Last updated: 26 June 2026

Data Controller

The Controller is Marenauta d.o.o., Ulica Osvobodilne fronte 1, 6000 Koper - Capodistria, Slovenia. Identification number: 8747563000. Tax number: 78709261. Email: privacy@marenauta.com.

This notice describes how Marenauta processes personal data of users who visit the site, request information, receive support, make or manage a booking and use services linked to Marenauta. Processing is carried out in compliance with Regulation (EU) 2016/679 ("GDPR") and applicable law.

Personal data processed

Marenauta may process data provided directly by the user, data collected during use of the service and data received from providers or partners when necessary for the stated purposes.

• identifying and contact data: name, surname, email, phone, address, city, postal code, province, state and country;
• data entered in forms, quote requests, communications with support, live chat, phone calls and messages;
• data relating to requests, bookings, purchased or requested services, travel preferences, documents and contractual information;
• payment, billing and transaction data to the extent necessary to manage purchases, bookings, refunds, disputes and antifraud;
• usage and technical data: IP address, user agent, browser, device, pages visited, times, logs, interactions and technical parameters;
• Cookies and other tracking tools described in the Cookie Policy;
• geographic location when the user enables location-based functions;
• aggregated or pseudonymized data used for measurement, security and service improvement.

When data are necessary, failure to provide them may prevent Marenauta from responding to the request, providing support, concluding or managing a booking, fulfilling legal obligations or making certain functions available. The user is responsible for personal data of third parties communicated to Marenauta and declares having an adequate basis to do so.

Purposes and legal bases

Data are processed to provide the site and service, manage requests, quotes, bookings, payments, support, operational communications and after-sales activities; fulfil contractual, pre-contractual, tax, accounting, administrative and regulatory obligations; protect Marenauta, users and third parties from fraud, abuse, unauthorized access, claims and disputes; monitor service quality, security and operation; measure traffic, conversions and usability in compliance with privacy choices; send informational, commercial or promotional communications when permitted by law or based on consent.

Applicable legal bases are: contract or pre-contractual measures, legal obligation, consent, legitimate interest, and where provided public interest or exercise of official authority. The user may request clarification on the legal basis applicable to a specific processing by writing to privacy@marenauta.com.

Methods, security and data access

Processing is carried out using IT, telematic and organizational tools consistent with the stated purposes. Marenauta adopts appropriate technical and organizational measures to reduce the risk of unauthorized access, loss, alteration, disclosure or misuse of data.

Authorized Marenauta personnel in administrative, commercial, customer support, marketing, IT, legal, accounting and system administration areas may access data. External providers, consultants, hosting providers, IT services, communication platforms, payment services, CRM, analytics tools and technical partners may also process data, appointed as processors when required by Art. 28 GDPR or operating as independent controllers when they determine their own purposes and means. An updated list of processors may be requested from the Controller.

Place of processing and international transfers

Data are processed at the Controller's operational sites, on the technical systems delivering the service and at the providers indicated in this notice. Some providers may process data in countries other than the user's or outside the European Economic Area, including the United States, United Kingdom or other countries where their respective infrastructures operate.

When an international transfer is necessary, Marenauta uses safeguards or bases permitted by Arts. 44 et seq. GDPR, such as adequacy decisions, EU-US Data Privacy Framework or applicable extensions, Standard Contractual Clauses, supplementary measures, transfers necessary for the contract or defence of rights, legal obligations or explicit consent when required.

Details on processing and providers

Contacting the user

• Marenauta contact form: responses to requests, quotes and support. Data: contact details, address, request content and data entered in the form.
• Marenauta mailing list or newsletter: informational, commercial or promotional communications. Data: email, preferences, subscription, unsubscription and interactions with messages.
• Marenauta phone contact: support, operational and commercial communications where permitted. Data: phone number, request or booking references and call content.

Contact management and message sending

• Twilio (Twilio, Inc.): phone and SMS communications. Data: phone, metadata and technical data. Location/area: United States and other countries. Privacy: twilio.com/legal/privacy.
• Skebby (Skebby - Mobile Solution S.r.l.): SMS sending. Data: phone and technical send/delivery data. Location: Italy/EU. Provider privacy policy.
• Brevo (Brevo SAS, formerly SendinBlue): email sending and measurement of delivery, opens, clicks and interactions where applicable. Data: email, usage data and applicable trackers. Location: France/EU. Privacy: brevo.com/legal/privacypolicy.

Post-service review requests

Marenauta may send, after a completed booking, invitation emails to leave a review via Trustpilot's Automatic Feedback Service (Trustpilot A/S, invite.trustpilot.com). Purpose: collect feedback on the booking and improve the service. Legal basis: Marenauta's legitimate interest under Art. 6(1)(f) GDPR and, where applicable, contract performance. Data processed: name, email, booking reference, language and technical sending metadata. This processing is not subject to Marketing cookie consent; the user may object by writing to privacy@marenauta.com.

Tag management, statistics, advertising and remarketing

• Google Tag Manager / server-side tagging (Google Ireland Limited): centralized management of tags and scripts via container loaded on load.sgtm.marenauta.com; tags respect Google Consent Mode and Marenauta consent panel choices. Data: usage data and technical data. Privacy: policies.google.com/privacy.
• Google Analytics 4 (Google LLC): statistics on users, sessions and interactions. Data: usage data, number of users, session statistics and trackers. Privacy: business.safety.google/privacy.
• Google Ads conversions and remarketing (Google LLC): conversion measurement and remarketing on the Google Ads/DoubleClick network. Data: Cookies, usage data and trackers. Privacy: policies.google.com/privacy. Opt-out: Google Ads settings.
• Remarketing with Google Analytics (Google LLC): link between Analytics and Google Ads for remarketing. Data: Cookies and usage data.
• Microsoft Advertising (Microsoft Corporation): Microsoft advertising and conversions. Data: Cookie e dati di utilizzo. Privacy: Microsoft Privacy Statement. Opt-out: Microsoft ad settings.
• Meta ads / Meta pixel and Facebook Remarketing (Meta Platforms, Inc.; Facebook, Inc.): conversions, advertising and remarketing on Facebook, Instagram and Audience Network. Data: usage data, Cookies and trackers. Privacy: facebook.com/about/privacy. Opt-out: Meta ad preferences.

Support, CRM, chat, reviews and external content

• Marenauta call monitoring: when the user contacts customer service, Marenauta may automatically associate the phone number with active requests or bookings to provide faster support. Operators may still ask the user to identify themselves to protect booking data confidentiality. Some calls may be monitored or recorded for quality control, training, complaint handling, fraud prevention, security and defence of rights. Not all calls are recorded; any recordings are kept for a limited period and deleted when no longer necessary, except for legal obligations, investigations, complaints, fraud or other legitimate reasons requiring longer retention.
• Streak / Rewardly, Inc.: CRM, management of requests, communications and support or sales activities. The relationship is governed by adequate contractual agreements and safeguards. Data processed: name, surname, email, phone, address, city, province or state, country, language, company name or billing data where applicable, usage data, communication content, information relating to requests, quotes, bookings and commercial relationship, as well as other information provided by the user or generated in contact management. Location/area: United States with possible extra-EU transfers subject to applicable safeguards. Privacy: streak.com/privacy.
• Crisp widget (Crisp IM SARL): live chat and support. Data: Cookies, usage data and chat content. Location: France/EU. Privacy: crisp.chat/en/privacy.
• TrustBox Trustpilot (Trustpilot A/S): embedded reviews widget; according to Trustpilot the TrustBox does not set Cookies on the host domain and may send technical events to api.trustpilot.com. Data: usage data on the integrated page. Privacy: Trustpilot end-user privacy terms.
• Google Maps and Google Places widget (Google Ireland Limited): location search, geocoding and map results display — essential service features. Data: Cookies, usage data and technical data. Privacy: policies.google.com/privacy.
• Marenauta geolocation: if authorized by the browser or device, provides location-based functions. Data: geographic location and related technical data.

Payments and online service sales

Data for booking, payment, invoicing, refunds, disputes and antifraud depends on the payment method. Full card data is processed by payment providers; Marenauta does not store full card number, CVV or equivalent credentials.

• Stripe (Stripe Payments Europe, Ltd.): payments, payment links, antifraud, transactions, refunds and disputes. Data: contacts, amount, currency, booking reference, email, metadata, technical data and payment data processed by Stripe. Location/area: Ireland/EU with possible extra-EU transfers. Privacy: stripe.com/privacy.
• Revolut (Revolut Bank UAB / Revolut Ltd): payments, links/orders, antifraud, refunds and reconciliation. Data: contacts, booking reference, amount, currency, technical data, transaction and payment. Location/area: Lithuania/EU, United Kingdom and other countries according to the service. Provider privacy policy.

Infrastructure, security and backup

• Hetzner (Hetzner Online GmbH): hosting/backend. Data: service data, technical content, logs and hosted data. Location: Germany/EU. Privacy: hetzner.com/legal/privacy-policy.
• Cloudflare (Cloudflare, Inc.): security, distribution and traffic optimization. Data: technical data, trackers and information necessary for security/performance. Location/area: United States and global network. Privacy: cloudflare.com/privacypolicy.
• Backup on Google Drive (Google Ireland Limited): backup of content and operational data. Data: various types depending on backup content. Privacy: policies.google.com/privacy.
• Smartlook (Smartsupp.com, s.r.o.): heat maps, interactions and session recordings. Data: Cookies, usage data and interactions. Location: Czech Republic/EU. Privacy: smartlook.com/privacy.

Retention

Data are retained for the time necessary for the purposes for which they were collected and, where applicable, for further periods imposed by law, by an authority order or necessary to protect the rights of Marenauta, users or third parties.

• Data processed to respond to requests, quotes, support, bookings, payments and contractual or pre-contractual activities are retained until the request or relationship is fully handled and for further periods necessary for claims, warranties, disputes, antifraud or defence of rights.
• Accounting, tax, administrative and payment data are retained for the periods provided by applicable law and for the time necessary to demonstrate compliance with related obligations.
• Data processed on the basis of consent are retained until consent is withdrawn, unless another legal basis exists to continue processing or retention is necessary for legal obligations or protection of rights.
• Data processed for direct marketing, newsletters or promotional communications are retained until withdrawal, objection, unsubscription or cessation of the purpose, while keeping minimal information necessary to demonstrate the user's choice.
• Technical logs, security data, phone recordings and antifraud data are retained for limited periods proportionate to the purpose, except where longer retention is necessary due to incidents, claims, fraud, investigations, legal obligations or defence of a right.
• Cookies and other tracking tools are stored according to the durations indicated in the Cookie Policy, in the configuration of the relevant tool or in third-party providers' notices.

User rights

Within the limits provided by the GDPR, the user may exercise the following rights in relation to data processed by Marenauta:

• access to personal data and essential information on processing;
• rectification or update of inaccurate or incomplete data;
• deletion of data when the legal conditions are met;
• restriction of processing in cases provided by the GDPR;
• portability of data provided by the user, where applicable;
• objection to processing based on legitimate interest or public interest, for reasons related to the user's particular situation;
• objection at any time, free of charge and without needing to provide reasons, to processing for direct marketing purposes; in that case data will no longer be processed for such purposes;
• withdrawal of previously given consent, without affecting the lawfulness of processing carried out before withdrawal;
• information on data recipients and safeguards applied to international transfers;
• complaint to the competent supervisory authority or recourse to the judicial authority.

Requests should be sent to privacy@marenauta.com. Marenauta responds without undue delay and in any case within one month, except extensions in complex cases provided by the GDPR.

When required by law, any rectifications, deletions or restrictions will also be communicated to recipients to whom data have been transmitted, unless this is impossible or requires disproportionate effort. The user may request information about such recipients.

Further information on processing

Defence of rights and requests from authorities

Marenauta may use and retain personal data to ascertain, exercise or defend a right in court or in preparatory stages, as well as to prevent, detect or counter abuse, fraud, unlawful use of the service or violations of the rights of Marenauta, users or third parties. The user is aware that Marenauta may be required to disclose personal data when required by law, a public authority or a legitimate order.

System logs and maintenance

For operation, security, maintenance, abuse prevention and technical diagnosis needs, Marenauta and the technical providers used may collect system logs, i.e. records of interactions with the service that may include IP address, device technical data, browser, times, pages requested, errors and other usage data.

Specific notices

When necessary, Marenauta may provide additional or contextual notices relating to specific functions, services, data collections or particular processing. The user may also request further information from the Controller using the contacts indicated in this Privacy Policy.

Minors

The service is not intended for children under 13. Users declare that they meet the age required by applicable law to use the service or, if minors, that they use it with the assistance and authorization of a parent or guardian. Under no circumstances may children under 13 use Marenauta.

Privacy Policy updates

Marenauta may update this Privacy Policy for technical, organizational, regulatory changes or changes relating to providers used. Changes will be published on this page and, when required by law or when consent-based processing changes, Marenauta may request the user's consent again.

Essential definitions

"Personal Data" means any information identifying or making identifiable a natural person. "Usage Data" means information collected automatically during use of the service. "User" means the person using Marenauta. "Controller" means Marenauta d.o.o. "Processor" means the entity processing data on behalf of the Controller. "Cookies" and "Tracking Tools" mean the technologies described in the Cookie Policy.