Privacy Policy
Last updated 14 August 2026
Short version. We do not set cookies of our own, we do not run advertising, and our analytics tool is cookieless — it collects no personal data and cannot follow you across websites. We do load one third-party script, from our accommodation partner Stay22, which rewrites outbound hotel links so a booking can be credited to us. If you click through to a booking partner, that partner sets its own cookie on its own domain. We never sell data and we do not operate a mailing list.
1. Who we are
The data controller for hvarcoastal.com is Hvar Coastal, operated by Strandway Systems, based in Prince Edward Island, Canada.
For any privacy matter, contact contact@hvarcoastal.com. We respond to data subject requests within one month, as required by Article 12(3) GDPR.
2. EU representative (GDPR Article 27)
We are established outside the EU. Our processing is occasional, does not include special categories of data on any scale, and is unlikely to result in a risk to the rights and freedoms of individuals. On that basis we rely on the Article 27(2)(a) exemption and have not appointed an EU representative. If our processing changes such that the exemption no longer applies, we will appoint one and list their details here. EU and UK residents can contact us directly at the address above.
3. What we collect
Analytics — no personal data, no cookies. We use Plausible Analytics, a privacy-focused analytics tool. Plausible does not use cookies, does not store any information on your device, does not collect or store personal data, and does not generate a persistent identifier. It measures aggregate page views, referring sites, approximate country, device type and browser. None of this identifies you, and none of it can be used to follow you to another website. Plausible processes this data on EU-owned servers inside the EU. Because no personal data is processed, this measurement does not require your consent under the GDPR or the ePrivacy Directive.
Affiliate click measurement. When you click a link to one of our booking partners, we record the click as an anonymous, aggregate event — which link was clicked, and nothing about who clicked it. We use this only to understand which recommendations are useful.
Affiliate link rewriting (Stay22). We load a small script from Stay22, an affiliate technology provider, which rewrites outbound accommodation links so that a booking made after clicking one is credited to us. The script runs in your browser and reads only the links on the page. What Stay22 stores when you click a rewritten link is governed by their privacy policy.
Partner cookies, set by the partner. Clicking through to a booking partner takes you to their website, where they set their own cookie to attribute a later booking to us. We do not set, read or have access to that cookie. What the partner collects is governed by their privacy policy, not ours — see section 5.
Server logs. Our host, Cloudflare, processes IP addresses transiently to serve the site and to protect it from abuse. This is necessary for the site to function and is covered by Cloudflare’s own data processing terms.
If you email us. We receive your email address and whatever you write. We use it to reply and nothing else.
We do not collect names, postal addresses, payment details, account credentials or newsletter signups. This site has no login, no comment system, no forms, and no mailing list.
4. Legal basis
| Purpose | Legal basis |
|---|---|
| Serving the website and preventing abuse | Legitimate interests (Art. 6(1)(f)) |
| Aggregate, cookieless analytics | Legitimate interests (Art. 6(1)(f)) — no personal data processed |
| Affiliate link rewriting and attribution | Legitimate interests (Art. 6(1)(f)) — funding the site |
| Affiliate attribution cookies set by partners | Your consent, given to that partner when you arrive on their site |
| Replying to your email | Legitimate interests (Art. 6(1)(f)) |
5. Who processes data for us
- Cloudflare — hosting and content delivery. Processes request data transiently.
- Plausible Analytics — cookieless, EU-hosted aggregate analytics.
- Stay22 — rewrites outbound accommodation links for affiliate attribution.
- Booking partners — GetYourGuide, Viator, Booking.com, Direct Ferries, Discover Cars, Airalo and GetTransfer act as independent controllers for anything they collect once you land on their site. Their privacy policies apply from that point.
We do not share data with anyone else, and we do not sell data to anyone under any circumstances.
6. Retention
Aggregate analytics are retained by Plausible in non-identifying form. Server logs are retained by Cloudflare per their standard retention. Emails you send us are kept for as long as needed to deal with the matter, then deleted.
7. Your rights
Under the GDPR and UK GDPR you have the right to access, rectify, erase, restrict and object to the processing of your personal data, and the right to data portability and to lodge a complaint with a supervisory authority.
In practice, we hold almost nothing to exercise these rights against: the analytics we collect are not personal data and cannot be linked to you, so we are unable to identify an individual within them. If you have emailed us and want that correspondence deleted, write to contact@hvarcoastal.com and we will delete it.
8. Children
This site is not directed at children under 16 and we do not knowingly collect data from them.
9. Changes
If we change this policy we will update the date at the top of the page. Material changes — for example if we ever introduce a mailing list — will be described here rather than made silently.