Privacy Policy
Effective date: 5 November 2026
This Privacy Policy explains how BOREAS TOURS collects and uses your personal data when you visit pulaexperience.com, send us an inquiry or book a tour or activity with us. If you have any questions, write to us at info@pulaexperience.com.
1. Who is responsible for your data
The data controller is:
BOREAS TOURS, Obrt za turizam i turistička agencija, vl. Florian Burić
Vodovodna ulica 18, 52100 Pula, Croatia
OIB: 86102696590
Email: info@pulaexperience.com
Tel: +385 977 755 590
Contact person for data protection: Florian Burić, info@pulaexperience.com
2. What data we collect
Booking and inquiry forms. First name, last name, email address, phone number, number of guests, the tour or activity you are interested in, the preferred date and your message.
Newsletter. First name, last name and email address, if you sign up.
Direct contact. The data you send us by email, phone or WhatsApp, such as your name, contact details and booking details.
Payments. When you pay by card, your card details are entered directly with our payment provider, Stripe. We never see or store your full card number. We receive only the confirmation of payment, the amount and the reference of your booking.
Website use. Our hosting server records technical data such as your IP address, browser type and the pages you visit, to keep the website running and secure. If you accept analytics cookies, Google Analytics collects information about how you use the website. See our Cookie Policy.
3. Why we use your data and on what legal basis
- To answer your inquiry and to arrange and carry out your booking – performance of a contract or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
- To issue invoices and keep accounting records – compliance with a legal obligation (Article 6(1)(c) GDPR).
- To send you the newsletter – your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time.
- To measure website traffic with Google Analytics – your consent (Article 6(1)(a) GDPR), given in the cookie banner.
- To keep the website secure and working – our legitimate interest (Article 6(1)(f) GDPR).
4. Who receives your data
We do not sell your personal data. We share it only where this is needed to provide our service or required by law:
- Tour and activity partners. Many tours on this website are operated by our local partners. When you book such a tour, we send the operator the details needed to carry it out: your name, phone number, number of guests, date and any special requests.
- Stripe. Stripe Payments Europe, Limited (Ireland), which processes your card payment. Stripe processes card data under its own Privacy Policy.
- Hosting provider. A2 Hosting, which hosts our website and its database.
- Google Ireland Limited. Provider of Google Analytics, only if you have accepted analytics cookies.
- Public authorities. Where we are legally required to disclose data, for example to tax or tourism inspection authorities.
Some of these providers may process data outside the European Economic Area. In that case the transfer is based on an adequacy decision of the European Commission or on Standard Contractual Clauses.
5. How long we keep your data
- Inquiry and booking data: as long as needed to handle your inquiry or booking, and after that for the periods required by Croatian accounting and tax law.
- Newsletter data: until you unsubscribe.
- Google Analytics data: no longer than 14 months.
- Server logs: for a short period needed for security and technical operation.
6. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased, where there is no legal reason for us to keep it;
- restrict the processing of your data;
- object to processing based on our legitimate interest;
- receive your data in a machine-readable format (data portability);
- withdraw your consent at any time, without affecting processing carried out before the withdrawal.
To use any of these rights, write to info@pulaexperience.com. We reply within one month.
If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka – AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr, or with the supervisory authority in your country of residence.
7. Children
Our website is not aimed at children under 16. Bookings for children are made by a parent or another responsible adult.
8. Security
The website uses an encrypted connection (HTTPS). Access to booking data is limited to the people who need it to handle your booking. If a data breach occurs that puts your rights at risk, we will inform you and the supervisory authority as required by law.
9. Changes to this Privacy Policy
We may update this Privacy Policy when our services or the law change. The current version is always published on this page, with its effective date at the top.