Privacy Policy

This Privacy Policy of company MT Management d.o.o. (ltd.) of 20236 Lozica (Dubrovnik), Lozica 51, Personal (Company) ID no. 08788791782 (hereinafter: Controller), has been prepared pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).

The Controller undertakes to handle your data in accordance with the General Data Protection Regulation, the Act on the Implementation of the General Data Protection Regulation (Official Gazette no. 42/2018) and other applicable national laws, and to apply appropriate technical and organizational measures to prevent unauthorized access to personal data, their misuse, disclosure, loss or destruction.

General Information

This Policy describes which data we collect, how we process and use them, and your rights related thereto.

Company responsible for data processing: MT Management d.o.o. (ltd.), Lozica 51, 20236 Lozica (Dubrovnik), Personal (Company) ID no. 08788791782

Property: Dominus Little Palace, Od Domina 10, 20000 Dubrovnik

E-mail: info@dominus-dubrovnik.com

Phone and WhatsApp: +385 91 111 2240

If we use service providers for processing your data, the processing is performed on our behalf and based on our instructions, and we remain responsible for the protection of your data.

Types of Processed Data

We process the data you entrust to us when visiting our website, booking accommodation, using our contact form, contacting us by e-mail, phone or WhatsApp, staying at our property or entering into a business relationship with us.

Contact form and inquiries: name and surname, e-mail address, phone number (optional), room of interest, planned dates of stay and number of guests (optional) and the content of your message. To protect the form from spam, we also process technical data such as your IP address and browser information (see Use of Digital Services).

Booking: name and surname, e-mail address, phone number, country, dates of stay, room type, number of guests, special requests and payment data needed to secure the booking. Bookings on our website are made through the Rentlio booking engine, which processes the data on our behalf. Payment card data is processed by the booking engine and its payment provider and is not stored by us.

Guest registration: Croatian law requires us to register every guest in the national eVisitor system. For this purpose we collect name and surname, date and place of birth, sex, nationality, type and number of identity document, address of permanent residence and dates of arrival and departure. Without these data we are not allowed to accommodate you.

Business partners: name and surname, position, company, business e-mail address and phone number of contact persons at our business partners and suppliers.

Video surveillance: when entering the range of the Controller’s video surveillance, personal data on a video recording may be collected. Video recordings are kept based on the Controller’s legitimate interest for the protection of people and property.

Within the framework of a contractual relationship, you are obliged to provide the data necessary for its establishment and performance, as well as data required by law. Without such data, we are forced to decline the booking or the agreement. You are not obliged to give your consent to the processing of data which are not necessary for the agreement or required by law.

Legal Ground and Purpose of Data Processing

The Controller processes your data for the following purposes:

Meeting legal obligations: guest registration, tourist tax, accounting and tax obligations, and reporting to competent authorities;
Agreement execution: confirming and managing your booking and providing your stay;
Answering your inquiries and preparing offers at your request;
Sending offers and other information, only based on your given consent;
Protection of people and property: video surveillance based on the Controller’s legitimate interest;
Operation and security of the website, protection of the contact form from spam and anonymous visitor statistics, based on the Controller’s legitimate interest;
Google Analytics and Google Maps, only based on your consent (see Use of Digital Services).

All of your personal data are processed based on a law, agreement, consent or legitimate interest.

Retention Period

Your data are kept only as long as necessary for the purpose for which they were collected. Inquiries that do not lead to a booking are kept only as long as needed to answer them and for any related follow-up communication, and are then deleted. Booking and accounting data are kept for the period required by accounting and tax laws. Guest registration data are kept for the period required by the applicable regulations. Video recordings are kept no longer than 6 months, unless needed as evidence in legal proceedings. Records of cookie consent decisions are kept for 12 months. Data processed based on consent are kept until you revoke your consent.

Managing Consent to Data Processing

Your consent may be revoked, partially or in full, at any time by sending an e-mail to info@dominus-dubrovnik.com or regular mail to Lozica 51, 20236 Lozica (Dubrovnik). Consent to cookies can be changed at any time through the “Manage consent” link at the bottom of our website.

If you revoke your consent, your data will no longer be used for the above purposes. Revocation of consent does not affect the legality of processing based on consent before its revocation.

If you want to give your consent again, you can use the same procedure.

Data Subjects’ Rights

Right of access: you may request information on whether and how we process your data and a copy of your data.
Right to rectification: if we process incomplete or inaccurate data, you may request their rectification or supplementation.
Right to erasure: you may request deletion of your personal data when there is no longer a legal reason to keep them.
Right to restriction of processing: you may request restriction of processing if you contest the accuracy of the data, if the processing is unlawful but you do not want the data deleted, or if you need the data for legal claims.
Right to object: you may object to processing based on our legitimate interest, and at any time to processing for direct marketing.
Right to data portability: you may request your data in a structured, commonly used and machine-readable format, if the processing is based on consent or agreement and carried out by automated means.
Right to lodge a complaint: if you believe that we have violated data protection regulations, please contact us first so we can resolve the issue. You are also entitled to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Selska cesta 136, 10000 Zagreb, azop@azop.hr.

We will reply to your request within one month. In case of doubt, we may request additional data to verify your identity, which serves to protect your rights.

Exercising your rights is free of charge. If a request is clearly unfounded or excessive, in particular because it is repeated, we may charge a reasonable administrative fee or refuse to act on it.

Transfer of Data to Third Parties

We do not sell your personal data. We share them only in the following cases:

with service providers who process data on our behalf: the Rentlio booking engine, website hosting, e-mail service, Cloudflare (spam protection of the contact form), Google (website analytics and maps, only with your consent) and our accounting service;
with online travel agencies (e.g. Booking.com) if you booked through them, and with payment service providers;
with the eVisitor system and tourist boards for guest registration;
with the Tax Administration, the Ministry of the Interior, the State Attorney’s Office, courts and other competent authorities, when required by law;
if you explicitly agree to it.

Some providers, such as Google, Cloudflare and WhatsApp (Meta), may transfer data outside the European Union. Such transfers are based on the EU–US Data Privacy Framework or on the Standard Contractual Clauses of the European Commission.

Use of Digital Services (Website)

When you visit our website, technical data such as IP address, browser type, operating system, pages visited and time of access are recorded in order to display the website correctly and keep it secure. Fonts and other files of the website are served from our own server and are not loaded from third parties.

Visitor statistics: we count visits to our website with a statistics tool that runs on our own server and does not use cookies. It records which pages are visited, the referring website and clicks on links such as “Book Now”, without identifying individual visitors. The data are not shared with third parties. We do this based on our legitimate interest in understanding how our website is used.

Spam protection: our contact form is protected by Cloudflare Turnstile, which checks technical signals of your browser (such as IP address and browser characteristics) to distinguish people from automated programs. These data are used only for this check, based on our legitimate interest in protecting the form from abuse.

Cookie consent: your choice in the cookie banner is stored in your browser so that we can respect it on your next visit. We also keep a record of each consent decision (which categories were allowed, when, and for which version of the banner) in our website’s database, to be able to demonstrate that consent was given. These records do not identify you personally.

We collect other personal data only when you voluntarily provide them, for example through the contact form or the booking engine. These data are used confidentially and only for the purpose of the form.

Our website uses cookies. Strictly necessary cookies are used without consent, while analytics cookies (Google Analytics) and external content (Google Maps) are used only with your consent. More information is available in our Cookie Policy.

If you contact us via WhatsApp, the message is also processed by WhatsApp under its own privacy policy.

Technical and Organizational Measures

We have undertaken all appropriate technical and organizational measures to protect your data from loss, modification and unauthorized access, including an encrypted connection (HTTPS) on the entire website and access to personal data restricted to authorized persons only. If you have any questions, do not hesitate to contact us. We will reply as soon as possible and help you exercise your rights.

Any amendments to this Privacy Policy will be published on our website.

Last updated: 23 October 2026