Privacy policy

Draft — the text is still being reviewed by a lawyer.

Version: draft of 3 October 2026. Details in square brackets are not filled in yet or still need to be confirmed.

The controller of your personal data on Buqtivity is [Business name], OIB [OIB], [Address]. For any question about personal data, write to [E-mail].

[for the lawyer: whether a data protection officer must be appointed (General Data Protection Regulation, Art. 37); if so, give their contact.]

The organiser of an event you book receives the data needed to run the activity and is an independent controller of it. [for the lawyer: independent or joint controllers (Art. 26); settle it in the agreement with organisers.]

This policy explains which data we process, why and on what legal basis (General Data Protection Regulation, "GDPR", Art. 6), with whom we share it, how long we keep it and what your rights are.

• Account: name, e-mail address, phone (if you enter it), password (stored by Google Firebase Authentication in protected form; we never see it), role (customer, leader, business), settings, favourite and recently viewed events. Basis: contract (Art. 6(1)(b)).
• Bookings and payments: event, date, tickets and extras, amounts, participants' names and the details the organiser asks for (e.g. age, experience), coupons, cancellations and refunds. Payments are processed by Stripe; we receive the payment status and basic transaction details, not the card number. Basis: contract; keeping accounting records: legal obligation (Art. 6(1)(c)). [for the lawyer: if an organiser asks for health data (e.g. allergies, health limitations), that is a special category of data (Art. 9): explicit consent or another exemption is needed.]
• Bookings for others: if you book for other participants, you enter their details. Please tell them and point them to this policy.
• Booking notices: confirmations, reminders, changes, cancellations and refunds are sent by e-mail. Basis: contract.
• The organiser's messages after the activity (e.g. photos, a thank-you): sent only if you agreed when booking, and for at most 7 days after the activity. You can withdraw your agreement in your order. Basis: consent (Art. 6(1)(a)). Messages needed to run the booking do not depend on it.
• Booking-open notices and newsletter: if you ask to be told when an announced event opens for booking, or sign up for the newsletter, we use your e-mail address for that only. Basis: consent; you can unsubscribe at any time.
• Customer support and complaints: your messages and our answers. Basis: contract, legal obligation (consumer complaints) and legitimate interest (Art. 6(1)(f)).
• Organisers (activity leaders and businesses): business details and contact person, profile, documents for approval, payout details. Basis: contract and legal obligations.

• Reviews: rating, text, the name you enter as the author, the date and the verified-booking mark. Reviews are public. Basis: your decision to publish the review and our legitimate interest in giving other customers reliable information. [for the lawyer: the legal basis for reviews (contract, consent or legitimate interest).]
• Analytics (PostHog, servers in the EU; Google Analytics): how the site is used (pages visited, clicks, device and browser, approximate location) and session recordings in which everything you type, and all text on the account, cart and checkout pages, is hidden. A signed-in user is recognised only by an internal identifier and role, never by name or e-mail address. Analytics start only if you accept cookies. Basis: consent. [for the lawyer: Google Analytics sends data to Google, which may process it in the USA.]
• Error reports (Sentry, servers in the EU): when an error happens on the site, technical data is sent (the error message, page, browser, app version) and, for signed-in users, the internal identifier and role. No IP address, cookies or form contents are sent, and nothing is stored in the browser. Basis: legitimate interest (a working and secure site). [for the lawyer: error reports run without cookie consent because they store nothing on the device; confirm that legitimate interest is the right basis.]
• Security: IP address, time and device details when you sign in and in server logs, request limits, and Google reCAPTCHA on sign-in, sign-up and password reset, to protect against abuse and fraud. Basis: legitimate interest.

We make no decisions based solely on automated processing that have legal or similarly significant effects on you.

• The organiser of the event you booked: name, contact and the participant details needed to run the activity, and your choice about messages after the activity.
• Google (Firebase and Google Cloud): hosting, database, sign-in, file storage and server functions, in data centres in the EU; Google reCAPTCHA and Google Analytics.
• Stripe: processing payments and refunds and preventing fraud. Stripe is an independent controller of part of the data. [for the lawyer: Stripe's contracting entity for the EU and the split of roles.]
• Resend: sending e-mail (confirmations, notices). [for the lawyer: Resend is a US business; check the sending region and the data processing agreement.]
• Typesense: search for events, places and organisers. We run the search server ourselves, on Google Cloud in the EU; it holds data from the public listings. [for the lawyer: confirm that the index holds no personal data of customers.]
• PostHog (servers in the EU): analytics, only with your consent.
• Sentry (servers in the EU): error reports.
• Advisers and authorities: accountants, lawyers and auditors, and public authorities where the law requires it.

Service providers process data on our instructions under a data processing agreement (Art. 28). We do not sell data.

We keep data in the European Union. Some providers (Google, Stripe, Resend, PostHog, Sentry) belong to groups based in the USA and may access data from outside the EU, e.g. for support or through their sub-processors. Such transfers rely on the adequacy decision (EU-US Data Privacy Framework) for certified recipients, or on the European Commission's standard contractual clauses (Art. 46(2)(c)) with supplementary safeguards. [for the lawyer: check the transfer basis and certification for each provider.]

We keep data only as long as the purpose we collected it for requires. The periods below are a proposal. [for the lawyer: confirm every period in this section; some are not carried out technically yet (e.g. deleting inactive accounts).]

• Account: until you delete it. An account nobody has signed in to for more than 3 years is deleted after a notice by e-mail.
• Orders, invoices and payment records: 11 years from the end of the year they were made in (accounting and tax rules). After an account is deleted, its orders are kept without your name and contact details.
• Participant details the organiser asks for: up to one year after the activity, unless they are part of the accounting records.
• Agreement to the organiser's messages: until withdrawn; messages after the activity are sent for at most 7 days anyway.
• Complaints and customer support: 3 years after the case is closed.
• Reviews: while they are published, or until you delete them.
• Newsletter and booking-open notices: until you unsubscribe, or until booking opens.
• Analytics: PostHog up to one year, session recordings up to 30 days; Google Analytics up to 14 months.
• Error reports (Sentry): up to 30 days.
• Security logs: up to 90 days, unless needed to investigate a specific incident.
• Your cookie choice: 12 months, on your device.

• access to your data and a copy of it (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure of your data (Art. 17);
• restriction of processing (Art. 18);
• portability of the data you gave us (Art. 20);
• objection to processing based on legitimate interest and to direct marketing (Art. 21);
• withdrawing consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

Send your request to [E-mail]. We answer within one month (in complex cases, with notice, at most two months more). We may ask you to confirm your identity. You can see and correct most of your data yourself in My account, and delete the account in the account settings.

If you believe that the processing of your data breaks the rules, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the supervisory authority of the EU member state where you live or work. We would be glad if you contacted us first, so that we can try to solve the problem.

We protect data with technical and organisational measures: encrypted connections (HTTPS), role-based access, database access rules and protection against abuse.

Only adults can open an account. Data about children taking part is entered by the parent or guardian who signs them up. [for the lawyer: the age of a child's consent to information society services in Croatia is 16 (Act on the Implementation of the GDPR, Art. 19); confirm that the 18-year limit for accounts fits.]

We may change this policy; the current version and its date are always on this page, and we tell you about significant changes by e-mail or on the site. Questions about personal data: [E-mail]. More about cookies in the Cookie policy, and about using the platform in the Terms of service.