Agency Portal Privacy & Cookies

1. Who is responsible for the data?

The data controller is Ragusina Ltd. Travel Agency, operating Dubrovnik Food Tours, Dubrovnik, Croatia. OIB / VAT ID: HR33419938593. For privacy questions or requests, contact info@dubrovnikfoodtours.com.

2. What information do we collect?

For a partner application we may collect the agency name, country, contact person, business email, phone number, website, VAT / Tax ID and any message or notes you choose to provide.

For Agency Portal bookings we collect the booking agent's name and email address, tour and booking details, guest counts, food preferences, operational notes, booking status, payment / invoicing status, booking-specific messages exchanged through the portal, and any optional booking voucher uploaded by the partner.

3. Guest names are not required

The standard Agency Portal booking form does not ask for guest names, passports, identity documents or payment card details. Please do not add unnecessary personal information to booking notes or vouchers.

If you choose to include a guest name or other personal information in a note or booking voucher, that information will be processed as part of the relevant reservation.

4. Food preferences and special requirements

Food preferences or allergy information may contain sensitive information. Please enter only information that is necessary to deliver the requested service and only where you are authorized to share it with us on the guest's behalf.

Such information is used only for booking operations and, where necessary, may be shared with the relevant guide, venue or service provider so the requested arrangement can be delivered.

5. Why do we use the information?

We use partner and booking information to review partnership applications, provide and secure portal access, process and manage reservations, communicate booking status, exchange booking-specific operational messages, arrange tours, manage invoicing and payments, prevent misuse and maintain necessary business records.

Depending on the context, processing is based on steps taken at your request and performance of the partner relationship, our legitimate interests in operating and securing the booking service, and legal obligations that apply to our business records.

6. Who may receive the information?

Access is limited to people and service providers who need the information for the relevant purpose. This may include authorized Dubrovnik Food Tours staff, assigned guides and venues where necessary for service delivery, and providers used for hosting/security and transactional email.

We do not sell Agency Portal personal data and do not use it for third-party advertising profiles.

7. Booking vouchers

Voucher upload is optional. Vouchers are stored privately and are intended only for booking documents relevant to the reservation. Do not upload passports, identity documents, payment card details or unrelated personal documents.

The portal is configured to retain an uploaded agency voucher until approximately 90 days after the tour date, after which it is eligible for secure deletion.

8. How long do we keep other information?

Partner application, agency, booking and booking-message records are kept only for as long as reasonably necessary for the partnership, reservation administration, accounting, legal obligations, security, dispute resolution and legitimate business record-keeping. Retention may therefore differ depending on the type of record and applicable legal requirements.

9. Cookies used by the Agency Portal

The Agency Portal application does not use advertising or analytics cookies. It uses strictly necessary security cookies to protect forms and booking actions against cross-site request forgery (CSRF).

dft_agency_apply_csrf is used on the partner application and dft_agency_portal_csrf is used inside the secure Agency Portal. They contain random security tokens, are marked Secure and HttpOnly with SameSite=Strict, and are configured to expire after approximately one hour.

dft_agency_session is a strictly necessary Agency Portal activity-session cookie. It contains only a random opaque session token, is marked Secure and HttpOnly with SameSite=Strict, and is renewed while the portal is actively being used. An active session is configured for up to approximately eight hours after the most recent activity.

The portal records the session creation time, last activity time, expiry and revocation status so authorized Dubrovnik Food Tours administrators can see whether an agency portal is currently active, review the most recent portal activity and sign out active sessions for security. The raw session token is not stored in the database; only its cryptographic hash is stored. Old expired or revoked session records are eligible for cleanup after approximately 30 days.

These security cookies do not contain agent names, email addresses, booking details or advertising identifiers. Because the Agency Portal application does not set optional analytics or advertising cookies, it does not present an optional cookie-consent banner.

10. Security

Agency Portal access uses a confidential secure link. Portal forms use security controls including CSRF protection and a strictly necessary activity session. Please keep your portal link within your authorized team, use Log out on shared devices, and contact us promptly if you believe it has been disclosed outside your organization.

11. Your privacy rights

Where applicable under data-protection law, you may request access to personal data concerning you, correction, deletion, restriction of processing, portability, or object to certain processing. To make a request, contact info@dubrovnikfoodtours.com.

You also have the right to lodge a complaint with the competent supervisory authority. In Croatia this is the Croatian Personal Data Protection Agency (AZOP).

12. Changes to this notice

If we materially change how the Agency Portal handles personal data or introduce optional analytics, advertising or similar technologies, this notice and any required consent mechanism will be updated accordingly.