Privacy Policy

1. Controller

OPG Marko Bernobić, Deklevi 10, 52463 Višnjan, Croatia, OIB 69881784926, MIBPG 182032. For privacy questions and requests, contact [email protected].

2. Current website

This website currently presents our estate, wines and olive oils. Online orders, payments and tasting reservations are disabled. The website does not currently perform an e-Građani age check.

Visitor analytics, advertising pixels and session recording are disabled. Fonts and photographs are served by our website; Google Maps opens only when you follow the external directions link.

3. Data and purposes

To deliver and protect the website, our hosting and network providers process technical connection data such as IP address, requested URL, time, browser information and security events. Our legitimate interest is operating a secure, reliable website (GDPR Article 6(1)(f)).

If you contact us by email or telephone, we process the details you provide to answer your enquiry or take steps you request before a contract (Article 6(1)(b)), and where necessary to handle general correspondence and protect legal claims (Article 6(1)(f)).

Any records of earlier orders or reservations remain subject to the applicable contract, accounting and legal-retention obligations. Closing online transactions does not erase those records.

4. Service providers and locations

The website runs on a Contabo server that we manage through Coolify. Cloudflare provides network delivery and security for the www hostname. Our Convex deployment is hosted in the EU, in Ireland; Convex is a US service provider. These services receive technical data needed to deliver their functions. Our email infrastructure processes enquiries you send to us.

Cloudflare operates an international network. Its data-processing terms and standard contractual clauses describe the safeguards for international processing: cloudflare.com/cloudflare-customer-dpa/. You can ask us for information about the applicable providers and safeguards.

The public website currently does not send new order or booking details to Stripe, DPD, Resend, Telegram, Google Calendar or e-Građani. The privacy information will be updated before those transactional features or visitor analytics are activated.

5. Retention

We retain correspondence for the time needed to answer the enquiry and complete related follow-up. Longer retention applies only where a contract, a legal obligation or the establishment, exercise or defence of legal claims requires it.

Technical logs are used for service operation, error investigation and security. Application logs rotate across three files of up to 10 MiB each, overwriting the oldest records. Retention is limited by the hosting and security services’ log rotation and retention settings; information needed to investigate an incident may be kept until the investigation and related legal claims are resolved. Contact us for the settings applicable to your request.

Accounting documents, where applicable, are retained for the statutory period. We do not collect visitor-analytics records in the current deployment.

6. Cookies and browser storage

No optional analytics or advertising cookies are enabled in the current deployment, so no analytics-consent banner is needed. Network-security services may use storage strictly necessary to deliver or protect the service.

The browser may retain a previous cart, checkout draft or consent choice from an earlier visit. These records are not an order and do not enable checkout. You can remove them through your browser’s site-data settings. Private admin sign-in uses separate authentication storage; public visitors do not need an account.

7. Your rights

Subject to the applicable legal conditions, you may request access, correction, erasure, restriction or portability of your personal data and object to processing based on legitimate interests. Contact [email protected]. We normally respond within one month; if a lawful extension is needed, we will explain it.

You may complain to the Croatian Personal Data Protection Agency (AZOP), azop.hr. We do not make automated decisions producing legal or similarly significant effects about visitors.