Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains how we process personal data when you visit this website, contact us or work with us. It is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Croatian Act on the Implementation of the General Data Protection Regulation.

1. Who is responsible for your data

The controller of your personal data is:

MONIO WEDDINGS, obrt za usluge, vl. Ivana Dumančić, Okrug Gornji, Put Izvana 30

CORE – Corporate Retreat Croatia is a brand of MONIO WEDDINGS, obrt za usluge, vl. Ivana Dumančić, Okrug Gornji, Put Izvana 30. In this policy, “we”, “us” and “our” refer to the controller named above. Further company details are given in our Legal Notice.

We have not appointed a data protection officer, as we are not required to do so. For any question about your personal data, please write to contact@corporate-retreat.com.

2. Overview

We process only the data we need to run this website and to answer and serve business inquiries. In particular:

  • we do not use analytics or statistics tools;
  • we do not use advertising, retargeting or tracking technologies;
  • we do not use social media plugins;
  • we do not send newsletters;
  • we do not carry out profiling or make decisions based solely on automated processing.

3. Visiting this website

Server log data

When you open a page, your browser automatically transmits technical information that the web server records in log files:

  • IP address;
  • date and time of the request;
  • the page or file requested (URL);
  • the referring page (referrer), where transmitted;
  • browser and operating system information (user agent).

Purpose: to deliver the website, keep it stable and secure, and detect and investigate misuse or attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Retention: log data is kept only for a short period and then deleted automatically, unless a specific security incident requires us to keep individual entries for longer until it has been resolved.

The website is hosted by an external hosting provider, which processes this data on our behalf as a processor in accordance with Art. 28 GDPR.

Fonts and website libraries

The typefaces used on this website (EB Garamond and Manrope) and the map library (Leaflet) are served from our own server. Loading them does not transmit any data to Google, to content delivery networks or to other third parties.

4. Cookies

By default, this website uses only cookies that are strictly necessary for it to work. These include the cookies that store your consent choices, a cookie that remembers your selected language, and functional cookies set by the website’s content management system. These cookies do not require consent under the Croatian Electronic Communications Act (Zakon o elektroničkim komunikacijama), because they are essential to provide the website you request. Any personal data they contain is processed on the basis of Art. 6(1)(f) GDPR; our legitimate interest is a functioning website and a record of your consent choices.

Any other storage or access on your device takes place only with your consent. Full details of each cookie, its purpose and its duration are set out in our Cookie Policy.

5. Interactive map (OpenStreetMap)

Some pages contain an interactive map of Croatia. The map images (tiles) are provided by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map is not loaded automatically. Map tiles are requested from OpenStreetMap only after you have given your consent, either by accepting the corresponding category in our cookie banner or by clicking “Load map” on the page. When the map loads, your browser connects to the OpenStreetMap servers and transmits your IP address and the technical information listed in section 3 (such as browser type and the page from which the request is made).

Purpose: to display the interactive map.

Legal basis: your consent, Art. 6(1)(a) GDPR.

Withdrawal: you can withdraw your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it.

The United Kingdom is a third country. The European Commission has adopted an adequacy decision for the United Kingdom under Art. 45 GDPR, confirming that it provides an adequate level of data protection. Information on how the OpenStreetMap Foundation processes data is available in its privacy policy at osmfoundation.org/wiki/Privacy_Policy.

6. Inquiries and contact

You can contact us by email, by phone or through the inquiry form on this website. Depending on how you contact us and what you choose to tell us, we process:

  • contact details: your name (if provided), company name, role or job title, business email address and phone number;
  • company information, such as headquarters location;
  • event details, such as preferred dates, estimated group size, preferred destinations or regions, type of event, desired programme elements and meeting setup, budget or investment range, preferred billing model and whether you require a non-disclosure agreement;
  • the content of your message and of our subsequent correspondence.

Purpose: to answer your inquiry, discuss your requirements and prepare an offer.

Legal basis: where your inquiry relates to a possible engagement, Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). For general correspondence, Art. 6(1)(f) GDPR; our legitimate interest is responding to messages addressed to us. Where you write on behalf of your employer, we process your business contact details on the basis of Art. 6(1)(f) GDPR, our legitimate interest being communication with the company you represent.

Retention: if no contract is concluded, we delete inquiry data at the latest 12 months after our last contact with you.

Is providing data required? You are not legally or contractually obliged to contact us or to provide personal data. However, we need the contact details and information marked as required in the form, or a means of reaching you, to be able to answer your inquiry and prepare an offer. Without them we cannot respond.

7. Clients, events and guests

When we organise an event, we process the data of our client’s contact persons and, where needed, of event participants, to plan, coordinate and deliver the agreed services. Participant data is usually provided to us by our client and covers only the information needed to arrange the event, for example names and the details required by venues, hotels and transport providers.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for participants who are not themselves party to the contract, Art. 6(1)(f) GDPR, our legitimate interest and that of our client being the proper delivery of the event. Where our client provides participant data to us, the client is responsible for informing the participants and for being entitled to share their data with us.

Client data needed to conclude and perform the contract and to issue invoices must be provided; without it we cannot provide our services.

Retention: contract and client data are kept for the duration of the business relationship and thereafter for the periods required by Croatian accounting and tax legislation. Data not subject to such obligations is deleted once it is no longer needed for the event and any related claims.

8. Recipients of your data

We share personal data only where necessary for the purposes described above:

  • Service partners: when organising an event, we pass on client and guest data to venues, hotels, transport providers and other service partners only to the extent needed to deliver the service (Art. 6(1)(b) GDPR). These partners use the data to provide their own services and are responsible for it under their own privacy policies.
  • Processors: our hosting provider and any other technical service providers we use (for example for email) process data on our behalf and only on our instructions, in accordance with Art. 28 GDPR.
  • OpenStreetMap Foundation: only if you load the interactive map (see section 5).
  • Advisers and authorities: where we engage accounting, tax or legal advisers, they receive data only as needed for their work and are bound by confidentiality; public authorities receive data only where we are legally required to disclose it.

9. Transfers outside the EU/EEA

The OpenStreetMap map service described in section 5 involves a transfer to the United Kingdom, which is covered by the European Commission’s adequacy decision.

Where a service provider we use processes personal data outside the European Union or the European Economic Area, we transfer data only on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or appropriate safeguards such as the Commission’s Standard Contractual Clauses (Art. 46 GDPR). Where an event involves a service partner outside the EU/EEA, data is transferred only where necessary to perform the contract with our client (Art. 49(1)(b) or (c) GDPR) or on the basis of such safeguards. You can ask us for information about the safeguards used and for a copy of them at the contact details in section 1.

10. Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you (Art. 15);
  • have inaccurate data rectified (Art. 16);
  • have your data erased (Art. 17);
  • restrict processing (Art. 18);
  • data portability, where processing is based on consent or contract and carried out by automated means (Art. 20);
  • withdraw consent at any time with effect for the future (Art. 7(3)), for example via “Cookie settings”;
  • object to processing (Art. 21), as set out below.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise any of these rights, write to contact@corporate-retreat.com or to our postal address. We will respond within one month; in complex cases this period may be extended as permitted by the GDPR. We may ask for information to confirm your identity.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, www.azop.hr

11. No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

12. Children

Our services are directed at companies and are not intended for persons under 16. We do not knowingly collect personal data from children through this website.

13. Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include limiting access to personal data to those who need it. No method of transmission over the internet is completely secure; please consider this when sending us confidential information by email.

14. Changes to this policy

We may update this Privacy Policy when our services, the website or the legal requirements change. The current version is always available on this page, with its date at the top.

15. Language

This Privacy Policy is available in English, German and Croatian. All language versions have the same content.