Privacy policy

Last updated: 2026-04-23

1. Who we are

This website operates as Kravica Waterfall Tour, a Mostar-based day-trip service. In this policy, "we", "us" and "our" refer to the operator of this site; "you" refers to the person using this website or contacting us.

Email

[email protected]

2. What we collect

We only collect the data we need to answer your inquiry and run your tour.

When you send an inquiry through the contact form on this site, we receive:

• Your name
• Email address and / or phone number
• Travel dates
• Group size
• Interests or tour you are considering
• Your message
• Technical context: the page you submitted from and any UTM parameters

When you contact us directly by email we receive whatever you choose to send us — typically your name, contact details, and the content of your message.

When you browse this site, our hosting provider automatically receives standard technical information (IP address, browser type, pages viewed) for security and abuse prevention. This site does not currently use Google Analytics, advertising cookies, or third-party trackers. If that changes we will update this page and flag the change.

We do not take card details on this website. Tours are arranged by email and, where applicable, paid by cash on the day or by a secure payment link sent separately.

3. Why we use your data

• To reply to your inquiry and arrange the tour you are interested in.
• To run the tour — share pickup details with your driver, handle changes or cancellations.
• To meet legal and accounting obligations in Bosnia and Herzegovina (booking records, invoicing, tax).
• To keep the site safe — detect and block abuse, spam, and fraudulent submissions (e.g. the hidden honeypot field on the contact form).

For visitors in the EU/EEA, our legal bases under the GDPR are: performance of pre-contractual steps and the contract for your tour, our legitimate interest in running and protecting the business, and compliance with legal obligations.

4. Who we share it with

We keep your data inside a short list of trusted service providers:

• Cloudflare, Inc. (United States) — hosts this website (Cloudflare Pages) and delivers inquiry emails to us via Cloudflare Email Workers / Email Routing. Cloudflare also provides DDoS and abuse protection.
• Google LLC (United States) — our operational inbox is hosted on Gmail, where forwarded inquiries arrive.
• Our drivers and operations staff — receive the booking manifest for your tour day (name, traveler count, pickup, notes).
• Tax, legal or government authorities — only where we are legally required to disclose information.

We do not sell your personal data and we do not share it with advertisers.

5. Cookies

This site uses only essential cookies needed to operate (for example, preserving your selections on a page). It does not currently set analytics or advertising cookies. You can block or delete cookies through your browser settings at any time.

6. How long we keep it

• Inquiry emails — kept for as long as needed to handle the inquiry, then archived or deleted periodically.
• Booking and invoice records — kept for up to 10 years after the tour year, to meet accounting and tax obligations in Bosnia and Herzegovina.
• Server logs — retained for a short period per our hosting provider's defaults for security and debugging.

When a retention period expires we delete or anonymise the data.

7. Your rights

You can email us at [email protected]to:

• Ask what personal data we hold about you
• Correct data that is wrong or out of date
• Delete your data (unless we are legally required to keep it)
• Withdraw consent you previously gave
• Receive a copy of your data in a portable format
• Object to a specific use of your data

If you are in the EU/EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local data protection authority if you believe we have handled your data incorrectly.

8. Children

Our tours are family-friendly and often include children travelling with an adult. We only collect a child's details when an adult includes them in a booking, and only for the purposes of operating the tour (capacity, child-seat requirements, travel documents where required). We do not market to children.

9. International transfers

Some of our service providers (Cloudflare, Google, Meta) process data in the United States and other countries outside Bosnia and Herzegovina and the EU. We rely on the providers' standard contractual clauses and equivalent safeguards to protect your data when it is transferred.

10. Security

This site is served over HTTPS. Inquiry form submissions are transmitted over encrypted connections to Cloudflare and delivered to our inbox by Cloudflare Email Workers. We limit access to inquiry and booking data to the people who actually need it to run the tour. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.

11. Changes to this policy

We may update this page from time to time — for example, if we add a new tool or if the law changes. The "Last updated" date at the top of this page shows when the current version took effect. Material changes will be flagged on the website.

12. Contact

For any privacy question, request, or complaint, email us at [email protected].