1. Who collects and processes your data?

This Policy provides all natural persons and interested parties with clear information regarding the purposes and methods of personal data processing carried out by ACI d.d., Rudolfa Strohala 2, 51000 Rijeka, Croatia, OIB: 17195049659 (hereinafter: ACI), as the owner of the shop.aci-marinas.com website.

ACI may collect personal data at every touchpoint or interaction with the user, as well as throughout all aspects of ACI’s business operations. “Personal data” shall mean any information collected and stored in a form that enables the identification of users as natural persons, either directly (e.g. by name) or indirectly (e.g. by telephone number).

You may withdraw your consent to the use of your personal data at any time by submitting a written request (Section 12 of this Policy).

2. Data Controller

ACI determines the purpose, scope, lawfulness and manner of processing personal data of clients and service users, using its organisational and technical resources. The data controller is ACI d.d., R. Strohala 2, 51000 Rijeka. Responsibility for implementing the data protection rules lies with ACI’s Data Protection Officer (hereinafter: the “Data Controller”).

• Contact: ACI d.d., Data Protection Officer
• Address: R. Strohala 2, 51000 Rijeka
• Telephone: +38551271288
• E-mail: dpo@aci-club.hr

3. Collection of personal data

The information we collect and store about you, which is protected under this Policy, may include the following:

• first name and surname;
• home address;
• email address;
• telephone number;
• search criteria;
• survey responses;
• the type of browser you use (Google Chrome, Edge, Firefox, Safari etc.);
• the time and duration of your access to the Website;
• cell IDs (these are unique identifiers of telecommunications towers used by your mobile device when you use location-based services on your mobile phone or tablet) and other location-related information (e.g. GPS data);
• photographs and other content you share with us when using our services;
• date of birth and any other personal data you may submit to us for the purpose of providing our services to you;
• the delivery of our services to you
• any other information you disclose to us that you wish to remain confidential.

ACI collects the following personal data:

• when you communicate with us through contact forms available on the Website (e.g. Contact, Berth booking and similar);
• when you communicate with us via email – in case you contact us using the available tools on our Website (for example, we will store the information you provide when corresponding with us), through social media, when you subscribe to our special offers or other updates, or when you complete surveys;
• when you book a berth through our Website
• automatically through the use of cookies and similar technologies (more information is available in our Cookie Statement).

In addition:

• we may combine information we already have with information about you or your interests, information relating to your socioeconomic and sociodemographic status, online identifiers, and current contact details obtained from third parties such as marketing agencies;
• we may record calls received from you or calls you receive from us;
• we may obtain information about you from companies within our group and from third parties with whom we maintain a business relationship.

By using our services, you consent to the use of your personal data in accordance with this Policy.

4. Purposes and methods of using personal data

ACI collects and processes the personal data of prospective and existing customers, as well as other service users, primarily in order to fulfil your requests (responding to enquiries, preparing offers, booking berths, arranging appointments), manage and improve our business operations and relationship with you, and conduct research activities.

All information ACI requests is used exclusively for the following purposes:

• Provision and management of services: Providing the services you have requested, managing bookings of berths, and providing administrative support.
• Provision of post-stay services: Subscription to the ACI newsletter, participation in the ACI prize draw systems, other marketing communications and marketing activities aimed at informing you about ACI services and products.
• Communication: Contacting you via post, email, telephone, mobile applications or other digital channels when it is necessary to provide information promptly or handle your enquiries.
• Enhancement of user experience and marketing: Managing the loyalty programme, improving your experience of staying at a marina and using your feedback to further develop ACI services.
• Promotional activities: Sending marketing communications and promotional materials (newsletters, prize draws, product notifications) in accordance with your preferences. Where required by law, we will obtain your prior explicit consent for such activities.
• Analytics and research: Conducting market research and internal statistical analysis in order to better understand customer needs and improve business strategies.

Combining and analysing data

We may combine your personal data with information collected from third parties (e.g. marketing agencies providing socioeconomic data or online identifiers) in order to better understand your interests. This enables us to develop and improve our processes, products and services provided to you. This may include, for example, implementing our business strategy, evaluating the effectiveness of our marketing and customer service activities, conducting market research, identifying products and services that may be of interest to you and contacting you regarding such products and services.

In partnership with third parties, and provided that you have consented to the use of cookies, we may also display personalised advertisements on social media platforms or while you browse the internet and visit other websites (more information is available in the Cookie Statement).

Legal and regulatory compliance

Personal data is processed in order to comply with our legal and regulatory obligations, respond to legal proceedings and requests for information issued by public authorities or third parties, prevent and detect fraud, and protect your rights as well as the rights of others.

Data retention period

We store your personal data in a form that permits identification only for as long as is reasonably necessary to fulfil the above purposes or while one of the following conditions applies:

1. The data is required for the provision of requested services and products.
2. The data is necessary to protect and defend our rights or property (within the legally prescribed limitation periods).
3. A legal obligation to retain the data exists (e.g. tax and accounting regulations).

ACI guarantees that the collected data will be used solely for the above-mentioned purposes, based on lawful grounds for processing in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette NN 42/2018), as well as applicable national legislation.

In addition to this Policy, certain ACI products and services (including some ACI applications and other ACI websites) may have their own privacy policies that describe in more detail how your personal data is collected, processed and stored in those specific contexts.

5. Protection of children’s personal data

ACI would appreciate it if your children do not provide any personal information without your permission. ACI advises parents and guardians to educate children about the safe and responsible handling of personal data on the internet.

As a general rule, ACI does not collect personal data relating to individuals under the age of 18, except in specific situations such as prize draws, and always subject to parental consent. Any online contact information collected from children without parental permission will be used solely for the direct response to the child’s request and will not be used for any other purpose.

ACI does not disclose any personal data to third parties without prior parental consent.

ACI does not allow children to, without parental consent, publicly post or otherwise distribute personal data or other materials that could enable them to be contacted, nor do we encourage children to disclose more information than is necessary to participate in a prize draw or other activity.

Where children under the age of 18 are permitted to participate in prize draws, ACI requires the child to first obtain permission from a parent or legal guardian and to provide the email address of the parent or guardian. If a child under the age of 18 wins a prize, the parents or guardians will be informed by email, telephone or in writing.

The personal data of both the child and the parent will be deleted from the ACI database upon request by the parent or guardian; you always have the right to request access to all personal data relating to your child that ACI may have collected through any of our websites, request deletion of such data (provided it is still retained in our database), and/or prohibit the future collection and use of data relating to your child. If you are a parent wishing to exercise these rights, you are required to contact us with such a request. In addition to the above, we guarantee the protection of children’s personal data in accordance with applicable special legislation governing this area.

6. Statement regarding credit card information

ACI undertakes all measures required by law to protect credit card information. ACI, as the owner of the Website, shall not be held liable for any interception of credit card details or for any other unlawful use of credit card information in connection with the direct use of this Website.

Credit card payments made during the booking process are processed through our partner Monri and its WSPay system, which ensures a secure and protected execution of online credit card transactions. This payment method is recommended by card issuers themselves (Visa, Mastercard, Diners etc.) because it has proven reliable in practice and, according to research, safer than conventional credit card payments in restaurants or shops.

However, no security system or method of transmitting data over the internet can be considered completely secure. For your own protection, we recommend that you do not include your credit card details in any emails sent to ACI.

7. Who has access to your personal data?

ACI does not sell or rent collected personal data, as such practices are contrary to this Policy.

ACI adheres to a strict “no spam” policy.

ACI shall not be held liable for accidental errors, errors arising from force majeure, or other objective circumstances resulting in the unintended violation of the guaranteed protection of your data; however, we guarantee such issues will be remedied as soon as possible, where feasible.

Some of our partners and service providers (e.g. providers of analytics services, cookie management tools and marketing platforms) may process your personal data outside the European Economic Area (EEA), including in the United States of America. In such cases, we ensure that any transfer takes place subject to appropriate safeguards in accordance with Chapter V of Regulation (EU) 2016/679 (GDPR), such as the Standard Contractual Clauses (SCCs) approved by the European Commission or the EU–US Data Privacy Framework.

Data transfers are carried out subject to the following safeguards:

• Google LLC (USA) – analytics services (Google Analytics, Google Ads) – Data Privacy Framework
• Meta Platforms Ireland Ltd / Meta Platforms Inc. (USA) – marketing services (Meta Pixel) – Data Privacy Framework
• CookieYes Ltd (Ireland/USA) – cookie management services – Standard Contractual Clauses (SCCs)
• Plus Hosting Grupa d.o.o. (Croatia) – Plus Hosting – web hosting services (within the EU)
• Monri Payments d.o.o. (EU) – online payment services (within the EU)
• Vixel d.o.o. (Croatia) – website management services (within the EU)

ACI may also disclose your personal data to:

• companies or other organisations hired by us to provide services on our behalf, such as web hosting companies, postal service providers, analytics service providers, event management services and information technology providers;
• companies or other organisations with which you have requested or agreed that we may share your personal data;
• professional advisers (such as lawyers and accountants);
• any law enforcement agency, court, public authority or third party where we believe such disclosure is necessary to comply with a legal or regulatory obligation, protect our rights, the rights of third parties or individual personal safety, or to detect, prevent or otherwise address fraud, security or safety issues; or
• any third party acquiring, or to whom we transfer, all or a substantial part of our assets and business operations. In the event of such sale or transfer, we will take all reasonable steps to ensure that the entity receiving your personal data uses it in accordance with this Policy.

8. Changes to your data

You may contact us at any time to review your personal data, as well as to update, correct or delete such data. Until such changes are made, we will continue to use your existing data for the stated purposes.

If you encounter any difficulties in exercising your rights, please contact ACI directly in writing via email at: dpo@aci-club.hr.

9. Legal bases we rely upon when using your personal data

There are several legal grounds upon which we rely in order to use your personal data. We will collect and use your personal data in the following circumstances, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject:

• where the use of your personal data is necessary for the performance of one or more contracts to which you are a party, or in order to take steps at your request prior to entering into a contract. For example, such contracts may include terms under which you purchase our products and services;
• where the use of your personal data falls within our legitimate interests or the legitimate interests of organisations with which we have shared your personal data and have taken measures to protect your personal data and your related rights;
• for the purpose of understanding and improving our (or their) products, services, and/or marketing strategies;
• for research purposes;
• for managing and improving our relationship with you and for administrative purposes;
• in order to determine which information, products and services may be of interest to you and to send or display information, offers and online advertisements relating to such products and services;
• for the purpose of personalising your experience of our products and services;
• to ensure that our products and services are provided and used in accordance with applicable laws and the relevant terms and conditions;
• where necessary to protect or defend our rights, or to detect, prevent or address security and privacy issues;
• where we consider the use of your personal data necessary in order to comply with legal or regulatory obligations to which we are subject; and
• where you have provided your consent.

We rely on your consent, for example, when collecting technical information such as cookie data and similar technologies, as described in our Cookie Statement, and when using your personal data for direct marketing communications to you via email, post, telephone or text messages.

You retain the right to withdraw your consent at any time. For further details, please refer to Section 12 of this Policy.

10. Retention of personal data

We will not process your personal data for longer than is necessary and intended for the specific purpose of processing and as prescribed by the applicable legislation of the Republic of Croatia and the Terms of Use. Transaction-related data is retained for a period of 11 years in accordance with the Accounting Act, after which such data will no longer be processed, while data processed for marketing purposes will be retained until consent is withdrawn or the purpose of processing ceases to exist.

The protection of the privacy of your personal data is ensured on a permanent basis.

11. Your consent

By completing forms on this Website, you guarantee that the information you have provided is accurate, that you possess legal capacity, that you are authorised to enter into this arrangement, and that you fully consent that ACI may use and collect your data in accordance with the law and the terms of this Policy. Your consent to the use of personal data must be given freely, without pressure, and in a specific and unambiguous manner.

The user of the Website agrees:

• that the use of this Website is entirely at their own risk;
• that neither ACI nor any affiliated third party can in any way guarantee that the use of this Website will be uninterrupted or error-free;
• that ACI or any other natural or legal person involved in the creation, production or distribution of this Website shall not be liable for any damage arising from the use of, or inability to use, this Website;
• that any copying, transmission, distribution, linking, publication or modification of these web pages in any manner whatsoever is prohibited, and that any breach of this prohibition may result in infringement of copyright, trademark rights or other rights, which may lead to legal proceedings and criminal prosecution.

Acceptance of this Policy does not automatically constitute your consent to receive marketing communications; a separate and explicit consent will be requested for such processing activities. Only after you have provided your data together with clear consent permitting ACI to contact you will you become part of the ACI mailing list, which forms an integral part of our database.

12. Your rights

List of Rights You May Exercise:

Right of access (Article 15 of the General Data Protection Regulation)

You have the right to obtain confirmation as to whether personal data concerning you is being processed and, where that is the case, access to the personal data and the following information: the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data has been or will be disclosed, the envisaged period for which the personal data will be stored, and the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing personal data.

Right to rectification (Article 16 of the General Data Protection Regulation)

If we process incomplete or inaccurate personal data relating to you, you may request correction or completion of such data at any time.

Right to erasure (Article 17 of the General Data Protection Regulation)

You may request the deletion of your personal data where the purpose for which it was collected no longer exists, where the processing is unlawful, where the processing disproportionately interferes with your protected legitimate interests, or where the processing is based on your consent which has subsequently been withdrawn. However, you should be aware that there may be other grounds preventing the complete erasure of your data, such as legal retention obligations, ongoing proceedings or the establishment, exercise or defence of legal claims, etc.

Right to restriction of processing (Article 18 of the General Data Protection Regulation)

You have the right to request restriction of the processing of your data if you contest the accuracy of your data, for a period enabling us to verify its accuracy; if the processing of your data is unlawful and you oppose the erasure of the data and request restriction of its use instead; if we no longer require the data for the intended purposes but you still require it for the establishment, exercise or defence of legal claims; or if you have objected to the processing.

Right to data portability (Article 20 of the General Data Protection Regulation)

Data which you have provided to us and which we process on the basis of your consent or for the performance of a contract, and which is processed by automated means, will, upon your request, be provided to you in a structured, commonly used and machine-readable format. Where technically feasible, we may also transfer such data directly to another controller, depending on your request.

Right to object (Article 21 of the General Data Protection Regulation)

If you believe that your rights have been violated and that your personal data is being used improperly, you may submit a written objection. In such a case, we will no longer process the personal data unless it is demonstrated that there are legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or where processing is required for the establishment, exercise or defence of legal claims.

Furthermore, where personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing purposes, including profiling to the extent that it is related to such direct marketing. Specifically, the right to object may not apply where the processing of personal data is necessary for taking steps prior to entering into a contract or for the performance of an already concluded contract.

Right to be exempt from legal decisions based on automated decision-making and profiling

ACI does not use automated decision-making within the meaning of Article 22 of GDPR. Automated processing for decision-making purposes will only be used where necessary in the following circumstances:

• where a decision based on an algorithm is necessary (i.e. there is no alternative means of achieving the same purpose) for entering into or performing a contract with the individual whose data is processed by the algorithm;
• where the individual has given explicit consent to a decision based on an algorithm.

If you have any questions or concerns regarding how we use your personal data, or if you wish to access the information ACI has about you, exercise your right to object, or exercise any other rights relating to your personal data, please contact us so that we may clarify any issues.

Your enquiries, requests and objections which you are entitled to submit pursuant to Regulation (EU) 2016/679 (GDPR) may be addressed to the Data Controller (Section 2). If you are not satisfied with our response or believe that your rights have been infringed, you may also contact the Croatian Personal Data Protection Agency (AZOP) in writing at AZOP, Martićeva 14, 10000 Zagreb, Croatia, or via email at: azop@azop.hr.

The Croatian Personal Data Protection Agency is the competent authority responsible for overseeing and enforcing rights and obligations relating to personal data protection in the Republic of Croatia.

Right to withdraw consent (Newsletter)

You may withdraw your consent to receive marketing communications at any time.

Upon withdrawal of consent, the processing of your data for direct marketing purposes will cease. Your data will be deleted from the newsletter distribution database, except for data which we are legally required to retain under other legal bases (e.g. records of issued invoices in accordance with tax regulations). In such cases, ACI may only use the data for legally prescribed obligations or internal statistical analysis subject to appropriate protective measures. ACI guarantees that your data will be stored and used in good faith and exclusively in accordance with your decisions.

If you no longer wish to receive our marketing communications via Newsletter, please unsubscribe using the unsubscribe link located in the footer of the Newsletter or by submitting a written request to the email address dpo@aci-club.hr.

13. Governing law

You agree that your use of this Website, this Privacy Policy, the General Terms of Use and any disputes relating to these documents shall in all respects be governed by the laws of the Republic of Croatia. Any disputes arising in connection with the foregoing shall be subject exclusively to the jurisdiction of the Commercial Court in Rijeka, Croatia.

14. Other websites and social media

Our Website may contain links to other websites that are not under our control and are not covered by this Policy. If you access other websites through the available links, the operators of those websites may collect your information and use it in accordance with their own privacy policies, which may differ from this Policy.

Our Website may also contain embedded content (e.g. videos, images, articles etc.). Embedded content from other websites behaves in the same way as if the visitor had visited the other website directly.

These websites may collect data about you, use cookies, embed additional third-party tracking technologies and monitor your interaction with such embedded content, including tracking your interaction with embedded content if you have an account and are logged into that website.

If you choose to participate in social media activities sponsored by ACI, ACI may collect certain information from your social media account in accordance with your social media service settings.

Our Website may also provide you with the ability to share or follow information regarding available products and/or services on the Website through third-party social media tools (such as on-screen “share”, “like”, or “follow” buttons). We offer this functionality in order to generate interest in our Website among members of your social networks and to allow you to share and follow opinions, news and recommendations regarding the Website with your contacts.

However, you should be aware that sharing personal data through social media may result in the collection of such data by the social media provider and may make the data publicly available, including through internet search engines. You should always carefully review the privacy policies of any website you access or any social media platform through which you share information in order to understand their privacy practices.

15. Cookie Statement

The Cookie Statement forms an integral part of this Privacy Policy and is presented as a separate document for reasons of clarity and ease of understanding.
You may read our Cookie Statement HERE.

16. Updates to the Privacy Policy

Any amendments to this Privacy Policy shall enter into force upon publication on this Website.

For processing activities based on consent, in the event of significant changes, we will request your renewed consent, provided that such changes comply with the applicable laws of the European Union and the Republic of Croatia and do not restrict your rights.

If, during the development of the Website and the implementation of new legal requirements, new technologies or improvements to our services, changes occur in the manner in which we use your personal data, we will clearly and visibly publish such changes on the Website. For this reason, we recommend that you periodically review this Privacy Policy.

If you do not agree with the implemented changes, please do not use the Website.

For any questions and/or comments regarding this Privacy Policy and the Cookie Statement, please contact us using the following contact details:

ACI d.d., Data Protection Officer
Address: Rudolfa Strohala 2, 51000 Rijeka, Croatia
Telephone: +385 (0)51 271 288
Email: dpo@aci-club.hr

Privacy Policy last updated: 16 June 2026