PRIVACY POLICY
The purpose of this Privacy Policy is to inform you about who we are, what we do and our ways of processing your personal dana.
This Privacy Policy applies to the processing of personal data as part of the business activities of our Travel Agency Atistria and as part of the use of our website www.atistria.com
More information on data processing as part of the business of Arena Hospitality Group d.d. and its subsidiaries can be found in our general privacy policies and notices available at:
https://arenahospitalitygroup.com/
https://www.arenacollection.com/
Controller
Company name: Arena Hospitality Group d.d.
Registered office address: Smareglina ulica 3, 52100 Pula, Republic of Croatia
VAT ID: 47625429199
Data protection contact: [email protected]
Arena Hospitality Group d.d. (hereinafter: AHG) is an international hospitality company which owns, co-owns, leases, operates and develops full-service upscale, upper upscale and lifestyle hotels, self-catering holiday apartment complexes and campsites primarily in Croatia, Germany, Austria, Hungary and Serbia. In addition to operating and developing its own brands, Arena Hotels & Apartments® and Arena Campsites®, through our majority shareholder PPHE Hotel Group Limited (‘PPHE Hotel Group’ or ‘PPHE’) AHG has the exclusive right to operate and develop the international Park Plaza® brand in 18 countries in the Central and Eastern European region (the ‘CEE region’) and to manage certain art’otel® branded properties, enabling us to further grow our presence. As part of the expanded cooperation with the Radisson Hotel Group, PPHE has secured access to the entire range of Radisson Hotel Group brands, including the Radisson Collection and Radisson RED, and has the right to sublicense them to AHG. AHG is thereby enabled to exploit the leading market brands of the Radisson Hotel Group in various market segments, in addition to its existing activities in the high-end and lifestyle hotel segment.
We at AHG and our subsidiaries (hereinafter together: “Arena”, “we”, “our”, “us”) are dedicated to protecting the privacy of all persons whose personal data we collect (hereinafter: “you”, “your”).
We process your personal data only in accordance with the applicable regulations: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: „General Data Protection Regulation“, „GDPR“), local regulations ensuring the implementation of the General Data Protection Regulation as well as other applicable regulations governing the protection of personal data depending on the region in which we operate.
In relation to some of your personal information which we process AHG may be considered a joint data controller with its subsidiaries, affiliates or third party. We may share your personal data within the Arena group and some entities within the group may provide services as processors to the controllers who are responsible for handling your personal data.
Tourist agency
As part of the activities of the travel agency, AHG collects and processes personal data of users for the purpose of selling, booking and/or realizing tourist services, including transfers within the country and excursions with included transport in its own organization or in the name and on behalf of other organizers, through our partner’s Turneo Ltd online platform and Atistria physical points of sale and information desks.
Atistria Experience
Through the website www.atistria.com acting as an intermediary, AHG promotes and provides an overview of a wide range of experiences within the Atistria Experience that can complement the stay of guests in our facilities.
The Atistria Experience platform is managed by our partner Turneo Ltd, who promotes and sells those experiences as an intermediary to companies, individuals, associations, family farms and other service providers (hereinafter referred to as the Organizers) who offer these same experiences to guests.
Arena Hospitality Group is not the owner or executor of the services offered through the Atistria Experience and therefore cannot be held responsible for any potential legal, material or any other problems that may arise when consuming the experiences it offers. Arena Hospitality Group is not responsible for any wrongly performed or non-performed service by the Organizer or any third party. Arena Hospitality Group does not provide any warranty or representation regarding the standard of service provided by the Organizer.
With regard to the processing of personal data, AHG, Turneo Ltd and the Organizers are considered independent data controllers.
For more information on data protection by our partner Turneo Ltd please read their Privacy Policy.
Purpose of processing
Personal dana is processed for the following purposes:
Booking and sale of tourist services (excursions, transfers and other activities and experiences)
Communication with users regarding reservations and potential changes related to reservations
Invoicing and business record keeping
Fulfilment of legal obligations (e.g. compliance with regulations on the provision of tourist services, tax and accounting regulations)
Bookings via third-party online platforms
Promotional activities subject to legal restrictions
Resolving queries and providing user support
Keep track of user satisfaction and Improvement our website and the services we provide, as well as the experiences and activities we promote.
Gaining insight into user needs
Business analysis
Legal bases for data collection and processing
The legal bases for collecting data for the above purposes are:
legal – processing is necessary for compliance with the legal obligations of the controller
contractual – processing is necessary for the performance of a contract to which the data subject is a party or in order to take actions at the request of the data subject before concluding a contract
legitimate interest – processing is necessary for the purposes of the legitimate interests of the controller or a third party, except when these interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data, in particular if the data subject is a child
consent – the data subject has given consent to the processing of his or her specific data for one or more specific purposes
in exceptional circumstances – the data subject’s vital interests – the processing is necessary to protect the vital interests of the data subject or another natural person
Categories of personal data
Depending on the type of service or business activity, we may collect the following information:
Name and surname
Contact details (e-mail, phone number)
ID or passport number, gender, citizenship (if legally required
Date of birth (if legally required or if necessary to customize and provide the service, activity, or experience)
Address information
Payment data (excluding full card number)
Additional information relevant to the provision of the service (e.g. special requests, health data if the user provides such data himself/herself)
IP address, technical data, data collected using cookies (more information can be found in our Cookie Policy (https://atistria.com/hr/cookie-settings/)
Data sources
Data is collected directly from users:
through the website and integrated platforms
at physical sales locations and information desks
via contact form, e-mail, phone and other communication channels
via web services
via newsletter registration or other interactive functionalities
mobile and web apps, if available.
Data may also be collected from publicly available sources, e.g. through social networks and platforms (comments, reactions, etc.), when you leave a review related to the use of our websites and services.
Processing of business partner data
As part of our business relationship with partners (e.g. agencies, service providers, suppliers, external collaborators), we process the personal dana of natural persons acting on behalf of partners (e.g. legal representative, contact persons, managers, employees, representatives).
The information we collect:
name and surname
business e-mail address and phone number
function/position within a legal entity
iInformation contained in correspondence and contracts
transaction data
In this case, the processing may be based on:
the performance of the contract or taking actions prior to the conclusion of the contract
legal obligations (e.g. pursuant accounting and tax regulations)
legitimate interest in establishing and maintaining business cooperation
Data recipients
Personal dana may be shared
a) internally
– within the Arena Group and affiliated companies
b) with external recipients such as:
– partners
– organizers
– IT service and system maintenance providers
– booking platforms
– providers of website hosting services and website maintenance
– website maintenance service providers
– legal, tax and other professional advisors, auditors, insurers
– supervisory and other state authorities, including the tax administration
– analytics providers (e.g. Google Analytics)
In the event that the recipients are considered to be processors in accordance with the GDPR, we will ensure that they apply appropriate protection measures in accordance with applicable data protection regulations and industry standards (e.g. by concluding data processing agreements, applying standard contractual clauses, having appropriate general terms and conditions, having appropriate information security certificates).
Transfer of personal data outside the European Economic Area
Due to the global nature of our business and our third-party suppliers who process your personal data, the personal data we collect from you may be transferred to, processed and stored outside the European Economic Area (EEA) including (where applicable) outside the jurisdiction where the personal data was collected.
We will take all necessary steps to ensure that your personal data is processed in a secure manner and in accordance with this Privacy Policy and all applicable data protection regulations and in accordance with Chapter V of the GDPR (data transfers based on an adequacy decision of the European Commission, based on appropriate safeguards e.g. standard contractual clauses)
When your personal data is transferred from the EEA to a non-EEA jurisdiction, we will comply with our legal obligations (and take into account that third-party suppliers comply with their obligations) in relation to the personal data, including that we have a lawful basis for the transfer of the personal data and that appropriate safeguards are in place to ensure an adequate level of protection of the personal data.
Data retention
We only keep your personal data for as long as necessary for the purposes for which we collect it.
If we collect and process your data for the purpose of fulfilling our legal obligations, we store them for the duration prescribed by applicable regulations (e.g. in accordance with accounting regulations, regulations on the provision of services in tourism).
We will keep the data we have collected on the basis of the contractual relationship for as long as it is necessary for the fulfilment of the contract or for the provision of the service and in accordance with our retention obligations.
We will keep the data we collect on the basis of consent for the period provided for the purpose for which the consent was given or until the consent is withdrawn.
We may also store data for the duration of proceedings related to the establishment, exercise or defence of legal claims.
After the purpose for which they were collected ceases to exist, we no longer use your personal data and they remain in our storage system and we keep them as long as we are obliged by legal regulations on the preservation of archival records.
Security of personal data
We are committed to safeguarding the personal data you provide to us and will take reasonable precautions to protect your personal information from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated with personal data processing.
We perform access control and provide access to data only to authorized persons who committed themself to maintain the confidentiality of the personal data they have access to.
Your rights
In relation to the personal data we process, you have the following rights:
Right of access – you have the right to know whether we process your dana and to obtain a copy of that dana.
Right to rectification – You may request the correction of inaccurate or incomplete.
Right to erasure („right to be forgotten“) – You may request the erasure of your dana when it is no longer needed or the processing is unlawful.
Right to restriction of processing – In certain circumstances, you may request temporary restriction of processing e.g. if you contest the accuracy of the data, if the processing is unlawful and you oppose the erasure of the data, for the purpose of establishing, exercising and defence of legal claims, if you have objected to the processing of the data
Right to object – you have the right to object to processing based on legitimate interest, including profiling, and when your personal data is processed for direct marketing purposes.
Right to data portability – you may request the transfer of your dana to another data controller in a structured, commonly used, and machine-readable format.
Right to withdraw consent – If the processing is based on consent, you have the right, to withdraw such consent at any time, without affecting the lawfulness of the processing that preceded the withdrawal of consent.
Right regarding automated individual decision-making, including profiling – You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless (i) the decision is necessary for the entering into, or performance of a contract between you and us; (ii) or if the decision is permitted by law, if that law prescribes appropriate measures to protect the rights, freedoms and legitimate interests of the data subjects; (iii) or if it is based on your explicit consent.
The exercise of certain rights may be restricted if the processing of personal data is, for example, necessary to comply with our legal obligations, for the establishment, exercise or defence of legal claims, if there are compelling legitimate reasons for the processing that outweigh the interests, freedoms and rights of the data subject, if data portability is technically impracticable and in other cases in accordance with applicable regulations.
Right to lodge a complaint with a supervisory authority – if you believe that the processing of your personal data by the Arena violates the applicable regulations on the protection of personal data, you have the right to lodge a complaint with the competent supervisory authority for data protection. In the Republic of Croatia, this is the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, HR – 10 000 Zagreb, e-mail: e-mail: [email protected]
We invite you to contact us directly if you have any concerns about any aspect of our privacy practices and the way we have handled your information in order to resolve any concerns, uncertainties, and to resolve your request in a satisfactory manner.
If you have any questions about this Privacy Policy or wish to exercise your rights listed above, you may contact us:
1) by E-mail: [email protected]
2) in writing to the address of the registered seat of Arena Hospitality Group d.d., Smareglina 3, 52100 Pula, Croatia (for the Data Protection Officer)
We will respond to all such requests regarding the exercise of your rights without undue delay and in any case within the deadlines set by applicable regulations.
The information will be provided without undue delay and in any event within one month of receipt of the request. This deadline may be extended by an additional two months if necessary, taking into account the complexity and number of requests. We will inform you of any such extension, as well as the reasons for the extension, within one month of receipt of the request.
In the event that we have reasonable doubts about the identity of the natural person making the request, we may request the provision of additional information necessary to confirm the identity in order to protect the data subject’s data from unauthorized disclosure.
Where the requests from a data subject are manifestly unfounded or excessive, in particular due to their frequent repetition, we may: a) charge a reasonable fee, taking into account the administrative costs of providing the information or communication or acting on the request, or b) refuse to act on the request.
Use of cookies and similar technologies
Our website uses certain cookies, pixels, beacons, logs, and other technologies. Please read our Cookie Policy (https://atistria.com/hr/cookie-settings/) to learn more about the cookies we use, how you can manage them and how you can delete them.
Third-Party Links and Services
Our Website contains links to third-party websites and services. Please note that when you use a link to go from our website to another website or request a service from a third party, this Privacy Policy no longer applies.
Your browsing and interaction on any other website or your business relationship with any other third-party service provider is subject to that website or third-party service provider’s own rules and policies.
We encourage you to familiarize yourself with the privacy practices of each website you visit or the practices of a third-party service provider with whom you come into contact, and to contact them if you have questions about their privacy policies and practices.
This Privacy Policy applies only to personal information collected through our website and services and does not apply to third-party websites and third-party service providers.
Changes to the Privacy Policy
We reserve the right to amend this Privacy Policy to align it with changes in legislation, our internal practices, or changes in the way we provide our services.
Any changes to this Privacy Policy will be posted on our website so that you are always informed about how we collect and use your personal information.
We encourage you to periodically review this Privacy Policy to stay informed about how we use your personal data and how we protect your privacy.
Last updated on: 27th of June, 2025
