HOTEL LERO d.o.o.
Iva Vojnovića 14
20 000 Dubrovnik
The company is signed into a court registrar at Commercial court in Dubrovnik under the number 060005711
VAT number: 97744396969
Board: Srđan Pujo, board member
Shared capital: 3.840.560,00 EUR, fully paid-up 
OTP BANK
Domovinskog rata 61, 21000 Split
IBAN: HR9824070001100619362
SWIFT: OTPVHR2X

1. Personal data processing
HOTEL LERO d.o.o. shall process personal data with fairness and in accordance with the law.
HOTEL LERO d.o.o. shall ensure accuracy, completeness and up-to-dateness of the collected personal data.

2. Purpose of collecting personal data
HOTEL LERO d.o.o. shall store personal data in the form which enables identification of data subjects for not longer than required by the purpose for which the data were collected or processed further.
We collect personal data primarily for the purpose of:

• more efficient response to your inquiry
• providing requested services
• promoting our services
• our internal statistical data processing
• possibility of sending publications, brochures and other promotional material

Data covered by the system of Personal Data Protection Policy (Privacy Policy):

• name and surname
• date of birth
• address
• e-mail address
• telephone and/or fax number
• other data that you mentioned, but wish to keep them confidential

HOTEL LERO d.o.o. collects data for the purpose which is known to the data subject (natural person), which is expressly stated and in line with the Law. Personal data shall be processed further only for the purpose for which they were collected initially, i.e. which corresponds with the purpose of collection.
HOTEL LERO d.o.o. shall not collect personal data in the volume exceeding the requirements of the set purpose.
Personal data shall be used by HOTEL LERO d.o.o. only for the time required to meet the specific purpose, unless a longer period is specified by a special law, and upon the expiry of that period, personal data shall be deleted, unless otherwise specified by a special law.

3. Duration of the privacy policy
At the moment of submitting your data, you agree to be contacted by us and you enter our mailing list – the moment of entry represents your explicit consent to be contacted. The protection of privacy of your data is permanent, and you could request to be removed from our mailing list at any moment. After that, the data will not be used by HOTEL LERO d.o.o. , apart from some internal purposes, e.g. computer data processing or statistical data processing.

4. Basis for collection and further processing of personal data
HOTEL LERO d.o.o. shall collect and process data:

• with consent of data subjects and only for the purpose that the data subject has consented to, or
• in cases specified by a specific law, or
• for the purpose of compliance with legal obligations of HOTEL LERO d.o.o., or
• for the purpose of entering into or executing a contract that the data subject is a party to, or
• for the purpose of protecting life or physical integrity of the data subject or other person in case where the data subject is physically or legally unable to give his/her consent, or
• if data processing is required for conducting the tasks carried out in the public interest or for the purpose of exercising public authorisations of HOTEL LERO d.o.o.. or the third party that the data shall be submitted to, or
• if data processing is required for the purpose of legitimate interests of HOTEL LERO d.o.o. or the third party that the data shall be disclosed to, except in cases when the interests of protecting the fundamental rights and freedoms of data subjects prevail, or
• if the data have been disclosed by the data subject.

In cases of the above items 1 and 8, HOTEL LERO d.o.o. shall entitle the data subjects to revoke their consent at any time and request the suspension of any further processing of their personal data, unless the data are processed for the purpose of statistics, where personal data no longer enable the identification of the persons concerned.

5. Information to be provided to data subjects by HOTEL LERO d.o.o.
Prior to any instance of personal data collection, HOTEL LERO d.o.o. shall, by all means, provide the data subjects with the minimum of information concerning the following:

• identity of the personal data collection manager,
• purpose of the processing to be conducted by using the data,
• right of access to information and right to correct the data referring to him/her,
• personal data recipients or categories of personal data recipients, and
• classification of data submission as voluntary or mandatory, including the possible consequences of withholding information.

In case of the mandatory data submission, the request to submit data shall also include the legal basis for personal data processing.
Information shall be available through all data collection channels.
Prior to submitting personal data to other users and recipients, HOTEL LERO d.o.o. shall inform the data subjects of such intentions by using the existing contact information of the data subjects.

6. Responsibilities of employees
All persons employed by HOTEL LERO d.o.o. shall, in accordance with the valid regulations and internal acts, process personal data.
At the same time, the employees shall report any irregularities relating to personal data processing to this e-mail address human.resources@hotel-lero.hr
All employees shall participate in education and trainings.

7. Responsibilities of other persons
All persons who are not directly employed by HOTEL LERO d.o.o., and who were appointed to perform tasks on its behalf, undertake to comply with this Regulation and shall be informed about it at the occasion of contracting a business relationship. At the same time, HOTEL LERO d.o.o. shall, when contracting any business relationship with the provider of data processing, ensure a proof of adequacy and ability to process personal data in accordance with the legal framework.

8. Delegating the tasks of personal data processing to data processing provider and forwarding data to recipients
On the basis of business-related justification, HOTEL LERO d.o.o. may entrust the collected personal data to the provider of data processing and/or forward the data to further recipients in line with the procedure, and in accordance with the legal framework.

9. Taking personal data out of Croatia
HOTEL LERO d.o.o. shall take personal data collections, i.e. personal data included in the personal data collections, out of Croatia for the purpose of further processing only if the country or an international organisation to which the personal data are taken, has adequately regulated personal data protection, i.e. if adequate security level is established.

Prior to taking personal data out of Croatia, HOTEL LERO d.o.o. shall, in case there is a reason to doubt the existence of adequately regulated personal data protection, i.e. in case of the countries not listed by the European Commission or if there is no other official agreement, obtain an opinion of the competent authority on the basis of a template of contracted business.

List of countries with adequate protection is available on the pages of the Croatian Data Protection Agency (AZOP).
Notwithstanding the above mentioned, personal data included in personal data collections of HOTEL LERO d.o.o. shall be taken out of Croatia to the countries or international organisations that provide no adequate protection level only in cases prescribed by the law.

In cases of establishments in several countries, some of which provide no adequate personal data protection level, HOTEL LERO d.o.o. shall obtain an approval of the competent authority.

10. Rights of data subjects and protection of data subjects’ rights
No later than [15 days] from receiving a personal request of the data subject, i.e. request of their legal representatives or authorised persons, Hotel Lero d.o.o. shall:

• submit a conformation stating whether personal data referring to him/her are processed or not,
• provide a notification, in an intelligible form, on the data referring to him/her that are processed, as well as on the source of this data,
• enable the data subject to examine the records of the personal data collection and to examine and transcribe the personal data included in this collection that refer to him/her,
• submit excerpts, receipts or printouts of the personal data included in the personal data collection that refer to him/her, which must indicate the purpose and legal basis for collection, processing and use of this data,
• submit a printout of information on the persons who have used this data, on the purpose that the data were used for and on the legal basis for using the personal data referring to him/her, and
• provide information on the logic of any automatic data processing relating to him/her.

Upon the request of the data subject, i.e. their legal representatives or authorised persons, HOTEL LERO d.o.o. shall amend, change or delete personal data, if the data were incomplete, inaccurate or obsolete, and if the processing of such data is not in line with the provisions of the Personal Data Protection Act.

Regardless of the data subject’s request, in case of establishing that personal data were incomplete, inaccurate or obsolete, HOTEL LERO d.o.o. shall complete or change the data on its own. Within no later than [30 days], HOTEL LERO d.o.o. shall notify the data subject, together with the personal data recipients, on any amendments, changes or removal of personal data.

11. Personal data processing for marketing purposes
Prior to collecting personal data, HOTEL LERO d.o.o. shall notify the respondent on the intended personal data processing for marketing purposes, and ensure his/her consent, while also enabling them to disapprove of such processing.

12. Unauthorised outflow of personal data
In case of any unauthorised outflow of personal data, i.e. violation of personal data through accidental or intentional operational activities, or by natural persons or legal entities acting on behalf of HOTEL LERO d.o.o., which has a significant impact on data subjects’ personal data, as estimated within the assessment of personal data processing, HOTEL LERO d.o.o. shall notify the data subjects and the competent authority, within a legally prescribed deadline.

13. Security of personal data processing
In accordance with the possibilities and the personal data protection impact assessment, HOTEL LERO d.o.o. shall implement appropriate technical and organisational measures to ensure an adequate security level, and include, when necessary:

• pseudonymisation and encryption of personal data;
• ability to ensure permanent confidentiality, completeness, availability and resistance of the system and processing services;
• ability to ensure timely re-availability and access to personal data in case of physical or technical incident;
• regular testing, evaluation and assessment with regard to efficiency of technical and organisational measures for ensuring the security of data processing

14. Protection of children’s personal data
HOTEL LERO d.o.o. advises parents and guardians to teach children about safe and responsible handling of personal data on the Internet. HOTEL LERO d.o.o. has no wish or intention to collect personal data of persons under 14 years of age and shall in no way use or disclose these data to the third persons.

We do not enable children to publicly disclose or in any other way distribute, without parents’ consent, any personal information or other material that they send to us, and which could be used to make contact with them.
Upon parents’ request, child’s personal data shall be deleted from our database. As parents or guardians, you will always be entitled to request an insight into all personal data of your child that were received through our web pages, to request that we delete the data (if the data are still in our database) and/or forbid any future collection and use of your child’s data.

If you are a parent and you wish to exercise this right, please contact us. In addition to the above mentioned, HOTEL LERO d.o.o. shall guarantee the protection of the personal data of children, as provided by special laws regulating this issue.

15. Your consent
By completing the forms on this page, you guarantee that the information you provided are accurate, that you have the business capacity and authorisation to use the information submitted, and you give your full consent to HOTEL LERO d.o.o. to use and collect your data in accordance with the law and the requirements of our privacy policy.

16. Transparency
In case we decide to change our privacy policy, all changes will be published on this page to allow you to access them at any time. These changes will also apply to our relationship, as if they existed prior to you becoming a member of our mailing list, provided that they comply with the positive Croatian regulations and cause no deprivations of some of your acquired rights.

This website uses cookies to enhance user services and facilitate navigation through our pages. You can configure and modify cookie settings on the site. You can still browse the site by blocking cookies, but some of its features may not function properly.

When browsing the site, no personal data is collected that would allow your personal identification. If we require your personal data to provide a specific service, we will explicitly notify you. All information collected by cookies is aggregated and thus anonymous.

Cookies are small text files that our web server places on the web browser of your computer. When you return to our website, your web browser sends the cookies back to us, allowing our web server to recognize them and adjust the website settings for better usability. This way, the information is tailored to your needs and usual usage patterns. You can find more detailed information about the use of cookies at http://www.aboutcookies.org. Beyond simple setting information, cookies can store a large amount of personal information (such as your name and email address), but only if you give explicit consent. If you do not provide access, cookies cannot access the files on your computer.

The website hotel-lero.hr uses temporary cookies (session cookies), which remain on your personal computer only during your visit and are deleted from your computer when you close the web browser. These cookies allow the site to store temporary data.

The website hotel-lero.hr also uses persistent cookies, which remain on your computer even after you close the browser until they expire or you manually delete them. All information collected by these cookies is aggregated and thus anonymous. These are Google Analytics GA4 cookies, which last up to 2 years, depending on the type of information they collect. Google Analytics GA4 cookies are used to measure website traffic and track how our website is used, what content interests our users, in order to improve and enhance the functionality of our website. The statistical cookies from Google Analytics GA4 enable the viewing of statistics for visited web pages, including the last visit. Find out more about GA4 here.

Our website uses sharing links for sharing content via various social services and networks. As third parties, these services may access some of your data and track your online activity. Please refer to their terms of use and privacy policies on those websites.

Dear Guests,

We hereby inform you of a personal data breach relating to the reservation management system used by Hotel Lero.

Most importantly, according to the information currently available, your payment card data has not been affected.

What happened

A third party unlawfully accessed part of the reservation management system. According to the findings available so far, the data that may have been affected relates to your reservation and may include your name and surname, e-mail address, address, and reservation details, such as the reservation number, dates of stay and property name.

According to the findings available so far, the database itself has not been compromised and the system remains safe for continued use. Your reservation remains valid and you do not need to make any changes to it.

What this means for you

Since the above data may have been accessed by a third party, there is a risk that someone may try to contact you by falsely presenting themselves as Hotel Lero or as our partner. Such attempts have already been recorded. Their purpose is to persuade you to authorise a payment, transfer money, or obtain your payment card details.

How to recognise a scam

Such messages may be sent by e-mail, WhatsApp or similar communication channels. To appear credible, they often include real details of your reservation, such as your name, reservation number or dates of stay. They often threaten that your reservation will be cancelled within a short period of time unless you immediately make a payment or confirm your details, and they direct you to a link where you are asked to enter your card details.

This is not how we communicate with our guests.

What we kindly ask you to do

- Do not open links contained in such messages.
- Do not enter your card details and do not make any payments based on such messages.
- Do not reply to such messages and do not share your personal data with anyone.
- If you are unsure whether a message is genuine, do not use the contact details contained in that message. Please contact us directly through the official contact details of Hotel Lero or through the details provided in your original reservation confirmation, and we will be happy to verify this for you.

Please note that Hotel Lero never requests payment or confirmation of card details through a link contained in a message.

If you have already acted upon such a message

If you have already entered your payment card details or made a payment based on such a message, we recommend that you immediately contact your bank or card issuer, report the potential fraud and request instructions on further measures to protect your card and dispute the transaction. The sooner you act, the easier it is to prevent or reduce any damage.

What we have done

As soon as we became aware of the breach, in cooperation with the reservation system provider, unauthorised access was restricted and the system was additionally secured. External cybersecurity experts have been engaged to determine the circumstances and scope of the breach, and additional security measures are being introduced to prevent recurrence. We are also monitoring the described fraud attempts and will inform you of any important updates in due course.

For any questions regarding this notice, we remain at your disposal.

For questions related to personal data protection, you may contact the Data Protection Officer of Hotel Lero at: marko@rasica.eu.

We apologise for any inconvenience caused and thank you for your understanding.

Sincerely,

Hotel Lero