Who handles your data
The controller is TRAVEL MANAGEMENT COMPANY d.o.o., Gospodarska zona Vukovar 15, Vukovar, Croatia, OIB 44463824608, MBS 030157861 (Commercial Court in Osijek), which runs ZagrebSpace at Gacka 16, Zagreb. For any question about your data, write to info@gacka16.com.
You can reach our data protection officer at dpo@ulixtravel.com or by phone on +385 99 6077 707.
Details from your enquiry
The form asks for your name, email and what you are interested in. Phone and message are optional. A hall enquiry also asks for the number of people; the date is optional. If you accepted advertising cookies, the enquiry also carries which ad brought you to the site. We use these details only to answer your enquiry and prepare the offer you ask for. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) of the General Data Protection Regulation). That is why the form does not ask for separate consent.
We never sell your details or pass them to others for their marketing.
How long we keep your data
- An enquiry that does not lead to a contract is deleted 12 months after we receive it.
- If we sign a contract, we keep the details for the length of the contract and as long as accounting and tax rules require.
- A consumer's written complaint is kept for one year from the day we receive it, as the Croatian Consumer Protection Act requires (Article 10(7)).
- How long each cookie lasts is in the cookie list below.
Cookies and measurement
Necessary cookies always run, because the site does not work without them. Everything else starts only after you click "Accept" in the cookie settings:
- Google Analytics and Google Ads – count visits and which ad led to an enquiry
- Meta Pixel (Facebook and Instagram) – measures which Facebook or Instagram ad led to an enquiry
- PostHog (EU servers) – shows how the site is used, so we can improve it
- Triple Whale – brings ad results together in one place
- our own visit measurement tool, which runs on Netlify's servers – counts visits and shows how the site is used
These tools may use cookies and similar technologies and process your IP address and browser and device details. Google and Meta may link that data to their own user accounts under their own privacy policies. You can withdraw consent at any time through the "Cookie settings" link. Withdrawing it does not delete an enquiry you already sent. You can also turn off interest-based ads at youronlinechoices.eu and in the ad settings of your Google, Facebook or Instagram account.
If you accept measurement and send an enquiry, we turn your email address into a SHA-256 hash in your browser. Google Ads receives the hash and the fact that an enquiry was sent so it can match the enquiry to an interaction with our ad. If you decline measurement or withdraw consent before sending, we do not send the hash to Google.
Cookie list
Besides cookies, we use the browser's local storage (localStorage and sessionStorage), which works in a similar way. Each item shows who sets it, how long it lasts and what it is for. The list covers all our websites, so not every item is set on every site. Where it says "the provider publishes no lifetime", the company that sets the item has not said how long it lasts.
Necessary (no consent needed)
- gacka16_consent (local storage) – us – no expiry, until you clear it or change your answer – remembers your cookie answer and when you gave it
- gacka16_test_submission (local storage) – us – no expiry – marks test enquiries from our staff, who set it by hand (never set for visitors)
- zs_prices (cookie) – us – 8 hours – staff sign-in to the price page, set only after the staff password
Advertising (only with consent)
- gacka16_attribution_v2 (local storage) – us – no expiry, but we stop using it after 90 days – details of the ad click and the page you landed on, for your enquiry
- gacka16_attribution_key (local storage) – us – no expiry – links a visit from a paid ad to a later enquiry
- gacka16_first_seen_at (local storage) – us – no expiry – time of the first visit from a paid ad
- _gcl_au, and when present _gcl_aw, _gcl_dc, _gcl_gb, _gcl_gs, _gcl_ag (cookies) – Google – 90 days – measures enquiries from Google Ads
- _gcl_ls (local storage) – Google – the provider publishes no lifetime – remembers a Google Ads click
- _fbp (cookie) – Meta – the provider publishes no lifetime (we observed 90 days) – Meta's browser ID
- _fbc (cookie) – Meta – 90 days – ID of a click on a Meta ad, only if you came through one
- multiFbc (local storage) – Meta – the provider publishes no lifetime – IDs of clicks on Meta ads
- lastExternalReferrer, lastExternalReferrerTime (local storage) – Meta – the provider publishes no lifetime – the last outside site you came from, and when
- TriplePixel, TriplePixelU, di_pmt_wt (local storage) – Triple Whale – the provider publishes no lifetime – visit count, pages viewed and profile ID
If you decline, we delete gacka16_attribution_v2, gacka16_attribution_key and gacka16_first_seen_at. If you decline after accepting earlier, we also delete cookies whose names start with _ga or _gcl, and the _fbp and _fbc cookies.
Analytics (only with consent)
- _ga (cookie) – Google – 2 years – tells visitors apart
- _ga_DVJK8FYQ41 or _ga_E01YH526CX (cookie) – Google – 2 years – keeps the state of your visit
- ph_phc_…_posthog (cookie and local storage) – PostHog – cookie 365 days, and the provider publishes no lifetime for local storage – PostHog's visitor ID and settings
- ph_phc_…_session_registered_properties, …_primary_window_exists, …_window_id, …_posthog (sessionStorage) – PostHog – the provider publishes no lifetime, and the browser deletes them when you close the tab – state of your visit
- purr_vid (cookie and local storage) – us – cookie 2 years, deleted if you withdraw consent – visitor ID for our own measurement tool
- purr_consent (local storage) – us – no expiry – where our measurement tool keeps your analytics answer
- bx_consent_mode (cookie) – our sites never set it, and our measurement tool only reads it if it is already there
Cookies in your browser
You can also block or delete cookies yourself in your browser settings. Your browser's help explains how, usually under "Privacy" or "Cookies". If you block all cookies and local storage, the site may not remember your cookie answer and will ask again.
Who else sees your data
Cloudflare serves the website. Enquiries pass through Cloudflare and reach our enquiry system, which runs on Netlify's servers, and our email.
The enquiry system stores enquiries in a database run by Supabase. That database sits on servers in the United States (East US, North Virginia), so outside the European Union. It holds the details from your enquiry (name, email, phone, message) and, with your consent, the ad details. Data from our own visit measurement tool and details of visits from paid ads go to the same database, but only if you accepted cookies.
The tools in the cookie section receive data only with your consent. Cloudflare and Netlify are also outside the European Union. Transfers to them rely on an adequacy decision or the European Commission's standard contractual clauses.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing and data portability, and you can object to processing. Write to info@gacka16.com or to our data protection officer at dpo@ulixtravel.com with enough detail for us to find your enquiry. If you think the processing breaks the rules, you can complain to the Croatian Personal Data Protection Agency (AZOP), azop.hr.
The rules for using this website are in the Terms of use.
Changes to this notice
We change this notice when we change our tools or when the law requires it. This page always shows the latest version. This version applies from 9 October 2026.