CONTROLLER

Njuškalo d.o.o., Zagreb, Miroslava Miholića 2, PIN: 94718723416 (hereinafter: “Njuškalo”).

We at Njuškalo

attach great importance to personal data protection. Our Privacy Policy (hereinafter: “Policy”) regulates how we handle your personal data when you use Njuškalo web portal and our services.


Everything you need to know, explained clearly and transparently:


WHAT KIND OF DATA IS COLLECTED AND HOW?

We value your privacy, which is why we collect only the data necessary to:

  • provide services and support
  • improve your user experience
  • improve existing services and inform you about new services developed for you
  • improve content quality and prevent fraud or publication of illegal content
  • comply with legal regulations, including the Council Directive (EU) 2021/514 (DAC7) and the Digital Services Act (DSA).

You give us your data by filling out the forms when using our services, by sending the legally defined documents or upon special request in that regard; your data is collected automatically when you use Njuškalo and we may also obtain data when you use our external partners’ services on Njuškalo (e.g. payment confirmation).


We collect the data entered when:

  • signing up, posting ads, making purchases on Njuškalo, booking accommodation, filling out surveys, questionnaires and other online forms
  • reporting illegal content and collecting legally defined documents
  • communicating with other users using Njuškalo messages
  • providing support and advice or responding to complaints
  • paying for services or getting a refund
  • performing other activities on Njuškalo.

In that regard, we collect your first and last name, address, contact details, personal identification number, username, photograph used as the profile picture (if allowed), IBAN or other financial data if you use payment services and other information necessary to use our services.


See which data we are obligated to collect and process and for what reason, in accordance with Council Directive (EU) 2021/514 (DAC7) and the Digital Services Act (DSA).


We may also automatically collect the data available when accessing and using Njuškalo, including:

  • geolocation and cookies (only if their use is allowed)
  • information about your device (model, device identifier, device fingerprint, mobile network, etc.)
  • service usage records that may contain IP addresses, time and duration of access, browser type, type of access to Njuškalo’s website, viewed pages or functions used in the mobile app, usage errors, etc.
  • content, time and duration of phone conversations with Njuškalo and the phone number from which the call is made
  • type of services you use, when and how.

Data obtained from other sources:

  • other users (e.g. comments, ratings, abuse reports, customer’s delivery address, information about guests, etc.)
  • external partners engaged as data controllers within the scope of services provided (e.g. the phone number used for SMS payments, verification, or providing support if your accommodation is booked using another portal and you, as the accommodation provider, are a registered Njuškalo user, or for getting into contact with an accommodation provider using another platform for providing Tourism services who also advertises via Njuškalo, etc.)
  • social media, provided that you have linked your Njuškalo account to a social media account (e.g. user profile name, phone number, e-mail addrevss and other information you have permitted to be used).

We will ask for your additional permission:

  • to collect and process special categories of personal data, such as sexual orientation, health status, religion, etc.

Njuškalo’s services are not intended for persons under the age of 16. We cannot know if the data collected or processed relates to children. If we find that such data is processed, we will close the user account and initiate the data erasure procedure. In the event that we get contacted by a guardian of a person whose data is processed and the guardian can be identified and has access to personal data via “Moje Njuškalo”, the data may be altered at his/her written request. We advise all parents and guardians to teach children how to handle personal data online in a safe and responsible manner.



HOW WE USE YOUR DATA

Data collected and obtained through the provision of services is processed exclusively:

  • for the purposes for which the data has been provided
  • for the purposes for which you have given your consent
  • on legal grounds, i.e. under applicable legal regulations, legitimate interest, consent or Terms and Conditions of Use (contract).

We may use your personal data to:

  • provide information and assistance
  • enable and facilitate the use of Njuškalo’s services and web portal
  • customise the content and ads according to your interests
  • conduct surveys and adjust to your requirements
  • inform you about new services and service updates
  • inform you about events and special offers by Njuškalo
  • prevent fraud or other prohibited or illegal activities
  • protect the security and integrity of Njuškalo and your data
  • conduct business and statistical analyses
  • develop new services and products accordingly
  • fulfil legal obligations.

We do not sell, rent or borrow any user lists or users’ personal data to any third parties.

Data that has been anonymised or aggregated in a way that you can no longer be identified as a natural person is not regarded as personal data.

If your user account is closed in accordance with the Terms and Conditions of Using Njuškalo Services, for instance if you breach the Terms and Conditions of Use or fail to confirm that you would like to use our services after 3 years of inactivity, we will start erasing your data and keep it only as long as we are obligated to, in accordance with the time limits specified in the section on the data retention period and restriction of processing.



HOW WE PROTECT YOUR DATA

We are fully committed to protecting data from unauthorised access, disclosure or erasure, regardless of the storage or processing location or the format of the data.

We cooperate with trusted and professional partners obligated to implement high security standards.


We implement recognised IT security standards:

  • risk-based technical and organisational protection measures are adopted
  • data collection, storage and types of processing are verified
  • data is pseudonymised and anonymised where possible
  • organisational and technical protection measures are tested
  • measures that can identify and/or prevent unauthorised collection and misuse of personal data and reduce potential harm are taken.

We take measures to ensure data integrity and availability of the processing system, taking into account the latest technological advancements. Data is stored in high-availability data centres in Croatia.


We are aware that there is no fully secure system and that security needs to be constantly upgraded.

You and all other Njuškalo users are our partners in ensuring security. Update your data regularly and allow us to send you recommendations on how to protect your data from abuse.

Here you can read more about security and security measures you can take yourself.



WHO WE SHARE YOUR DATA WITH

Your data is shared only with our contractual partners. Only the data necessary to provide certain services is shared. Any person with access to your data as well as our partners assume the obligation of confidentiality as part of the contractual relationship and they are also obligated to implement organisational and technical protection measures.

Your data is also shared with internet users and Njuškalo users. You can choose which personal data you want to publish on Njuškalo’s website or share with other users when using Njuškalo’s services.


Third parties will process your data only for the purpose of:

  • providing Njuškalo’s services, such as: payment services, data analysis, electronic or regular mail delivery, customer support, data validation, data verification for the purpose of preventing fraud and money laundering, posting your accommodation available for booking on the Tourism portal, etc.
  • providing various services to Njuškalo, such as: hosting, IT, accounting and legal, audit and other consultancy services. To provide these services, we rely on the companies within the Styria Media Group whenever possible.
  • When you use the services of Njuškalo’s Tourism portal, Njuškalo and Styria digital marketplaces d.o.o. (Bolha) process data as joint controllers for the purpose of sales, advertising and support. For such services, we rely on the MyRent platform, all in accordance with the relevant data processing agreements.

If so prescribed by the law, data is also processed for the purpose of:

  • complying with applicable laws, subordinate legislation or any other regulations
  • detecting, preventing or otherwise addressing fraud, security or technical issues pertaining to Njuškalo or users’ personal data.

When you use Njuškalo messages or Njuškalo PayProtect, or when we send you e-mails from the app, we use the service provider Mailgun with registered office in the USA, and we transfer only the data necessary for the this purpose: e-mail address and message content. The data is kept in the partner’s system up to 6 months.


As part of ad processing (e.g. showing ads based on your behaviour and interests), it is possible to have personal data transferred to third parties registered in the USA (e.g. Google), but only if you have agreed to such data processing based on cookies or other technical identifiers.


Service providers and third parties will process personal data based on Njuškalo’s instructions and in compliance with this Policy and other applicable regulations (General Data Protection Regulation (EU) 2016/679, Act on the Implementation of the General Data Protection Regulation and other applicable laws, depending on the processing).


Regarding partners registered outside the EU, when transferring data to third countries, data protection is ensured in accordance with applicable regulations and instructions of the European Data Protection Board, as well as under relevant agreements on data transfers to third countries. If the European Commission assesses that the country to which data is transferred cannot ensure data protection, meaning that the service provider is obligated to provide your data to its public authorities for control and monitoring purposes, we also take additional measures – data is anonymised if possible, a data transfer risk assessment is made and you are informed via this Policy.


Njuškalo allows search engines to collect data that you published, so that buyers could find your ad more easily and quickly.


For more information about the transfer of data to third parties, please send an e-mail to our Data Protection Officer.



WHAT COOKIES AND TOOLS WE USE

We use tools to analyse how you use Njuškalo and to collect information about your habits and activities, which allows us to better identify your needs and improve the quality of our offer.


We use our own and our partners' cookies to identify your computer and provide you with a better service or ads you are interested in.


Data collected is not linked to your personal data on Njuškalo’s website.

Said tools may collect and store technical data, such as cookies, user and/or visitor IP address, mobile device identifier, browser data and alike, but without identifying the person.


We manage cookies using the Didomi tool, which allows you to inform yourself about which cookies we use and why as well as to accept or decline necessary cookies or cookies from certain partners. You can limit the use of cookies and related processing on our website and mobile app.


Necessary cookies are always set, but you can change your PC, browser or mobile device settings to reject or delete necessary cookies and continue using Njuškalo. In that case, some of Njuškalo’s functions will not be fully available. Read more about cookies and find details about necessary cookies here.


If you decide to use Google services and allow Google Analytics tools on our website here you can inform yourself about how Google manages your data.




SOCIAL MEDIA

To publish content you may be interested in and communicate on social media Njuškalo uses business profiles and pages on the platforms of the following companies: Meta Platforms, Inc.: Facebook and Instagram, Google LLC, YouTube, Twitter, TikTok Ltd and Pinterest Inc. When interacting on social media, we collect and process your data, but we do not store it in our systems.


Persons responsible for social media account management can see messages and posts. In exceptional cases, we can store them if we are legally required to do so. If you visit our pages on social media platforms, we can see statistics about page visits, general interests and demographic data. These statistics do not contain personal data and they help us manage the content we publish and make it as interesting as possible.


If you use social media to interact with our website (Facebook, Instagram, YouTube, Twitter, TikTok, Pinterest), these platforms transfer data to the USA and they, as the controllers, define which data is used, for what purpose and under which legal basis. The platforms also define the cookies they set and the purpose for which they use them. You can find out more about this in their privacy policies:


Facebook


Instagram


Youtube


Twitter


TikTok


Pinterest




HOW YOU WILL EXERCISE YOUR RIGHTS

You can file a request for data erasure, data rectification, restriction of processing, data transfer and data inspection.


If you have any objections regarding data processing or your rights, feel free to contact us in confidence. If we cannot resolve your complaint, you may file a complaint to the Croatian Personal Data Protection Agency as the competent authority.


The request may be rejected if your identity as the owner of the personal data cannot be verified or if there are any other legal restrictions. If we cannot identify you based on the data collected, we will request a partial copy of your personal ID document.


If you use Njuškalo on behalf of another person or company, we will not be able to identify you. In that case, you may exercise your request only with the approval and request of that person or company.


Regarding advanced Njuškalo services, we use service providers that can act as controllers, in which case they define which data they require and why. You will receive this information when you start using such services and before collecting data on behalf of another controller. Read all about data protection in their privacy policies before you start using their services. Make sure to check how you can exercise your rights and contact the relevant controller for additional information. We have no access to the data processed by other controllers. In case of any ambiguities, contact us and we will try to help you exercise your rights. If you do not want to use services involving other controllers, you can continue using other Njuškalo services.



RIGHT TO ERASURE AND RESTRICTION OF PROCESSING

At any moment, you may request us to erase personal data collected during the use of Njuškalo’s services or to restrict the purpose of using your data, either in part or in whole.

Request for personal data erasure can be submitted to our address in writing, verbally or by e-mail to podrska@njuskalo.hr.


If you have a Njuškalo user account, you should submit the account closure and data erasure request via the “Moje Njuškalo” interface. If you have any unconfirmed purchases and payments under the Njuškalo PayProtect service, we will warn you to complete the transactions before initiating the user account closure and data erasure procedure.


Upon receipt of the data erasure request, we will confirm that the request has been received and the account closure and data erasure procedure will be initiated. Any unauthorised attempt to close your account and erase data can be cancelled within 24 hours from receiving the notification thereof, or until midnight on the following day at the latest. After 24 hours have passed, the processing of your data will be restricted and the erasure procedure will be initiated.

If you do not have a Njuškalo user account because you used services for which signing up is not necessary (for example, you booked accommodation and made the required payment for such booking), if you reported prohibited content on Njuškalo or if you are unable to log in, you may send us a request to exercise your rights from the e-mail address which you used for the relevant service to our address: podrska@njuskalo.hr.


DATA RETENTION PERIOD AND RESTRICTION OF PROCESSING

Your data will be kept depending on its purpose and in accordance with the applicable regulations or legitimate interests arising out of or in relation with the use of Njuškalo. Upon expiration of the specified time limit, the data will be erased.


For example, records of financial transactions or invoices must be kept in accordance with a legally defined time limit, whereas other categories of data will be kept by the time limit we have specified for preventing fraud, responding to complaints or other legitimate purposes (2 years). Shipping details will be kept for 6 months. Data which we are obligated to collect in accordance with the law will be kept for as long as the law stipulates, e.g., for 6 months after questionable content on Njuškalo has been reported. If the time limit for erasure is extended due to technical or other justified reasons, you will be notified in writing. After your personal data has been erased, the username will be kept in an anonymised form and it will not be possible to reuse it. This ensures that nobody can use your username on Njuškalo.


At any moment, you may restrict the use of the e-mail address for receiving notices and promotional messages by Njuškalo.

You can modify your data and settings using the “Moje Njuškalo” interface or simply unsubscribe from the newsletter list via the link found in the e-mail.

When posting an ad for their accommodation facility, accommodation providers may restrict the sending of their IBAN to the person booking accommodation in the booking confirmation, for the purpose of additional payment for such accommodation.



RIGHT TO DATA PORTABILITY

As the owner of an active user account, you can at any moment submit a request to have your data and content transferred to another service provider.

You can download your data yourself via the “Moje Njuškalo” interface for registered users.


You can download the following data in digital form:

  • your contact details
  • your ads available when you log in your Njuškalo user account.

We protect the privacy of our users and do not allow the download of any content that could harm your rights or the rights of other users.

Due to technical limitations, we cannot enable automated data transfer to another service provider.



RIGHT TO INFORMATION (DATA ACCESS)

You are the owner of your data and you have the right to know what data is stored or processed. You can also submit a request for additional information.


You can check your basic information via the “Moje Njuškalo” interface for registered users.


If you would like to get more information or if you are not a registered Njuškalo user, please send a written request to our address or an e-mail to podrska@njuskalo.hr.



RIGHT TO DATA RECTIFICATION

It is important that your data is accurate, so please check it from time to time.

To help you in that regard, we can also check the accuracy of the data as technically and legally permissible. For instance, we can verify your phone number, e-mail address or other data. We will send you reminders on the importance of using accurate data. Please rectify your data via the "Moje Njuškalo" interface.


Rectification of PIN and country in your profile can be achieved by sending a written request using the e-mail address registered in your user account to podrska@njuskalo.hr or to your sales consultant.

If you do not have a user account or if you are unable to change your e-mail via “Moje Njuškalo”, please send a written request to our address or an e-mail to podrska@njuskalo.hr.


Username cannot be changed, so it is important that you follow the instructions on choosing the username and password.



LINKS TO OTHER WEBSITES

Njuškalo’s website may contain links to websites of other service providers to which our Privacy Policy does not apply.


If you leave Njuškalo’s website using a certain link, please familiarise yourself with other service providers’ privacy rules and find out how they protect your personal data.



NOTICE ON CHANGES TO THE POLICY AND CONTACT INFORMATION

These rules may be occasionally changed. Any changes to this Policy will be published on Njuškalo’s website together with this Privacy Policy. In case of any significant changes, you will also be informed appropriately. Previous versions of the Privacy Policy may be requested via the contact form.


By registering or continuing to use Njuškalo after the Policy has been amended, you confirm that you are familiar with the applicable rules and you agree to have your data processed for the purposes specified above.


Any inquiries and remarks regarding this Policy as well as any additional information about your personal data collected on Njuškalo’s website can be submitted to Njuškalo’s Data Protection Officer:


The Policy was amended on 12/11/2024 and it applies as of 12/11/2024.


Policy changes:

  • Details regarding usage of TikTok platform.