Privacy & Cookie Policy

M-DUB, Car Rental Business, Owner Mirko Obradović

Owner: Mirko Obradović
Nikole Tesle 3
20000 Dubrovnik
Croatia

OIB: 39466887905
MB: 97330728

Email: info.mdub@gmail.com
Telephone: +385 98 963 1171
Website: dubrovnikprivatetransfer.com

Privacy requests can be sent to info.mdub@gmail.com.

The contact form and the quote form collect the same information. Neither form creates a booking or takes payment. Both prepare a WhatsApp message, which is sent only if the customer sends it.

The forms ask for:

• name
• pickup location
• drop-off location
• date
• time
• number of passengers
• an optional message

The forms do not ask for a separate email address, telephone number, flight number, vehicle choice, billing details or card number. A flight number, luggage note, child-seat request or other detail is processed only if the customer includes it in the message or sends it later by WhatsApp, telephone or email.

When the customer sends the WhatsApp message, WhatsApp shows M-DUB the customer WhatsApp number. That number is not typed into the website form.

The hosting provider may process technical connection data, such as IP address, browser type and the page requested, in server logs used to deliver and protect the website. This website does not run its own analytics.

Information needed to answer an inquiry or carry out a transfer is not processed on the basis of marketing consent. Consent is used only where it is actually required.

• Responding to an inquiry and preparing a quotation: steps requested by the customer before a contract (GDPR Article 6(1)(b)).
• Confirming a booking, organising transportation, sending pickup instructions, the meeting point and the pickup time, communicating changes, and providing the booked journey: performance of a contract (GDPR Article 6(1)(b)).
• Monitoring a flight when the customer has provided the flight number for an arrival transfer: performance of that requested transfer (GDPR Article 6(1)(b)).
• Payments and refunds agreed off the website, where a booking is confirmed: performance of a contract (GDPR Article 6(1)(b)). This website does not collect card details.
• Issuing invoices and keeping accounting and tax records: legal obligation (GDPR Article 6(1)(c)).
• Customer support and written complaints: performance of a contract and, for the statutory complaint record, legal obligation (GDPR Article 6(1)(b) and 6(1)(c)).
• Technical logs needed to operate and secure the website: legitimate interest in running a reliable site (GDPR Article 6(1)(f)). This interest is limited to technical operation.
• Optional analytics or marketing cookies, if a tool of that kind is ever added: consent (GDPR Article 6(1)(a)). No such tool is installed today. Inquiry and booking data is not used for unrelated marketing.

The application source and the production homepage were checked for third-party scripts. The following were not found: Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, Microsoft Clarity, Hotjar, TikTok Pixel, reCAPTCHA, an embedded Google Map, YouTube, Vimeo, a payment-provider script, and a booking-engine script.

What is in use:

• The website itself, hosted on Vercel. The homepage response did not set a cookie.
• WhatsApp links (wa.me). A cookie is not set on this website by the link. If the customer opens WhatsApp, WhatsApp may set cookies on the WhatsApp service.
• Links to the M-DUB Facebook and Instagram profiles. They are not embedded plugins and they do not receive the form contents.
• Typefaces served by this website. The browser is not sent to Google Fonts to load them.
• A cookie preference stored in local storage on the device, and only after the visitor chooses Accept, Reject or Save settings. It is not sent to M-DUB as a marketing profile. Remembering that choice is a necessary function.

Necessary storage may stay available. Analytics and Marketing are off until the visitor enables them. Enabling a category does not load a tool that is not installed. The choice can be changed at any time through Cookie Settings in the footer.

Personal data is shared only as far as the operation requires:

• WhatsApp (Meta), when the customer sends the inquiry or a later message through WhatsApp.
• Vercel, the hosting provider, for technical delivery of the website.
• A driver or other person engaged to carry out a confirmed journey, limited to the details needed for that journey.
• Public authorities, where the law requires it.
• An accounting provider, where M-DUB uses one, for invoices and tax records.

No payment processor, advertising network or booking engine receives data from this website, because none is connected to it.

This policy does not claim that personal data never leaves the European Economic Area. Vercel is a hosting provider that can process connection data outside the EEA. WhatsApp is operated by Meta, and a message the customer sends through WhatsApp can be processed outside the EEA under that service. Where M-DUB transfers personal data outside the EEA, it does so only with a safeguard required by the GDPR, such as standard contractual clauses, or another lawful transfer tool.

Personal information is kept only for as long as it is needed for the purpose for which it was collected, and for any longer period the law requires. This policy does not set an extra retention period of its own.

• The website does not store form submissions in its own database. The details sit in the WhatsApp message the customer sends. Correspondence needed to organise a journey is kept while that journey, and any question about it, still needs to be handled.
• Accounting documents entered in the journal and ledger are kept for at least 11 years under the Croatian Accounting Act, from the last day of the business year to which the books relate. A different period applies where the law on fiscalisation says so. Fiscalised e-invoices are kept for the period that law requires, currently 6 years.
• Records of written consumer complaints are kept for one year from receipt, as required by Article 10(7) of the Croatian Consumer Protection Act.
• A saved cookie preference stays in local storage on the device until the visitor changes it or clears site data.

Under the GDPR, the customer may ask M-DUB for:

• access to personal data
• rectification of inaccurate data
• erasure, where a ground for erasure applies
• restriction of processing
• portability of data provided by the customer and processed by automated means on the basis of a contract or consent
• objection to processing based on legitimate interests
• withdrawal of consent, where processing is based on consent, without affecting processing that took place before withdrawal

Consent is not required to request or book a transfer. Withdrawing a cookie choice does not cancel a confirmed journey. Requests can be sent to info.mdub@gmail.com.

The customer may lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Selska cesta 136, 10000 Zagreb, azop.hr.

General Terms & Conditions · Cancellation Policy · Written Complaints