
As an EU resident, you have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Ask us to correct inaccurate or incomplete data.
- Erasure: Request deletion of your data ("right to be forgotten").
- Restriction: Ask us to limit how we process your data.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interest.
- Withdraw consent: Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email us at info@boatrenthvar.com. We will respond within 30 days.
8. International data transfers
Your data is primarily processed within the EU/EEA. Where third-party services process data outside the EEA, they do so under Standard Contractual Clauses (SCCs) or other GDPR-compliant safeguards.
9. Data security
We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, secure hosting infrastructure, and access controls.
10. Children's privacy
Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. Cookies
For details on how we use cookies and similar technologies, please see our Cookie Policy.
12. Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP):
- Website: azop.hr
- Email: azop@azop.hr
13. Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.
