Draft — to be completed with the operator’s details and reviewed by a lawyer before going live.
This notice explains how we handle your personal data when you use this website, book or stay with us. Processing follows the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (ZZPL).
Data controller
[Operator name], registered office: [address], tax number (PIB): [●], registration number (MB): [●]. Email: hello@grandatelier.rs, phone: +381 64 000 0000.
What data we process, why, and on what legal basis
- Booking: name, email, phone, dates of stay, number of guests, notes — to fulfil the booking (performance of a contract, GDPR Art. 6(1)(b)).
- Guest registration on arrival: identity document details we must report under Serbian law (eTurista system) — legal obligation (Art. 6(1)(c)).
- Invoicing and accounting: booking and payment details — legal obligation (Art. 6(1)(c)).
- Contact form: name, email, message, planned dates — to answer your question (Art. 6(1)(b) and (f)).
- Reviews: after your stay we ask for a review by email (legitimate interest, you can opt out at any time); a submitted review is published with your name and country based on your consent (Art. 6(1)(a)).
- Security: Cloudflare Turnstile on the forms and Wordfence on the site use technical data (IP address, browser) to block attacks and automated submissions — legitimate interest (Art. 6(1)(f)).
Who has access to the data
- Our hosting provider: [name, address], where the website and database run.
- Cloudflare, Inc. (Turnstile bot protection) — technical data only.
- Google Ireland Ltd. (Google Maps) — only if you click to load the map.
- Booking.com and Airbnb only receive booked dates through calendar sync, no personal data.
Cloudflare and Google may also process data outside the EU (USA), under the EU–US Data Privacy Framework and standard contractual clauses.
How long we keep data
- Booking, invoicing and guest registration data: as long as Serbian accounting and hospitality laws require.
- Contact messages: up to one year.
- Reviews: until you withdraw your consent.
- Security logs: up to 90 days.
Cookies
This site only uses cookies needed for it to work; no analytics or advertising cookies, so we do not ask for consent.
| Cookie | Purpose | Duration |
|---|---|---|
| WP_SESSION_COOKIE | Remembers your chosen dates between booking steps. | 30 minutes |
| wordpress_* | Administrator login only. | session / 14 days |
Cloudflare Turnstile sets no cookies. Google Maps loads (and may set cookies) only if you click to load the map.
Your rights
You can request access to, correction or deletion of your data, restriction of processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time. Write to hello@grandatelier.rs; we reply within 30 days.
You may lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) and, if you live in the EU, with your national data protection authority.
Effective date and changes
Effective from: [●]. We update this notice when our services change; the current version is always on this page.