Privacy Policy

Last updated: August 9, 2026.

This Privacy Policy explains how Navigate Croatia processes personal data relating to visitors of the public catalog, boat owners, administrators, and other people who interact with the platform. Navigate Croatia is an online lead-generation and listing platform for charter boats on the Croatian Adriatic. In the current version of the service, bookings, payments, and charter contracts are not concluded on the platform itself; they are arranged directly between the guest and the boat owner.

1. Who is the controller

The controller for Navigate Croatia is BeeDigital d.o.o., Miroslava Krleže 22, 34000 Požega, Croatia, OIB/VAT ID: HR69213629245. For privacy questions, use the contact form with the subject line “Privacy Request”.

2. What data we collect

Depending on platform usage, the following categories of data may be processed:

  • account and authentication data: first name, last name, email address, phone number, chosen sign-in method, and security data linked to the account;
  • listing and owner data: boat name, description, price, marina, specifications, photos, and the owner profile contact details the owner chooses to make available after a “Show contact details” action;
  • usage and security data: IP address, access time, session identifier, CSRF token, locale preference, and basic technical data needed to operate, secure, and rate-limit the platform; after consent, limited first-party public-funnel events may also be recorded without form content;
  • contact-reveal data: which boat was opened, when it was opened, which channels were shown, whether the event was unique within the session, and the date of the event;
  • public boat inquiry data: full name, email address, phone number if provided, approximate travel dates, guest count, message content, locale, IP address, and basic attribution metadata connected to a public inquiry;
  • support and communication data: the content of messages sent to us, bug reports, and administrative correspondence;
  • cookie and analytics consent data: whether analytics was accepted or rejected and a technical record of that choice stored locally on the device;
  • social sign-in data, if enabled: when sign-in with Google or Facebook is used, we may receive the email address and basic profile data such as first and last name returned by that provider;
  • optional AI feature data: when AI-assisted listing tools or AI search are intentionally used, the data submitted with that request may be processed in order to generate the response.

3. How and why we use data

We use personal data to enable registration, sign-in, the owner dashboard, listing publication and display, the contact-reveal flow, structured public boat inquiries, system security, content moderation, user support, optional AI features expressly triggered by the user, and compliance with legal obligations or the protection of platform rights.

4. Legal bases for processing

  • performance of a contract or steps taken at the user’s request, for example to open an account, sign in, and manage listings;
  • legitimate interests, including platform security, fraud prevention, rate limiting, moderation, basic reporting, and the defense of legal claims;
  • consent, where consent is required, for example for optional cookies or any processing that cannot appropriately rely on another legal basis;
  • legal obligation, where we are required to retain or disclose data under applicable law.

Navigate Croatia does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of Regulation (EU) 2016/679, nor does it carry out profiling in that sense.

If you do not provide data that are necessary to open an account, send a structured inquiry, operate essential security or session mechanisms, or other features that depend on those data, the relevant part of the service may be unavailable or not fully available. This does not affect the lawfulness of processing that relies on other legal bases and does not constitute conditioning by consent where consent is not the legal basis.

5. Who may receive data

We do not sell personal data. In the current production baseline reflected in this repository, relevant recipients may include hosting and infrastructure providers, the SMTP email delivery provider used for transactional messages, and Nominatim / OpenStreetMap when a boat location must be geocoded. Additional channels are used only when they are actually enabled in configuration or expressly triggered by the user, for example Twilio for phone verification SMS and individual admin-triggered account or profile completion reminders, Google or Facebook for social sign-in, Google Analytics 4 and/or Cloudflare Web Analytics for consented analytics, Meta Pixel for consented advertising measurement, and OpenRouter plus the selected model provider for AI features the user chooses to invoke. We may also disclose data to lawyers, accountants, regulators, courts, or competent authorities where this is necessary for compliance, protection of rights, or a valid legal request.

6. Transfers outside the EU/EEA

Some of the providers above may process data outside the European Union or the European Economic Area, especially in connection with international cloud, analytics, OAuth, or AI services. Where such transfers occur, we aim to use appropriate GDPR safeguards such as adequacy decisions, standard contractual clauses, or other permitted transfer mechanisms, together with proportionate technical and organizational protections.

7. AI features and external providers

Some AI features are available only when a user actively triggers them. In that case, the content submitted in the AI request may be sent to OpenRouter and the selected model provider in order to generate the response. We aim not to store full prompts or full AI responses in our application audit logs; instead, we may retain limited metadata such as the model, duration, token usage, status code, and failure reason. If separate GPS or related owner services are activated in the future, they may be supplemented by additional terms or privacy notices.

8. How long we keep data

  • account and listing data are kept while the account remains active and for as long as reasonably necessary afterwards for legal obligations, dispute handling, and platform protection;
  • the signed session cookie nc_session may remain active for approximately 7 days unless deleted earlier by the user or invalidated sooner;
  • the local cookie-consent record nc_cookie_consent_v1 stays on the device until the user changes the choice through cookie settings or removes it in the browser;
  • the server-readable choice nc_analytics_consent_v1 lasts for up to one year or until the choice changes, while consent-enabled public-funnel page-view records are normally deleted after 180 days;
  • detailed contact-reveal data is used for security, anti-abuse, and owner reporting; the owner interface currently emphasizes recent history, typically around the last 90 days, while some technical or evidentiary records may need to be retained for longer where justified;
  • structured public boat inquiries may be kept for as long as reasonably necessary so the owner can review and handle the message, and longer where needed for abuse prevention, support, or the defense of legal claims;
  • support and administrative correspondence may be retained longer where necessary to track requests, complaints, or the establishment, exercise, or defense of claims;
  • limited AI audit metadata may be retained for a reasonable operational period for security, cost control, and diagnostics.

9. Public listings and contact details

Public listing content, such as the boat name, description, marina, key specifications, price, and public photos, may be visible to visitors and search engines when the listing is approved and visible. Owner contact details are not exposed to every visitor by default; instead, they are revealed after a user action through the “Show contact details” flow and pulled from the owner profile. The owner remains responsible for the accuracy and lawful publication of those profile contact details.

When a guest sends a structured inquiry through the platform, Navigate Croatia processes the data to receive, review, and forward the inquiry to the boat owner within the platform’s role. For further direct communication, the owner’s own offer, the owner’s CRM, or other processing outside that role, the boat owner may act as an independent controller. For such processing, you should primarily contact the owner; Navigate Croatia may, where agreed and technically feasible, assist by forwarding requests when proportionate.

10. Your rights

Under the GDPR and applicable law, access to data, rectification of inaccurate data, erasure, restriction of processing, data portability, and objection to processing may be requested where the legal conditions are met. Where processing relies on consent, that consent may also be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal, for example by changing cookie settings or contacting our team. A complaint may also be lodged with the Croatian Personal Data Protection Agency (AZOP). To exercise rights, use the contact form.

To protect personal data and prevent unauthorized disclosure, we may ask for reasonable additional information to verify the identity of the person making the request. If the same rights are exercised very frequently with an obvious intent to misuse them, we reserve the right to charge a reasonable administrative fee or refuse to process the request, in line with the Regulation. You may request restriction of processing in the situations described in Article 18 of the Regulation—for example while you contest the accuracy of data we are verifying, where processing is unlawful and you request restriction instead of erasure, where we no longer need the data for our purposes but you still need them for legal claims, or where you have objected while we assess whether our legitimate interests override yours.

11. Cookies, local storage, and consent settings

For details about cookies and related technologies, see the separate Cookie Policy. The banner keeps first-party public-funnel telemetry and analytics and marketing tools disabled by default until consent is given. Depending on configuration, external tools may include Google Analytics 4, Cloudflare Web Analytics, and Meta Pixel. The choice is stored locally through nc_cookie_consent_v1 and passed to the server through nc_analytics_consent_v1; it can be changed later through the “Cookie settings” link in the site footer.

12. GPS tracking data

GPS data is used for vessel monitoring by the owner and is processed through trusted technical partners (hosting infrastructure and the BeeGuard GPS tracking system). Guests do not see the boat's real-time location unless the owner explicitly sends them a live-tracking link. Vessel position data is not sold or used for profiling or third-party advertising.

13. Changes to this policy

We may update this policy from time to time to reflect changes in platform functionality, business operations, or regulatory requirements. The latest update date will be shown at the top of the document.