PRIVACY AND SECURITY

Privacy and Online Payment Security Statement

Last updated: 11 June 2026

1. Introduction

We value your privacy and respect your personal data. This Privacy Statement explains which personal data Integral Zagreb d.o.o. collects, for which purposes it processes it, on which legal basis, to whom it may disclose it, and which rights you have in relation to the processing of your personal data.

This Statement applies to personal data that we collect when you browse and use the website www.integral-zagreb.hr, send an inquiry, subscribe to the newsletter, request an offer, make a reservation or contract a trip, contact us directly, or use other services of Integral Zagreb d.o.o.

All employees and business partners who have access to personal data in the course of providing services are required to act in accordance with the rules on personal data protection, confidentiality and data security.

2. Data Controller and Contact

The controller of personal data is Integral Zagreb d.o.o., Paromlinska cesta 2a, Zagreb, OIB: 11154562870.

For all questions regarding the processing of personal data, exercising your rights or withdrawing consent, you may contact us by email at: info@integral-zagreb.hr.

3. Which Personal Data We Collect

Depending on the type of service, inquiry, reservation or contract, we may collect the following categories of personal data:

identification data, such as first and last name, date of birth, gender, citizenship and handwritten signature;

contact data, such as address, telephone number and email address;

data required for the realization of travel, such as passport number or other identity document number, travel document data, visa data, special travel-related requests and data about other passengers included in the reservation;

payment data, such as data about the means of payment, payment status and invoice, whereby card payments are processed through an authorized payment service provider;

data that you provide to us through inquiries, forms, surveys, complaints, objections or other communication;

technical data related to the use of the website, such as IP address, device and browser data, access time, cookies and the way in which the website is used.

We do not collect more data than is necessary for a specific purpose. If we need additional data for a particular service, we will inform you separately.

4. Purposes and Legal Bases of Processing

We process personal data only when there is an appropriate legal basis and for clearly defined purposes.

5. Methods of Data Collection

We collect personal data directly from you when you complete forms on the website, send an inquiry, subscribe to the newsletter, communicate with our employees, request an offer, make a reservation or conclude a contract.

We may also receive data from third parties, such as subagents, other travel agencies or persons who contract a service on your behalf, when this is necessary to realize the requested service.

If you provide us with personal data of other passengers, you are required to ensure that those passengers are familiar with this Privacy Statement and that there is an appropriate basis for providing their data.

6. Recipients of Personal Data

We share your personal data with third parties only when this is necessary for the realization of contracted or requested services, fulfilment of legal obligations or protection of our rights and legitimate interests.

Recipients of data may include airlines, bus carriers, hotels and other accommodation facilities, local partners and providers of tourist services, other travel agencies, subagents, insurers, banks, card companies, online payment service providers, visa offices, accounting, IT and other authorized service providers, and competent authorities when required by law.

Where applicable, we require all processors and business partners to act in accordance with personal data protection rules and to apply appropriate security measures.

7. Transfer of Data Outside the European Economic Area

Since certain tourist services may be provided outside the European Economic Area, your personal data may, when necessary for the realization of travel or another contracted service, be forwarded to service providers in third countries, such as hotels, carriers, local agents, visa offices or other competent entities in the country of destination or transit.

Such transfer is carried out only to the extent necessary for the realization of the contracted or requested service, with the application of appropriate safeguards where applicable.

8. Newsletter and Promotional Notices

We send newsletters and promotional notices only to persons who have voluntarily subscribed to them or have otherwise clearly given consent to receive such notices.

By subscribing to the newsletter, you agree that we may send you information about our travel offers, promotions, last minute and first minute offers, and other promotional content related to our services.

You may withdraw your consent to receive the newsletter at any time by clicking the unsubscribe link in the newsletter or by sending a request to info@integral-zagreb.hr. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Surveys and Questionnaires

From time to time, we may conduct surveys and questionnaires. Data that you voluntarily provide in surveys and questionnaires is used to analyze user satisfaction and improve our services.

Where possible, survey results are used in aggregated or anonymized form.

10. Cookies and Similar Technologies

The website www.integral-zagreb.hr may use cookies and similar technologies. Cookies are small files stored on your device that enable the basic functioning of the website, usage analysis, visitor counting, language settings and improvement of the user experience.

Necessary cookies are used for the proper operation of the website. Analytical, marketing and other optional cookies are used only when there is an appropriate legal basis, such as your consent, if required under applicable regulations.

You can change cookie settings in your internet browser or through the consent management tool, if available on the website.

11. Log Files and Technical Data

Like most websites, we may collect technical data such as IP address, browser type, access time, pages viewed and similar data. This data is used to maintain security, analyze website operation, detect technical difficulties and improve the user experience.

Where possible, we use technical data in aggregated form that does not enable direct identification of an individual.

12. Online Payment and Card Data Security

When paying through the website, we use the services of an authorized payment service provider. Integral Zagreb d.o.o. does not store complete data about your payment card.

Card and payment data is entered into the secure payment form of the payment service provider and processed in accordance with the rules, security standards and terms of that provider.

Security measures such as encrypted data transmission, security protocols and other technical and organizational standards for the protection of payment data are applied during online payment.

13. Online Payment Security Statement via the CorvusPay System

When paying in our web shop, CorvusPay, an advanced system for secure online payment card acceptance, may be used.

The CorvusPay system ensures the confidentiality of card and personal data from the moment you enter it into the CorvusPay payment form. Payment data is transmitted in encrypted form from your web browser to the bank that issued your card. Our store does not come into contact with complete data about your payment card.

The payment data entry form is secured by SSL transport encryption. Stored data is additionally protected by encryption using a cryptographic device certified according to the FIPS 140-2 Level 3 standard. CorvusPay operates in accordance with PCI DSS Level 1, the highest security standard in the payment card industry. When paying with cards included in the 3-D Secure program, your bank, in addition to verifying the validity of the card, also confirms your identity through a token, password or other authentication method.

CorvusPay treats all collected information as confidential and uses it exclusively for the purposes for which it is intended. Only data necessary for carrying out online payment is collected, in accordance with prescribed security procedures.

Security controls and operational procedures applied to the CorvusPay system infrastructure, including access control, regular security monitoring and vulnerability checks, are aimed at maintaining and improving system security and protecting card data.

14. Security Measures

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration or destruction.

Access to personal data is granted only to persons who need such data to perform their work or provide a specific service. We protect confidential data by applying online and offline security measures, including access restrictions, security protocols and other protective measures appropriate to the risk of processing.

15. Data Retention Periods

We keep personal data for as long as is necessary to achieve the purpose for which it was collected, or for as long as we are required to keep it under applicable regulations.

Data related to contracts, invoices and business documentation is kept for periods prescribed by accounting, tax and other applicable regulations. Data processed on the basis of consent is kept until consent is withdrawn, unless there is another legal basis for further processing.

After the expiry of retention periods, personal data is erased, anonymized or otherwise appropriately removed from active processing.

16. Your Rights

In accordance with applicable personal data protection regulations, you have the right to request access to your personal data, correction of inaccurate data, erasure of data, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent where processing is based on consent.

To exercise your rights, you may contact us at info@integral-zagreb.hr. In order to protect personal data, before acting on a request we may ask for additional information needed to confirm your identity.

If you believe that the processing of your personal data has violated personal data protection regulations, you have the right to lodge a complaint with the supervisory authority, namely the Croatian Personal Data Protection Agency.

17. Links to Other Websites

Our website may contain links to other websites. Integral Zagreb d.o.o. is not responsible for the content, security or privacy rules of other websites. We recommend that you read the privacy statements of every website you visit and to which you provide personal data.

18. Copyright and Use of Website Content

Texts, photographs, graphic elements and other content published on the website www.integral-zagreb.hr are intended for informing users and for non-commercial use, unless expressly stated otherwise.

Unauthorized copying, distribution, modification or publication of content for commercial purposes is not permitted without the prior written approval of Integral Zagreb d.o.o.

19. Changes to this Statement

Integral Zagreb d.o.o. may amend this Privacy and Security Statement from time to time. The current version will be published on the website www.integral-zagreb.hr.

We recommend that you check this Statement from time to time to stay informed about how we process and protect your personal data.

20. Contact

For all questions related to personal data protection, privacy or online payment security, you may contact us by email at: info@integral-zagreb.hr.