Privacy Policy
Last updated: October 19th, 2026
This Privacy Policy explains how Litto d.o.o. collects and uses your personal data when you visit litto.co, make a booking, or contact us. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Croatian Act on the Implementation of the General Data Protection Regulation.
1. Who is responsible for your data
The controller of your personal data is:
- Litto d.o.o., Lovački put 7, 21000 Split, Croatia
- OIB: 32528484119
- Email for data protection matters: gdpr@litto.co
- Phone: +385 91 1770310
We have not appointed a data protection officer, as we are not required to. For any question about your personal data, contact us at gdpr@litto.co.
2. What data we collect
| Category | Data |
| Booking data | Name and surname, email address, phone number, country, dates of stay or experience, number and ages of guests, special requests. |
| Payment data | Amount paid, payment status and transaction reference. Card details are entered directly with our payment provider Stripe; we do not see or store your full card number. |
| Communication | The content of emails, messages and calls with us, for example questions, change requests and complaints. |
| Website usage data | IP address, browser and device type, pages visited and time of visit. Analytics data is collected only if you accept analytics cookies. |
| Newsletter | Your email address and your subscription preferences, if you subscribe. |
At check-in, your host asks for your identity document and other details that Croatian law requires for the registration of guests. The host collects and processes this data and is responsible for it.
We do not intentionally collect special categories of personal data, such as data about health. Please do not send us such data unless it is needed for your stay, for example, accessibility needs.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
| Processing your booking, sending the confirmation and passing the necessary details to the host or experience operator | Performance of a contract, Art. 6(1)(b) |
| Taking payments and issuing invoices | Performance of a contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Keeping accounting records | Legal obligation, Art. 6(1)(c) |
| Answering your questions, change requests and complaints | Performance of a contract, Art. 6(1)(b), or our legitimate interest in responding to you, Art. 6(1)(f) |
| Keeping the website secure and working | Legitimate interest, Art. 6(1)(f) |
| Website analytics | Your consent, Art. 6(1)(a) |
| Sending our newsletter | Your consent, Art. 6(1)(a) |
| Establishing or defending legal claims | Legitimate interest, Art. 6(1)(f) |
If you do not provide the data needed for a booking, we cannot complete it.
4. Who we share your data with
- Hosts and experience operators: we pass on the details they need to provide the service, such as your name, contact details, dates and number of guests.
- Service providers who process data on our behalf: Stripe (payments), Vercel (website hosting), SendGrid (booking emails), Mailchimp (newsletter), Google (website analytics and tag management) and Cloudinary (image delivery). They may use your data only on our instructions.
- Accountants, lawyers and auditors, where needed for our legal obligations or to protect our rights.
- Public authorities, where we are required to by law, for example tax authorities.
We do not sell your personal data.
5. Transfers outside the European Economic Area
Our website is hosted on Vercel servers in the European Union.
Some of our service providers, such as Stripe, Google, Vercel, SendGrid, Mailchimp and Cloudinary, are based in the United States or may process data there. We transfer data only where the European Commission has recognised an adequate level of protection, including for companies certified under the EU–US Data Privacy Framework, or where the provider has signed the Standard Contractual Clauses approved by the European Commission.
6. How long we keep your data
| Data | Retention |
| Booking, payment and invoice data | 10 years, as required by Croatian accounting and tax law |
| Questions and correspondence not related to a booking | Up to 12 months after the last contact |
| Newsletter | Until you unsubscribe |
| Analytics data | Up to 14 months, after which it is deleted or anonymised |
If we need data to establish or defend a legal claim, we may keep it until the matter is closed.
7. Your rights
You have the right to:
- access your personal data and receive a copy;
- have incorrect data corrected;
- have your data erased, where we no longer need it or have no legal basis for it;
- restrict the processing of your data;
- receive your data in a portable format;
- object to processing based on our legitimate interest;
- withdraw your consent at any time, for example by unsubscribing from the newsletter or changing your cookie settings. Withdrawal does not affect processing carried out before it.
To exercise your rights, email gdpr@litto.co or write to our address. We may ask you to confirm your identity. We will reply within one month. For complex requests, this period may be extended by up to two further months, in which case we will tell you why.
8. Complaints
If you believe we have not handled your data correctly, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Croatian data protection authority:
- Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia
- azop@azop.hr · https://azop.hr
If you live in another EU country, you can also contact the data protection authority in your country.
9. Security
We use appropriate technical and organisational measures to protect your data, such as encrypted connections, access limited to people who need it, and providers that meet recognised security standards. Card payments are handled by Stripe, which is certified to the PCI DSS security standard.
10. Children
Our website is not intended for children under 16, and bookings can be made only by persons aged 18 or over. Data about children travelling with you, such as their age, is processed only as part of your booking.
11. Cookies
We use cookies as described in our Cookie Policy: https://www.litto.co/help/cookie-policy
12. Changes to this policy
We may update this Privacy Policy. The current version is always published on this page, with the date of the last update.