Privacy policy
Information on the processing of personal data
This notice is provided under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, the GDPR). It concerns the processing of personal data of visitors to the website il-palazzo.com.
1. Controller
The controller is Effata ugostiteljstvo d.o.o., Put bioca 47, 22000 Šibenik, Croatia, company registration number (OIB) 65956396141, which operates the restaurant Il Palazzo Galbiani at Ul. kralja Tomislava 10, 22000 Šibenik, Croatia.
Contact for all matters relating to the processing of personal data and for exercising data subject rights: info@il-palazzo.com, +385 99 389 4900.
2. Data protection officer
The controller has not appointed a data protection officer, as it does not meet the conditions set out in Article 37(1) of the GDPR. Requests are to be submitted to the contact given in section 1.
3. Categories of personal data
The website has no submission form, no user accounts and no newsletter sign-up. The following categories of data are processed:
- website usage data, collected by Google Analytics 4 subject to the data subject’s consent: pages viewed, duration of the visit, source of the visit, approximate location derived from the IP address, device type and browser;
- server log data, recorded automatically by the server: IP address, date and time of the request, the address requested and browser information;
- data from direct communication, where the data subject contacts the controller by email or telephone: the data contained in that message.
4. Purposes of processing and legal bases
| Purpose | Legal basis |
|---|---|
| Measuring traffic and analysing how the website is used | Consent of the data subject, Article 6(1)(a) GDPR |
| Ensuring the operation, availability and security of the website and detecting and resolving faults and misuse | Legitimate interests of the controller, Article 6(1)(f) GDPR |
| Responding to an enquiry and taking steps at the data subject’s request prior to entering into a contract | Article 6(1)(b) GDPR |
The legitimate interest referred to in the second row is the controller’s interest in keeping the website available and secure and in being able to establish faults and unauthorised access. The controller has assessed that this interest is not overridden by the interests or fundamental rights and freedoms of the data subject, given that server log data is not used to make decisions about the data subject and is not combined with other sources.
5. Consent
Processing for the purpose of measuring traffic is carried out solely on the basis of consent. Consent is voluntary and refusal does not affect the availability or functionality of the website.
The data subject has the right to withdraw consent at any time, without giving reasons. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. The method of withdrawal is described in the cookie policy.
6. Recipients of personal data
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as a processor, in connection with Google Analytics and Google Maps.
- The website hosting provider, acting as a processor, in respect of server logs.
By selecting the reservation link, the data subject leaves this website and proceeds to the reservation system of a third-party provider, which processes data as an independent controller and in accordance with its own privacy policy. The controller has no access to that data.
Personal data is not sold and is not disclosed to third parties beyond the above.
7. Transfers to third countries
Where the services of Google Ireland Limited are used, personal data may be transferred to third countries outside the European Economic Area. Such transfers are carried out subject to appropriate safeguards under Article 46 GDPR, on the basis of standard contractual clauses adopted by the European Commission, and under the EU-U.S. Data Privacy Framework for recipients certified under it.
8. Retention periods
| Category of data | Retention period |
|---|---|
| Website usage data (Google Analytics 4) | No longer than 14 months from collection, after which it is deleted automatically |
| Server logs | In accordance with the hosting provider’s policy, as a rule up to 30 days |
| Data from direct communication | Until the purpose of the enquiry has been fulfilled, and at the longest until the expiry of any retention periods imposed on the controller by law |
9. Rights of the data subject
The data subject has the right:
- of access to personal data, Article 15 GDPR;
- to rectification of inaccurate data and completion of incomplete data, Article 16;
- to erasure, Article 17;
- to restriction of processing, Article 18;
- to data portability, Article 20;
- to object to processing based on legitimate interests, Article 21;
- to withdraw consent at any time, Article 7(3).
Requests are to be submitted to info@il-palazzo.com. The controller will act on the request without undue delay and at the latest within one month of receipt, subject to extension in accordance with Article 12(3) GDPR.
10. Right to lodge a complaint
The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. The supervisory authority in the Republic of Croatia is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, azop.hr.
11. Obligation to provide data
Providing personal data is neither a statutory nor a contractual requirement and is not a condition of using the website. The data subject is under no obligation to consent to traffic measurement, and refusal has no consequences. Server log data is generated automatically on every request to the server and is a technical precondition for delivering the content.
12. Automated decision-making
The controller does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.
13. Children’s data
The website is not directed at children and the controller does not knowingly collect personal data of children.
14. Amendments to this notice
The controller may amend this notice where the manner of processing or the applicable law changes. The version in force is published at this address.
Last amended: 20 September 2026.