Privacy Policy

1. Data Controller Information

The controller responsible for processing your personal data on this website and for our rental services is: Fluvius Suite (Private Host / Smeštaj u domaćinstvu) Address: Blagoja Parovića 1L, 18000 Niš, Republic of Serbia Email: info@fluvius-suite.com Phone: +381 67 7205195

2. Categories of Personal Data Collected

We collect and process personal data only to the extent necessary to provide our booking and hospitality services:

• Account & Authentication Data: When logging in via Google OAuth, we receive your name and email address.
• Guest Registration & ID Data: Official identification documents (e.g., passport or national ID details) required for mandatory tourist registration under Serbian hospitality regulations (eTurista). Registered users may optionally use Didit.me for identity verification.
• Booking & Financial Data: Dates of stay, number of guests, special requests, and payment status (bank transfer records or PayPal transaction IDs). We do not store credit card details directly.
• Technical Telemetry & Analytics: IP addresses, device/browser details, essential language preference cookies, Cloudflare performance metrics, and anonymized user behavior via Microsoft Clarity.

3. Legal Basis for Data Processing

We process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b) GDPR): Processing necessary to execute apartment reservations and provide guest management services.
• Legal Obligation (Art. 6(1)(c) GDPR): Statutory guest registration duties under the Serbian Law on Tourism and tax regulations.
• Legitimate Interest (Art. 6(1)(f) GDPR): Website performance monitoring, security enforcement via Cloudflare, and usability optimization via Microsoft Clarity.
• Consent (Art. 6(1)(a) GDPR): Voluntarily stored preference cookies and optional identity validation features.

4. Third-Party Service Processors

We may share relevant data with trusted third-party service providers solely for operational necessity:

• Cloudflare: Security, content delivery, and Real User Monitoring (RUM) performance tracking.
• Google OAuth: Secure Single Sign-On user authentication.
• Microsoft Clarity: Anonymized behavioral heatmaps and session replays for usability improvement.
• Didit.me: Optional third-party document and identity verification service for registered accounts.
• PayPal & Banking Partners: Secure processing of digital payments and bank transfers.
• Public Authorities: Official registration of guest stays with the tourist registry of the Republic of Serbia as required by law.

5. Data Retention & Security

We store personal data only as long as necessary to fulfill statutory duties (e.g., financial and guest logs maintained for 5–10 years as required by Serbian law). Technical telemetry is anonymized or purged within 30 to 90 days. All data transfers are protected using HTTPS/TLS encryption and Cloudflare Web Application Firewall (WAF) security measures.

6. Your Data Rights

Under GDPR and applicable privacy laws, you possess the following rights regarding your data:

• Right of access to your personal data • Right to rectification of inaccurate data • Right to erasure ('Right to be Forgotten'), subject to legal recordkeeping obligations • Right to restriction of processing and data portability • Right to withdraw consent at any time without affecting prior lawful processing

You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia or your local EU supervisory authority.

7. Cookies & Local Storage

We use essential local storage cookies exclusively to preserve your chosen language preference across site navigation. No third-party advertising cookies are deployed on our platform.

8. Contact Us

For any questions, requests, or concerns regarding your privacy or data protection rights, please contact us at info@fluvius-suite.com or +381 67 7205195.