Skip links
Candy Brick

PRIVACY POLICY CANDY SHELLS d.o.o.

PRIVACY POLICY
CANDY SHELLS d.o.o.
Last Updated: January 26, 2026

  1. INTRODUCTION

Candy Shells d.o.o. (“Company,” “we,” “us,” or “our”) is committed to protecting the privacy and personal data of our customers, visitors, and business partners. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you visit our websites, use our services, or interact with our company.

Please read this Privacy Policy carefully. By accessing or using our services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.

  1. COMPANY INFORMATION

Company Name: CANDY SHELLS d.o.o.
Brand: CANDY BRICK
Address: Mletačka ulica – Via Venezia 12, 52100, Pula, Hrvatska
OIB: 68633451791
Email: INFO AT CANDYBRICK DOT COM
Phone: +385 99 284 2857

  1. DATA CONTROLLER

Candy Shells d.o.o. is the Data Controller for the personal information collected and processed under this Privacy Policy. We are responsible for ensuring compliance with GDPR and Croatian data protection legislation.

  1. TYPES OF INFORMATION WE COLLECT

Personal Information You Provide:

  • Full name and contact details (email, phone number)
  • Postal address and property location information
  • Financial information (bank account details, payment information)
  • Investment preferences and property interests
  • Communication records and inquiries
  • Identification documents (as required for legal transactions)

Information We Collect Automatically:

  • Website usage data (IP address, browser type, pages visited)
  • Cookies and tracking technologies
  • Device information
  • Date and time of visits

Information from Third Parties:

  • Real estate databases and property listings
  • Payment processors and financial institutions
  • Guest reviews and feedback platforms
  • Credit and background check services (where applicable)
  1. PURPOSE OF DATA COLLECTION

We collect and process your personal data for the following purposes:

  • Property Sales & Transactions: Facilitating villa purchases, ownership transfers, and related legal documentation
  • Investor Communication: Providing property information, investment analysis, and financial projections
  • Property Management: Managing vacation rental bookings, guest communications, and property maintenance
  • Marketing & Advertising: Sending property updates, promotional materials, and investment opportunities
  • Legal Compliance: Meeting tax, regulatory, and legal obligations in Croatia and EU
  • Customer Service: Responding to inquiries, resolving disputes, and providing support
  • Financial Management: Processing payments, managing contracts, and loan documentation
  • Website Operations: Improving user experience and website functionality
  • Security: Protecting against fraud and unauthorized access
  1. LEGAL BASIS FOR DATA PROCESSING

Our processing of your personal data is based on:

  • Contractual Necessity: Data required to execute property sales, rental agreements, or management contracts
  • Legal Obligation: Compliance with Croatian law, tax requirements, and EU regulations
  • Legitimate Interest: Marketing, customer service improvements, and business operations
  • Consent: When you explicitly opt-in to newsletters, marketing communications, or cookie usage
  • Performance of Public Task: Compliance with governmental and regulatory requirements
  1. DATA SHARING & RECIPIENTS

Your personal data may be shared with:

  • Legal & Professional Advisors: Lawyers, accountants, and notaries for contract execution and tax compliance
  • Financial Institutions: Banks and payment processors for transaction processing
  • Property Management Partners: Housekeeping, maintenance, and utility service providers
  • Government Authorities: Tax agencies, regulatory bodies, and law enforcement (when legally required)
  • Marketing Partners: Analytics providers and advertising platforms (anonymized data only)
  • Other Users/Guests: Limited information shared on booking platforms and property listings
  • Company Subsidiaries: Seaways Villas d.o.o., Ora Maritima d.o.o., and other affiliated companies

We do NOT sell your personal data to third parties for marketing purposes.

  1. DATA RETENTION

Personal data is retained for the following periods:

  • Customer/Investor Data: Duration of business relationship + 7 years (legal/tax requirements)
  • Transaction Records: 10 years (Croatian accounting and tax law requirements)
  • Guest Information: Duration of booking + 1 year for dispute resolution
  • Marketing Data: Until consent is withdrawn or relationship ends
  • Website Analytics: 26 months (Google Analytics default)
  • Cookies: As specified in cookie policy (typically 1-2 years)

Data is securely deleted when no longer required for legal or business purposes.

  1. YOUR RIGHTS

As a data subject, you have the following rights under GDPR:

Right to Access: Request a copy of your personal data we hold
Right to Rectification: Correct inaccurate or incomplete information
Right to Erasure: Request deletion of your data (subject to legal obligations)
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a structured format
Right to Object: Opt-out of marketing communications and certain processing
Right to Withdraw Consent: Revoke previously given consent at any time
Right to Lodge a Complaint: File a complaint with the Croatian Data Protection Authority

To exercise these rights, contact us at INFO AT CANDYBRICK DOT COM with “Data Subject Rights Request” in the subject line.

  1. SECURITY MEASURES

We implement comprehensive security measures:

  • Encrypted storage of sensitive personal and financial information
  • Secure HTTPS website connections
  • Restricted access to customer data (authorized personnel only)
  • Regular security audits and vulnerability assessments
  • Confidentiality agreements with all staff and contractors
  • Secure document handling and disposal procedures
  • Password-protected digital systems and databases
  • PCI DSS compliance for payment card information
  • Incident response procedures for data breaches
  1. COOKIES & TRACKING TECHNOLOGIES

Our website uses cookies for:

  • Essential Cookies: Website functionality and security
  • Analytics Cookies: Understanding user behavior (Google Analytics)
  • Marketing Cookies: Personalized advertising and campaign tracking, including the Meta Pixel (Meta Platforms Ireland Ltd.), which measures visits and the effectiveness of our ads on Facebook and Instagram
  • Preference Cookies: Remembering user settings and language preferences

Users can control cookie settings through browser preferences. Disabling cookies may limit website functionality.

On our landing pages the Meta Pixel is activated only after you accept it in the consent banner; you can change your choice at any time through the “Cookie preferences” link at the bottom of the page.

  1. MARKETING COMMUNICATIONS

Email Marketing:

  • We send property updates, investment information, and promotional content only with consent
  • Subscribers can unsubscribe at any time via email or website
  • Frequency: Monthly to quarterly (based on subscription preferences)

SMS & Phone Communications:

  • Only sent with explicit prior consent
  • Used for time-sensitive property and guest updates

Social Media & Advertising:

  • We may use anonymized data for targeted advertising on social platforms
  • No personal information is shared with social media platforms for marketing
  1. THIRD-COUNTRY DATA TRANSFERS

Personal data may be transferred to countries outside the EU/EEA only with:

  • Adequate protection mechanisms (EU adequacy decisions)
  • Standard contractual clauses approved by the European Commission
  • Explicit consent when required

All transfers comply with GDPR Chapter 5 requirements.

  1. CHILDREN’S PRIVACY

Our services are not directed to people under 18 years old. We do not knowingly collect personal data from this group. If we become aware of such collection, we will delete the data immediately. Parents/guardians concerned about data collection should contact us.

  1. POLICY UPDATES

We reserve the right to update this Privacy Policy at any time. Changes will be posted on our website with an updated “Last Updated” date. Continued use of our services constitutes acceptance of modified terms.

Significant changes will be communicated via email to registered users.

  1. CONTACT INFORMATION

For Privacy Inquiries:
Email: INFO AT CANDYBRICK DOT COM
Phone: +385 99 284 2857
Address: Mletačka ulica – Via Venezija 12, 52100, Pula, Hrvatska

Data Protection Authority:
Croatian Personal Data Protection Agency (AZOP)
Address: Selska cesta 143, 10000 Zagreb, Hrvatska
Website: www.azop.hr

  1. COMPLIANCE STATEMENT

Candy Shells d.o.o. operates in full compliance with:

  • General Data Protection Regulation (GDPR) EU 2016/679
  • Personal Data Protection Act (Zakon o zaštiti podataka o osobama) – Croatian Law
  • Croatian Consumer Protection Laws
  • Electronic Communications Law

Document Version: 4.0
Status: Active
Date: January 26, 2026

This website uses cookies to improve your web experience.

NEW PROJECT COMING SOON!

NEW MODERN VILLAS WITH A SPECTACULAR SEA VIEW

full rental management service available!

Reserve a villa in the new Candy Brick project in Istria!