Your Information. Handled with Care.

1. Introduction

This policy applies to the Ragusina software services website, ragusina.hr. It covers contact inquiries and website operation. It applies to information provided through this website or sent to us directly in connection with a business inquiry.

We aim to collect only what is relevant to your inquiry and the secure operation of this site.

2. Data Controller

The controller is RAGUSINA d.o.o. za turizam i usluge, turistička agencija, Petra Hektorovića 27, 20000 Dubrovnik, Croatia, OIB 33419938593. Contact details for privacy requests are provided below.

3. Personal Data We Collect

The inquiry form provides fields for your name, email address, and project details. Company or organization and project type are optional.These details are transmitted when you submit the form.

If you contact us directly by email, we receive your email address, the information in your message, and any material you choose to send.

Please provide only information needed to discuss your inquiry. Do not include payment information, passwords, identity documents, health information, or other sensitive personal data.

4. Purposes of Processing

Inquiry information is used to understand your request, communicate with you, assess a potential project, and keep appropriate correspondence records. Technical information is processed to deliver the website, prevent abuse, and investigate security issues.

Submitting an inquiry does not subscribe you to marketing communications.

5. Legal Bases Under GDPR

Depending on the inquiry, processing may be necessary to take steps at your request before entering a contract (Article 6(1)(b)). For business representatives and general correspondence, it may rely on legitimate interests in responding to relevant business communications (Article 6(1)(f)), balanced against your rights.

Necessary website security and abuse prevention may also rely on legitimate interests. Where a specific legal obligation applies, Article 6(1)(c) may be relevant. The form's privacy acknowledgement confirms that you have read this notice; it is not consent to marketing and is not used as a substitute for the appropriate legal basis.

6. Contact Form Submissions

Required fields are limited to the information needed to respond: name, email address, and project details. The form also requires acknowledgement of this policy and server-side validation.

Submissions are sent securely to our inquiry endpoint and passed to Postmark for delivery to the company. After Postmark accepts that notification, we attempt an acknowledgement to your email address containing a copy of your inquiry. A successful response means the delivery service has accepted the inquiry for processing; it does not guarantee inbox delivery or an immediate reply.

7. Technical and Security Data

The website is served through Cloudflare. Handling a request may involve its IP address, requested URL, timestamp, browser or device headers, and security-related request information. Cloudflare processes such information as applicable to content delivery, service operation, and security.

When online inquiries are enabled, Cloudflare Workers validates the submitted fields, checks the request origin and a hidden anti-spam field, and applies rate limiting using a keyed, IP-derived identifier. Raw IP addresses are not deliberately logged by the contact application. Inquiry contents and API credentials are not deliberately logged either. These controls do not use an interactive verification widget.

8. Cloudflare and Service Providers

Cloudflare provides website hosting, delivery, and associated security processing. You can read its Privacy Policy for information about its processing.

Postmark is the configured transactional email delivery provider for online inquiries and acknowledgement emails to the visitor. It processes the inquiry content, recipient addresses, and delivery metadata. See Postmark's Privacy Policy. Inquiry correspondence is also handled by the company's receiving email service.

Direct email correspondence is handled by the company's receiving email service.

Providers should receive only the information needed for their role. Information about the processing arrangements applicable to your correspondence is available on request.

9. Data Retention

Inquiry correspondence is reviewed for deletion 12 months after the last substantive communication, unless a justified business or legal reason requires longer retention. Exceptions are documented.

This is a manual review and deletion process. This website does not automatically delete correspondence from mailboxes or provider records.

Where an inquiry leads to a contract, or records are needed for legal obligations or claims, different retention requirements may apply. Technical and provider records have separate retention arrangements, which depend on the service and its configuration. Contact us for the retention information applicable to your data.

10. Cookies and Similar Technologies

We have not added analytics, advertising trackers, or marketing cookies to this website. The application does not use cookies or local storage to build visitor profiles.

The contact form does not load a third-party verification script. Cloudflare platform security processing depends on its actual service configuration. This processing is not used here for advertising. Any future non-essential tracking would require a separate assessment and, where required, consent before activation.

11. International Data Transfers

Service providers may process data outside Croatia or the European Economic Area. Any applicable transfer must have a lawful basis and appropriate safeguards under GDPR, such as an adequacy decision or suitable contractual safeguards, depending on the provider and processing arrangement.

You may request information about the transfer arrangements and safeguards applicable to your data.

12. Your GDPR Rights

Subject to the conditions and exceptions in GDPR, you may request access, correction, erasure, restriction, or portability of your personal data. You may object to processing based on legitimate interests. If any processing relies on consent, you may withdraw it without affecting prior lawful processing.

We may need to verify your identity proportionately to a request. Rights are not absolute: legal record-keeping obligations and other lawful grounds may affect what can be deleted. Requests are normally answered within one month, subject to the extensions permitted by GDPR.

Where a personal-data breach occurs, notification to the supervisory authority is required without undue delay and, where feasible, within 72 hours of awareness unless it is unlikely to result in a risk to individuals' rights and freedoms. Affected individuals must also be informed where the applicable high-risk threshold is met, subject to GDPR exceptions.

13. Complaints to AZOP

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), or another competent supervisory authority. Information and current contact details are available at azop.hr.

14. Contact Information

For privacy requests, email info@ragusina.hr, or write to the registered address below.

See Legal Information for the full company identity and Contact for current inquiry availability.

15. Changes to This Policy

This notice will be updated when the website's processing or applicable requirements change. Changes relevant to online submissions, retention, or providers will be reflected here before the corresponding service is enabled.