Privacy Policy

1. Controller

The controller for Bled Local marketplace processing is Prevozne storitve, Aljaž Žnidar s.p., trading under the Bled Local brand. The registered address and published contact details are shown below.

2. Data we collect in the current service

Browsing and attribution. The marketplace creates a functional visitor session. When you enter through a participating accommodation route, it records the accommodation or distribution point that referred the visit, so the correct guest presentation and any applicable attribution can be applied. It does not require a guest account.

Native booking data. When you make a Bled Local native booking, we collect your name, email address, telephone number, selected activity, date, quantity, location or accommodation details if supplied, optional booking note, price, booking and payment status, and the terms version and time accepted.

Restricted-area accounts. Admin, accommodation-owner and activity-provider areas use Supabase authentication. The relevant account identity and role are used to control access. Owners are intentionally not shown customer personal data.

Operational records. We keep limited booking, availability, commission, audit and service-security records needed to operate the marketplace, investigate errors and protect the service. We do not use Google Analytics, advertising pixels or marketing tracking in the current marketplace implementation.

3. Why we use personal data

We process data to provide the marketplace and complete a requested native booking (performance of a contract or steps at your request), to meet applicable accounting or legal obligations, and for legitimate interests in security, fraud prevention, service reliability and fair attribution to accommodation partners. Where consent is required for a separate purpose, we will ask for it separately. We do not use a pre-ticked marketing consent in the booking flow.

4. Who processes data

Supabase provides the database, authentication and storage infrastructure used to operate Bled Local. Stripe processes card payment details and payment transactions for native Stripe Checkout bookings; Bled Local does not store full card details. Vercel hosts the application and may process limited technical request information needed to deliver it.

For a third-party activity or a stay, a click may take you to the named provider’s or property’s own website or booking service. Information you enter there is handled under that business’s own privacy notice and terms. Bled Local does not receive your payment-card details from those external checkouts.

These providers may process data from locations outside the EEA. Where a transfer occurs, the relevant provider is responsible for using an applicable transfer mechanism and safeguards. We do not sell personal data.

5. Retention and security

We keep data only for as long as needed for the purpose collected, including booking administration, resolving a complaint, fraud prevention and applicable legal or accounting obligations. Functional visitor-session data is designed to expire after 30 days; the short attribution handoff expires after 60 seconds. Specific retention schedules for booking, financial and audit records are still being formalised and will be published when approved.

Access is limited by role and technical controls. No online service can guarantee absolute security, but we use reasonable measures appropriate to the service and minimise access to personal data.

6. Your rights

Subject to applicable law, you may ask for access, correction, deletion, restriction, portability or object to certain processing. You may also complain to the Slovenian Information Commissioner or your local EU/EEA data-protection authority. To make a request, contact us using the published contact details and describe the request so we can verify and respond appropriately.

7. Changes

We may update this policy when the service or legal requirements change. The latest version is published on this page.