Privacy and cookie policy
The portal can be used without an account and without leaving personal data. Here is what is recorded nonetheless, why, for how long, and what your rights are.
Who is responsible for your data
Browsing the portal
No account is needed to view routes. Like any server, ours technically sees your IP address and browser type with each request. We do not write them to a visit log; the IP address is used only briefly, in memory, to protect against overload and abuse. Legal basis: legitimate interest — secure operation of the portal (Art. 6(1)(f) GDPR).
Visit statistics, with nothing taken from your browser
We count visits on our own server, from the page requests your browser sends anyway: how often each page was opened, in which language, how often a GPX was downloaded and a partner clicked, and which site visitors came from — only as a domain name (e.g. google.com). These are aggregate counts only — per day, and per minute for monitoring the portal's load (kept for three days): no IP address, no visitor identifier and no script in the browser, so we cannot recognise or follow any individual visitor. The same applies to routes embedded on partner destination websites: we count how often they are shown and how many visitors came from them to the portal, as daily totals. The embed sets no cookies. Legal basis: legitimate interest — knowing which content is useful and showing destinations how often their routes are viewed.
Cookies and local storage
We store on your device only what is necessary for the portal to work or what you chose yourself, e.g. the base map (the list is at the bottom of this page). We currently use no cookies for analytics or advertising, so there is no cookie banner either. If we introduce them (Google, Meta), we will use them only with your explicit consent in the banner — without consent their scripts are not loaded at all — and you will be able to change your choice at any time via “Cookie settings” in the footer.
Location
When you turn on your position on the map, “Follow route” or “Near me”, location is used only in your browser and is not sent to us. It is sent to our server only in these cases, and only when you click: • “Cycle to the route” from your location — our routing server (also ours, in the EU) uses the coordinates to calculate the way to the route. The coordinates are not stored or logged. • Emergency 112 message — we use the coordinates to find the nearest settlement and add it to the message, because dispatchers work with settlement names. The coordinates are not stored. You then send the message yourself, with an app of your choice. • “Report a problem” — the location and the kilometre on the route are sent with the report (see “Forms and newsletter”). You may refuse location access — everything else keeps working.
Maps, videos and navigation
Maps, terrain and map labels are served from our own server; the data comes from OpenStreetMap and the sources listed on “Map data sources”, but your browser does not connect to them. YouTube and Vimeo videos load only when you click them — your browser then connects to Google or Vimeo, whose privacy policies apply. On a destination page with its own route planner (e.g. Polje Jezero), the planner map is loaded from that app (polje-jezero.eu, also our app), so your browser also connects to its server when you open that page. Navigation buttons open Google Maps only when you click.
Forms and newsletter
When you report a problem or send a partnership enquiry, we store what you entered (email, name, organisation, message) and the time; the editorial team is notified by email. Enquiries are used only to reply. A problem report from navigation (“Report a problem” in “Follow route”) can only be sent on or next to the route and also includes your location and the kilometre on the route at the moment of sending, plus the photos and short video you record in the browser (without location or device data). Location and recordings are sent only when you tap “Send report”. With the report you allow us to use and publish the photos, video and description on the route page as a notice about the route condition; we store the time of this permission and the version of its text. Your name and email are not published. A published notice has an expiry date and disappears when it expires or the problem is resolved. The newsletter is sent only with your consent, via the Brevo service. After signing up you receive an email with a link; you become a subscriber only once you click it. Brevo stores your email address, language, the time of sign-up and confirmation and the consent text you saw, and for emails sent it records whether they were opened and which links were clicked. You can unsubscribe at any time with one click on the link in every email. Legal basis: consent for the newsletter (Art. 6(1)(a)); for enquiries your request and our legitimate interest in replying (Art. 6(1)(b) and (f)).
Technical logs
For editors with an account we log sign-ins (with IP address), content changes and administration errors for security. Errors that happen in visitors’ browsers are sent only if you have accepted analytics — with a shortened IP address (last number removed), the page address and browser type, so we can fix them. Legal basis: legitimate interest (editors) or consent (visitors).
Who receives data
We do not sell data or pass it to others for their own purposes. We use processors under contract: Hetzner Online GmbH (server and backups, Germany), Resend (email delivery, including sign-in links for network members, EU servers), Brevo (Sendinblue SAS, France; newsletter, EU servers) and Google Ireland Ltd. (business email). When a network member looks up the address of their business, the typed address (without any personal data) is sent to the Nominatim service of the OpenStreetMap Foundation (United Kingdom). If we introduce Google or Meta cookies, they will also receive visit data, but only with your consent.
Transfers outside the EU
We keep data in the EU. For the United Kingdom (Nominatim) there is a European Commission adequacy decision. Google, Meta and Resend are linked to companies in the USA; any transfer there is based on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
How long we keep data
Error log: 30 days. Editor sign-in log: 90 days. Enquiries and problem reports: as long as needed to reply, at most two years. Newsletter: until you unsubscribe; after that only the address remains on the unsubscribe list, so that we do not write to you again. Partner accounts, network members and photographer details: for as long as the cooperation lasts; once we remove a person, their data is permanently deleted after 30 days, or immediately at your request. Record of your cookie choice (no personal data): 13 months. Aggregate visit counts contain no data about visitors and are kept for year-on-year comparison.
Your rights
You have the right to access your data, rectification, erasure, restriction of processing and portability, and the right to object to processing based on legitimate interest. You can withdraw consent (newsletter, and cookies once we introduce them) at any time — by unsubscribing or via “Cookie settings” — without affecting the lawfulness of processing before withdrawal. Send requests to info@activecroatia.hr; we reply within one month at the latest.
Complaint to the supervisory authority
If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the authority in your country.
Partners, network members and photographers
Partner accounts. People from tourist boards and other partners who work in the partner portal have an account: first name, last name, email, position, phone and organisation (name, tax number, address, website). We use this data for access, arrangements and notices about the portal. Network members (hotels, campsites, agencies…). For access to the member workspace we store the email of the person invited by the partner or the editors, a note, and when the invitation was sent and when the person signed in. Sign-in works without a password, with a link sent by email; after signing in, the browser receives the ac_clan cookie for 30 days. The location and address of the business are entered by the member. Photographers. Next to a photo we publish the photographer’s name (“Photo: …”), as copyright requires. Only the editors see the photographer’s email and notes; photographers may ask for a correction or a different credit. Legal basis: the contract with the partner or network member and our legitimate interest in running the portal and crediting photographers correctly (Art. 6(1)(b) and (f) GDPR).
Changes
We update this policy when the way the portal works changes. Last updated: 24 October 2026