CONTROLLER

Njuškalo d.o.o., Zagreb, Miroslava Miholića 2, PIN: 94718723416 (hereinafter: “Njuškalo”).

I attach great importance to personal data protection. My Privacy Policy (hereinafter: “Policy”) regulates how I handle your personal data when you use Njuškalo web portal and our services.


Everything you need to know, explained clearly and transparently:


WHAT KIND OF DATA I COLLECT AND HOW

I value your privacy, which is why I collect only the data necessary to:

  • Provide services and support
  • Improve your user experience
  • Improve content quality and prevent fraud or publication of illegal content
  • Comply with legal regulations, including the Council Directive (EU) 2021/514 (DAC7) and the Digital Services Act (DSA).

You give me your data by filling out the forms when using my services and by sending documents that are legally required or upon special request in that regard. Your data is collected automatically when you use Njuškalo and I may also obtain data when you use our external partners’ services on Njuškalo (e.g. payment confirmation and alike).


I collect the data you enter when:

  • Signing up, posting ads, making purchases on Njuškalo, booking accommodation, filling out surveys, questionnaires and other online forms
  • Reporting illegal content and collecting legally required documents
  • Communicating with other users using messages on Njuškalo
  • Providing support and advice or responding to complaints
  • Paying for services or getting a refund
  • Subscribing to receive additional promotional messages if you are not a registered user

I collect your first and last name, address, contact details, personal identification number, username, photograph used as the profile picture (if allowed), IBAN or other financial data if you use payment services, your date of birth and other information where required by law.


See which data I am obligated to collect and process and for what reason, in accordance with Council Directive (EU) 2021/514 (DAC7) and the Digital Services Act (DSA).


I also automatically collect the data available when you access and use my services, including:

  • Geolocation and cookies (only if their use is allowed)
  • Information about your device (model, device fingerprint, mobile network, etc.)
  • Service usage data that may contain IP addresses, time and duration of access, browser type, method of access to Njuškalo’s website, viewed pages or functions used, usage errors, information about whether you have read our e-mail, taken part in a survey, etc.
  • Content, time and duration of phone conversations with Njuškalo and the phone number from which the call was made, e-mail address from which I got your inquiry, complaint or request

Data obtained from other sources:

  • Other users (e.g. comments, ratings, abuse reports, customer’s delivery address, information needed to book accommodation or alike, information about the person who made the payment)
  • External partners engaged as data controllers within the scope of services provided (e.g. the phone number used for SMS payments). Providing support if your accommodation is booked using another portal and you, as the accommodation provider, are a registered Njuškalo user. Getting into contact with an accommodation provider using another platform for providing Tourism services who also advertises via Njuškalo, etc.)
  • Social media, provided that you have linked your Njuškalo account to a social media account (e.g. user profile name, phone number, e-mail address and other information you have permitted to be used).

I will ask for your additional permission:

  • To collect and process special categories of personal data, such as sexual orientation, health status, religion, etc.
  • To monitor your activities on Njuškalo for the purpose of creating a profile.

Njuškalo services are not intended for persons under the age of 16. I cannot know if the data I collect or process relates to children. If I find that such data is being processed, I will close the user account and initiate the data erasure procedure. In the event that I get contacted by a guardian of a person whose data is processed and the guardian can be identified and has access to personal data via “Moje Njuškalo,” the data may be altered at his/her written request. I advise all parents and guardians to teach children how to handle personal data online in a safe and responsible manner.



HOW I USE YOUR DATA

Data collected and obtained through the provision of services is processed exclusively:

  • For the purposes for which you provided the data, which has been notified to you
  • On legal grounds, i.e. based on legal requirement, legitimate interest, consent or Terms and Conditions of Use (contract).

I may use your personal data to:

  • Provide information and assistance
  • Enable and facilitate the use of Njuškalo services and web portal
  • Customise the content and ads according to your interests
  • Conduct surveys and adjust to your requirements
  • Inform you about new services and service updates
  • Inform you about events and special offers by Njuškalo
  • Prevent fraud or other prohibited or illegal activities
  • Protect the security and integrity of Njuškalo and your data
  • Conduct business and statistical analyses
  • Develop new services and products based on the data provided by you
  • Fulfil legal obligations.

More about automated data processing

If you have consented to the tracking of your activities on Njuškalo, I will create your profile to help me:

  • Show you content that may be of interest to you
  • Offer you a customised price for services
  • Offer you a customised price for services
  • Link your activities with your user profile and the data on that profile.

For example: if I determine that you are not reading the messages I send you by email, I will send you a notification instead. If you frequently post ads, I may offer you a customised price. If you are interested in ads from a particular category, I will show you exactly those. And if you are most active in the evening, that is when I will send you notifications. If I determine that certain notifications are of no interest to you, I will not send them to you until I find something that is just for you.

I do not sell, rent or borrow any user lists or users’ personal data to any third parties.

Data that has been anonymised or aggregated in a way that you can no longer be identified as a natural person is not regarded as personal data.

If I close your user account in accordance with the Terms and Conditions of Using Njuškalo Services, for instance if you breach the Terms and Conditions of Use or fail to confirm that you would like to use our services after 3 years of inactivity, I will start erasing your data. I will keep the data as long as I am obligated to, in accordance with the time limits specified in the section on the right to erasure. During this period, I will use the data only for purposes prescribed by law or for fraud prevention.



HOW I PROTECT YOUR DATA

I know how important your privacy is to you and I take seriously the responsibility I have for your personal data. I protect it from unauthorised access, disclosure, sharing or deletion, regardless of the place of storage, the manner in which it is processed or has been processed, or the format in which it is held

I cooperate with trusted and professional partners obligated to implement high security standards.


I implement recognised IT security standards:

  • Risk-based technical and organisational protection measures are adopted
  • Data collection, storage and methods of processing are verified
  • Data is pseudonymised and anonymised where possible
  • Organisational and technical security measures are tested
  • Measures that can identify and/or prevent unauthorised collection and misuse of personal data and reduce potential harm are taken.

I take measures to ensure data integrity and availability of the processing system, taking into account the best practices and technological advancements. Data is stored in high-availability data centres in Croatia.


Special categories of personal data that I am required to collect due to the legal obligation to verify sellers and accommodation providers, such as a copy of an identity card, are encrypted in storage and used solely for that purpose.

I am aware that there is no fully secure system and that security needs to be constantly upgraded.

You and all other Njuškalo users are my partners in ensuring security.

Update your data regularly and allow me to send you recommendations on how to protect your data from abuse.

Here you can read more about security and security measures you can take yourself.



WHO I SHARE YOUR DATA WITH

Your data is shared only with Njuškalo’s contractual partners. Only the data necessary to provide certain services is shared.

All partners (third parties) who have access to your personal data are obligated to maintain confidentiality and provide appropriate protection of personal data. All persons who have access to your personal data are regularly trained on the importance of personal data protection and are required to adhere to the prescribed procedures.

The data is shared with competent authorities such as the police, the tax administration and other state institutions, where this is a legal obligation. Your data is also shared with internet users and Njuškalo users. You can choose which personal data you want to publish on Njuškalo’s website or share with other users when using Njuškalo’s services.

When posting an ad in the Auto Moto category, you can decide whether the vehicle’s registration plate will be visible in the photo. If you do not want it to be visible, remove it from the photo before posting.

Njuškalo allows internet search engines and artificial intelligence-based search engines to collect data you have made public, as this will help buyers find your ad more easily and quickly.

I do not provide your data to anyone for the training of AI models.


Third parties will process your data only for the purpose of:

  • Providing Njuškalo services, such as: payment services, return calls, data analysis, email or postal delivery, customer support, data validation, data verification for the purpose of preventing fraud and money laundering, posting your accommodation facilities available for booking on the Tourism portal, contracting and providing accommodation services offered via the Tourism portal etc
  • Providing various services to Njuškalo, such as: hosting, IT, accounting and legal, audit and other consultancy services. To provide these services, I rely on the companies within the Styria Media Group whenever possible.
  • When you use the services of Njuškalo’s Tourism portal, Njuškalo and Styria digital marketplaces d.o.o. (Bolha) process data as joint controllers for the purpose of sales, advertising and support
  • When you use Njuškalo messages, Njuškalo PayProtect, or when I send you email messages from the app, I use the service provider Sinch Email based in the USA and transfer only the data necessary for this purpose: your email address and the content of the message. Data in the partner’s system is stored for up to 6 months.
  • To conduct surveys, I use the service provider SurveyMonkey Inc. Only for surveys for which I send invitations by email do I share your email address with the service provider. You can find information on the processing of personal data carried out by SurveyMonkey Inc. as the controller here.
  • If legally required, for complying with applicable laws, subordinate legislation or any other regulations
  • Detecting, preventing or otherwise addressing fraud, security or technical issues pertaining to Njuškalo or users’ personal data.

As part of ad processing (e.g. showing ads based on your behaviour and interests), it is possible to have personal data transferred to third parties registered in the USA (e.g. Google), but only if you have agreed to such data processing. In such data processing activities, third parties identify you through cookies or a technical identifier.

Service providers and third parties will process personal data based on Njuškalo’s instructions and in compliance with this Policy and other applicable regulations (General Data Protection Regulation (EU) 2016/679, Act on the Implementation of the General Data Protection Regulation and other applicable laws, depending on the processing).

Regarding partners registered outside the EU, when transferring data to third countries, data protection is ensured in accordance with applicable regulations and instructions of the European Data Protection Board, as well as under relevant agreements on data transfers to third countries. If the European Commission assesses that the country to which data is transferred cannot ensure data protection, meaning that the service provider is obligated to provide your data to its public authorities for control and monitoring purposes, I also take additional measures – data is anonymised, if possible, a data transfer risk assessment is made and you are informed via this Policy.

For more information about the transfer of data to third parties, please send an e-mail to our Data Protection Officer.



WHAT COOKIES AND TOOLS I USE

I use technical tools to analyse how you use Njuškalo and to collect information I require for business performance analysis and for planning improvements to the website, as well as for preparing data on website traffic that I am legally required to publish in accordance with the DSA requirements.


Said tools may collect and store technical data, such as cookies, IP address you used to access the website, mobile device fingerprint, browser data and alike.


If you have consented to the use of cookies for the purpose of improving service quality and marketing activities, I collect data about your habits and activities to better understand your needs. In doing so, my partners and I use identifiers from your device or browser to display content that may be of interest to you. For this purpose, I use the services of our partner Braze, Inc., which processes your data exclusively in accordance with our instructions and the obligations set out in the Data Processing Agreement.


I manage cookies using the Didomi tool, which allows you to inform yourself about which cookies I use and why, as well as to accept or decline necessary cookies or cookies for services from certain partners. You can always change the settings and restrict the use of cookies and related processing on our website and mobile app.


Necessary cookies are always set, but you can change your PC, browser or mobile device settings to reject or delete necessary cookies and continue using Njuškalo. In that case, some of Njuškalo’s functions will not be fully available. Read more about cookies and find details about necessary cookies here.


If you decide to use Google services and allow Google Analytics tools on our website, here you can inform yourself about how Google manages your data.




HOW I USE SOCIAL MEDIA AND LINKS TO OTHER WEBSITES

To publish content you may be interested in and communicate on social media, Njuškalo uses business profiles and pages on the platforms of the following companies: Meta Platforms, Inc.: Facebook and Instagram, Google LLC, YouTube, Twitter, and TikTok Ltd. When interacting on social media, I collect and process your data, but I do not store it in our systems.


Persons responsible for social media account management can see messages and posts. In exceptional cases, I can store them if I am legally required to do so. On social media platforms I can see statistics about page visits, general interests and demographic data. These statistics do not contain personal data and they help me manage the content I publish and make it as interesting as possible.


If you use social media to interact with our website, the social media platforms transfer data to third countries. They, as the controllers, define which data is used, for what purpose and under which legal basis. The platforms also define the cookies they set and the purpose for which they use them. You can find out more about this in their privacy policies:


Facebook


Instagram


Youtube


Twitter


TikTok


Pinterest




Links to other websites

On Njuškalo, you may find links that lead to websites of other service providers to which this Privacy Policy does not apply.

If you leave the Njuškalo website by following such a link, please familiarise yourself with their privacy policies and how they protect your personal data.



HOW LONG I RETAIN DATA AND THE POSSIBILITY TO RESTRICT PROCESSING

I will retain your data in accordance with applicable regulations or legitimate interests arising from or related to the use of Njuškalo and will delete it upon expiry of the defined retention period.


Records related to financial transactions or invoices must be kept in accordance with legally prescribed deadlines. Other categories of data will be retained for the period I defined for fraud prevention, response to complaints, or other legitimate purposes (2 years), and data entered for delivery purposes will be retained for 6 months. Data I am required to collect by law will be stored for the period prescribed by the relevant legislation – for example, I store reports of suspicious content on Njuškalo for 6 months. If the deletion deadline is extended for technical or other justified reasons, I will inform you in writing.


After your personal data is deleted, your username will be stored in anonymised form and cannot be used again. This ensures that no one can impersonate you on Njuškalo by using the username you previously used.


Options to restrict data processing

You can restrict the use of your email address for receiving Njuškalo notifications at any time by adjusting the settings in the “Moje Njuškalo” interface.

You can unsubscribe from the list for receiving additional promotional offers you previously consented to via the link provided in the email message.

When posting an accommodation unit, the accommodation provider can choose to restrict the sharing of the IBAN with the guest in the booking confirmation, for the purpose of additional payment for the accommodation.

If you have accepted activity tracking and profiling, you can withdraw your consent and restrict such processing at any time through the Didomi tool in your web browser or by changing the settings on your device.

HOW YOU WILL EXERCISE YOUR RIGHTS

You can file a request for data erasure, data rectification, restriction of processing, data transfer and data access.


If you have any objections regarding data processing or your rights, feel free to contact me in confidence. If we cannot resolve your complaint, you may file a complaint to the Croatian Personal Data Protection Agency as the competent authority.


The request may be rejected if your identity as the owner of the personal data cannot be verified or if there are any other legal restrictions. If I cannot identify you based on the data entered in the user profile, I may request additional data that I will use to try to identify you so that I can help you exercise your rights.


If you use Njuškalo on behalf of another person or company, I will not be able to identify you personally. In that case, you may exercise your request only with the approval and request of that person or company.


Regarding advanced Njuškalo services, I use service providers that can act as controllers, in which case they define which data they require and why. You will receive this information when you start using such services and before collecting data on behalf of another controller. Read all about data protection in their privacy policies before you start using their services. Make sure to check how you can exercise your rights and contact the relevant controller for additional information. I have no access to the data processed by other controllers.


In case of any ambiguities, contact me and I will try to help you exercise your rights. If you do not want to use services involving other controllers, you can continue using other Njuškalo services.



Right to erasure

At any moment, you may request that I erase personal data collected during the use of Njuškalo services or restrict the purpose of using your data, either in part or in whole.

If you have a Njuškalo user account, you should submit the account closure and data erasure request via the “Moje Njuškalo” interface. If you have any unconfirmed purchases and payments under the Njuškalo PayProtect service, I will warn you to complete the transactions before initiating the user account closure and data erasure procedure.

Upon receipt of the data erasure request, I will confirm that the request has been received and the account closure and data erasure procedure will be initiated. Any unauthorised attempt to close your account and erase data can be cancelled within 24 hours from receiving the notification thereof, or until midnight on the following day at the latest. After this time has passed, I will restrict the processing of your data and initiate the erasure procedure.

If you do not have a Njuškalo user account because you used services for which signing up is not necessary (for example, you booked accommodation and made the required payment for such booking), if you reported prohibited content on Njuškalo, or if you are unable to log in, you may send me a request to exercise your rights from the email address which you used for the relevant service, to the address podrska@njuskalo.hr.



Right to data portability

As the owner of an active user account, you can at any moment submit a request for transfer of your data and content for the purpose of their use by another service provider.

You can download your data yourself via the “Moje Njuškalo” interface for registered users.


You can download the following data in digital form:

  • Your contact details
  • Your ads which are available to you when you log in your Njuškalo user account
  • Accommodation units, if you are an accommodation provider.

I protect the privacy of users of my services and do not allow the download of any content that could harm your rights or the rights of other users.

Due to technical limitations, I cannot enable automated data transfer to another service provider.



Right to information (data access)

You are the owner of your data and you have the right to know what data I store or process. You can also submit a request for additional information.


You can check your basic data via the “Moje Njuškalo” interface for registered users.


If you would like to get more information or if you are not a registered Njuškalo user, please send a request to the email address podrska@njuskalo.hr.



Right to data rectification

It is important that your data is accurate, so please check it from time to time.

To help you in that regard, I can also check the accuracy of the data, as technically and legally permissible. For instance, I can verify your phone number, email address or other data. I will send you reminders about the importance of using accurate data. Please rectify your data via the "Moje Njuškalo" interface.


Rectification of the country indicated in your profile can be achieved by sending a written request using the email address registered in your user account to podrska@njuskalo.hr or to your sales consultant.

If you do not have a user account or if you are unable to change your email address or PIN via “Moje Njuškalo,” please send a written request to my address or an email to podrska@njuskalo.hr.

If I determine that you are unlawfully using another person’s personal data or failing to keep your data up to date, I will suspend your user account.


Username cannot be changed, so it is important that you follow the instructions on choosing the username and password..



NOTICE ON CHANGES TO THE POLICY AND CONTACT INFORMATION

These rules may be occasionally changed. Any changes to this Policy will be published on www.njuskalo.hr together with this Privacy Policy. In case of any significant changes, you will also be informed appropriately. Previous versions of the Privacy Policy may be requested via the contact form.


By registering or continuing to use Njuškalo after the Policy has been amended, you confirm that you are familiar with the applicable rules and that you agree to have your data processed for the purposes specified.


Any inquiries and remarks regarding this Policy as well as any additional information about your personal data collected on Njuškalo website can be submitted to the Data Protection Officer:

  • In writing, sent to Njuškalo’s head office
  • By email, sent to zop@njuskalo.hr.

Changes:

  • I no longer use MyRent IT services for the Tourism section.
  • I have adjusted the content for improved readability and clarified the automated data processing.

In case of any discrepancies, the Croatian language version of this Policy shall prevail, including with respect to the effective date of the Policy.


The Policy was amended on 01.09.2025.