This policy explains how we handle the personal data you provide when you send a booking request through pecka.ba.
Who is responsible for your data
pecka.ba is an information portal for Pecka and the surrounding area in Bosnia and Herzegovina.
Accommodation bookings made through the website are handled by:
Društvo sa ograničenom odgovornošću "Outdoor resort Pecka" Mrkonjić Grad (Pecka Outdoor Resort)
Registered office: Mrkonjić Grad, Bosnia and Herzegovina
Company ID (JIB): 4404620580005
Email: peckaoutdoor@gmail.com
In this policy, "we" means Pecka Outdoor Resort, the controller of your personal data.
Asarum Tech LLC (Delaware, USA; 16192 Coastal Highway, Lewes, DE 19958) hosts and maintains the website. It processes your data only on our instructions, under a data processing agreement, and never for any other purpose.
We process your data in line with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH, No. 12/25).
What data we process and why
Booking requests
When you send a booking request, we process your name, email, phone number, dates of stay, chosen cabins and number of guests, whether your group includes foreign nationals, whether you are bringing a pet, your planned arrival time, and any note you leave. Your name, email, phone number, dates, cabins, number of guests and whether your group includes foreign nationals are required; the pet, planned arrival time and note are optional.
We use this data to handle your request, confirm your booking and arrange the details of your stay. The legal basis is your request before entering into an accommodation contract, and performing that contract. Without this data we cannot process your booking.
Registering your stay
As an accommodation provider in Bosnia and Herzegovina, we are required by law to register the stay of every guest with the competent authorities and to keep a guest register. Foreign guests are registered with the Service for Foreigners' Affairs within 12 hours of arrival (Law on Foreigners, Article 103).
We take the details needed for registration from your passport or ID card when you arrive. On the website we only record whether your group includes foreign nationals and whether your stay has been registered. The legal basis is our legal obligation.
Protecting the form from abuse
We protect the booking form from automated and fake submissions. For this we use Cloudflare Turnstile, which processes technical data about your device and browser, and we limit the number of requests from the same IP address. The legal basis is our legitimate interest in protecting the system and our staff from abuse.
Technical data
When you send a request, the server records technical data such as your IP address, the time of access and your browser type. This data is used for security and to keep the booking system running properly. The legal basis is our legitimate interest.
Who receives your data
We do not sell your data or use it for advertising. We share it only where needed for the purposes above:
- Asarum Tech LLC, which hosts and maintains the website, and its service providers: Vercel Inc. (website hosting), Neon (database) and Zoho (the email service we use to send confirmations)
- an internal messaging app, which notifies our staff of new requests (name, phone, dates and cabins) so we can reply quickly
- Cloudflare, to protect the form from abuse
- The authorities responsible for registering stays, including the Service for Foreigners' Affairs of Bosnia and Herzegovina for foreign guests, as required by law
Transfers outside Bosnia and Herzegovina
Asarum Tech LLC and some of the providers listed above are based or process data outside Bosnia and Herzegovina, including in the European Union and the United States. We make such transfers in line with the law, under contractual data protection obligations that bind these providers.
How long we keep your data
- Confirmed bookings: your name, contact details and notes are deleted 2 years after your departure, so that we can answer any questions or complaints about your stay. After that we keep only the dates, cabins and price, without your name or contact details, for statistics.
- Declined, cancelled and unanswered requests: personal data is deleted 6 months after the requested dates, so that we can answer any questions about the request.
- Registration details are entered in the guest register, and for foreign guests also in the register of foreigners. We keep these registers for as long as the law requires, and the register of foreigners for at least three years after it is closed.
- Copies of messages: notifications in the internal messaging app are deleted automatically after one month, and we keep email correspondence with guests no longer than the booking data itself. Database backups are replaced automatically within a short period.
Your rights
You can ask us at any time to:
- give you access to the data we hold about you
- correct inaccurate data
- delete your data, except data we are required by law to keep
- restrict processing
- transfer your data
You can also object to processing based on our legitimate interest.
Send your request to peckaoutdoor@gmail.com. We will reply within 30 days at the latest.
If you believe we are processing your data unlawfully, you can lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina.
Security
The website uses an encrypted connection (HTTPS). Only authorised staff can access booking data, through the website's protected admin area.
Changes to this policy
We may update this policy when the way the website works or the law changes. The current version is always published on this page, with the date of the last update.