This policy explains what personal data Maribor's Attic collects when you use this website, why, and the rights you have. It is written plainly and reflects how the site actually works — there is no booking form here, and no advertising cookies are set by default.
Who is responsible
The data controller is Sergej Nejc Gorišek s.p., Koroška cesta 43b, 2000 Maribor, Slovenia — registration no. 9279261000, VAT SI49368842. For any privacy question or request, contact [email protected] or +386 69 316 197.
What we collect, and why
- If you contact us — by email, phone or WhatsApp — we process the details you choose to send (your name, contact details, and your message) for the sole purpose of answering you. The legal basis is our legitimate interest in responding to enquiries.
- Website analytics — we use Cloudflare Web Analytics, which is privacy-first and cookieless: it records aggregate, anonymised page views and does not set cookies, fingerprint your device, or track you across other sites. No personal profile is built.
- Hosting and security — the site is served by Cloudflare Pages. Like any web server, it processes technical request data (such as IP address) transiently to deliver pages and protect against abuse. The legal basis is our legitimate interest in a secure, working site.
We do not currently use advertising or marketing cookies. If we ever introduce analytics or advertising that relies on cookies (for example Google Analytics or Google Ads), you will be asked to consent first through a cookie banner, and you can decline.
Bookings are made on Airbnb
This website is informational. Reservations, payment and identity verification all happen on Airbnb, under Airbnb's own terms and privacy policy. We receive only the guest information Airbnb shares with a host to manage a confirmed stay. We never ask for card or payment details on this site, and you should never enter them here.
Sharing
We do not sell your data. We share it only where necessary with the service providers that run the site (Cloudflare for hosting and analytics) and, for a booking, with Airbnb. These providers process data on our behalf or as independent controllers under their own policies.
How long we keep it
Enquiry correspondence is kept only as long as needed to deal with your request and any reasonable follow-up, then deleted. Analytics data is aggregated and not tied to you.
Your rights
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. To exercise any of these, email [email protected]. If you believe your data has been mishandled, you may complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, ip-rs.si).
Changes
If this policy changes — for instance, if we add consent-based analytics before running ads — we will update this page and its date.
Last updated 2 June 2026.