User Privacy Policy
Your privacy is extremely important to us, therefore we are committed to protecting your personal data in accordance with applicable laws, in particular the EU General Data Protection Regulation (GDPR). This document explains how AdriaticBooking collects, uses and processes your data when using our services, including the website. It also informs you about your rights and how you can contact us regarding privacy protection.
If you reside in the United States of America, please see the section on the rights of US users, where you can find additional information adapted to the CCPA regulation.
If you are a business partner or a provider of tourism services, please read our Privacy Policy for partners, which describes how we process data within the framework of business cooperation.
1. Key terms
In order to better understand this privacy policy, it is important to define the basic terms we use:
- Tourist activity – includes excursions, attractions and other experiences available through the AdriaticBooking platform.
- Service provider – entities that organize and offer tourist activities to users of our platform.
- CCPA – California Consumer Privacy Act of 2018.
- GDPR – European regulation defining the protection of personal data (EU 2016/679).
- AdriaticBooking platform – our activity booking system, accessible through the website and related platforms.
- Personal data – any information that can identify a specific person.
2. Who controls your data?
AdriaticBooking j.d.o.o. is responsible for the processing of your personal data when you use our services.
- Company name: AdriaticBooking j.d.o.o.
- Address: Gundulićeva 32, 21000 Split, Croatia
- Contact: For all privacy questions, you can contact us at info@adriaticbooking.com
It is important to note that the service providers with whom you make a reservation independently process your data in accordance with their own privacy policies. AdriaticBooking does not control the way they use your data.
3. How do we collect and use your data?
3.1. Automatic data collection
When you visit our website, certain data is collected automatically:
- Which pages you visit and how long you browse them
- Information about your device (browser, operating system, language, application version)
- Date and time of access
- IP address (which is automatically encrypted and deleted after 30 days)
- We use this information solely to improve the security and functionality of our platform and to prevent fraudulent activities
3.2. Data you provide to us
When using the AdriaticBooking platform, you can create a user account and enter personal data such as:
- First and last names
- E-mail addresses
- Passwords
This data allows us to manage your account and provide personalized services.
3.3. Wish lists and recommendations
To improve your experience, we allow you to create a wish list with activities you would like to book later. Based on your selections, we can offer you a display of personalized recommendations and customized offers.
3.4. Reviews and ratings
After participating in an activity, you can leave a rating and review to share your experience with other users. You can post them anonymously, and you also have the right to request the removal of your reviews later.
4. How do we process your inquiries and improve customer support?
4.1. Customer service
If you contact us via email, social media or chat, we process your data to help you with your inquiry. For faster and better support, we cooperate with trusted customer service providers.
The data that may be processed includes:
- First and last name
- Email address
- Booking number
- Content of your message
To manage inquiries, we use reliable systems such as FreshDesk and FreshChat, which can process data in accordance with European privacy regulations.
4.2. Improving the user experience
In order to improve the quality of our customer support, we analyze inquiries and conduct anonymous surveys on customer satisfaction. This ensures that our support is as efficient and tailored to your needs as possible.
5. Your rights and how to exercise them
According to the GDPR, you have the right to:
- Access to your data – You can request a copy of all personal data we hold about you.
- Rectification of data – If your data is inaccurate or incomplete, you can update it.
- Erasure of data – You can request the deletion of your data, except in cases where we have to retain it for legal reasons.
- Restriction of processing – In certain situations, you can ask us to restrict the way we use your data.
- Data portability – You have the right to receive your data in a structured format and transfer it to another service provider.
- Objection to processing – You can object to the processing of your data for marketing purposes or other activities that are not necessary for the provision of the service.
- To exercise your rights, please contact us at info@adriaticbooking.com
5.1. Translation of queries
In certain situations, it may be necessary to translate user queries into another language. In order to ensure high-quality international support, we process certain personal data, which is in our legitimate interest according to Art. 6 Para. 1 Point f GDPR. We use the services of DeepL SE ("DeepL") and Open AI, Inc. ("OpenAI") for translation. You can find more detailed information about their privacy policies here for DeepL and here for OpenAI.
5.2. Recording and analysis of telephone conversations
If you have given us your explicit consent, we may record and analyze telephone conversations for the purpose of improving customer support. We store these recordings for a maximum of three months, after which they are deleted. The legal basis for this data processing is Art. 6 Para. 1 Point a GDPR. You can withdraw your consent at any time via the contact channels specified in this privacy policy, and the withdrawal does not affect the processing of data before the withdrawal.
6. Technical infrastructure
6.1. Web hosting
Our website is hosted on Amazon Web Services EMEA S.a.r.l. ("AWS"). When users visit the site or enter personal data, their interaction is processed on AWS servers located within the European Union. In certain situations, AWS may process data outside the European Economic Area, including the USA, but appropriate safeguards are in place. You can find more information about AWS's privacy policy here.
6.2. Sending emails
We use Mailerlite, G-Suite and FreshDesk for email communication. Mailerlite, G-Suite and Freshdesk may process data in countries outside the EU, including the USA, in compliance with the EU-US Privacy Shield Framework. Detailed information can be found here at the links above.
6.3. Security protection
To protect our platform from automated attacks and abuse, we use Amazon AWS, Cloudfront, Google Business Suite technologies.
7. Newsletters and promotional notifications
Users can subscribe to our newsletter to receive personalized information about excursions, special offers and activities. By subscribing to the newsletter and the platform, users consent to the processing of their email address and interactions with the newsletter for the purpose of analysis and sending notifications, in accordance with Art. 6, paragraph 1, point (f) of the GDPR.
If you have already booked an activity through the AdriaticBooking platform or are a registered user, we may send you information about similar activities based on our legitimate interest (Art. 6, paragraph 1, point (f) of the GDPR).
You can unsubscribe from the newsletter at any time via the link in the email.
For the distribution of the newsletter, we use the MailerLite service, which may process data in the USA with the application of protective measures. More information about the MailerLite privacy policy is available here.
8. Activity booking process
8.1. Collection and sharing of data with service providers
When booking an activity through the AdriaticBooking platform, we collect the necessary information to provide the service. This includes first and last name, contact details, number of participants, booking date, and details of the selected activity. Depending on the type of activity, we may request additional information, such as information about documents or the age of the participants.
This data is used exclusively for the purpose of managing reservations, in accordance with Art. 6 para. 1 point b GDPR. If necessary, the information is forwarded to the activity organizers who further process it in accordance with their own privacy policies. If the data is transferred outside the European Economic Area, the relevant data protection legal mechanisms apply.
If you make a reservation through partner sites, you will be redirected to the AdriaticBooking site to complete the process. If you make a reservation through a travel agency, they are responsible for collecting the data and forwarding it to us for the purpose of realizing the reservation.
After confirming the reservation, you have the option to share the reservation information with other participants by entering their email addresses. In this case, you are responsible for ensuring their consent to receive such information.
8.2. Booking notifications
In order to ensure timely information about your bookings, we send e-mail notifications, SMS messages (if the number is provided) or push notifications within the AdriaticBooking application. These notifications serve as confirmation of the booking, reminders or notifications about possible changes to the date or location. Users can adjust the notification settings in their user accounts.
9. Payment Methods
We offer different options for paying for the activities you have booked. Depending on the payment method chosen, we process your personal data in order to successfully complete the transaction in accordance with our contractual obligations under Article 6, paragraph 1, point b of the General Data Protection Regulation (GDPR).
9.1. Credit card payments
We work with the service provider Stripe to process credit card payments. Stripe sends transaction data to the relevant banks or financial institutions to process the payment. Payments and payment confirmations are received by us or the service providers, depending on how the service is agreed between AdriaticBooking and the service provider. We will only receive confirmation of the successful payment, along with the first six and last four digits of your credit card number. We do not have access to your entire card number. Details on how Stripe processes your personal data can be found on their official website.
10. Fraud Prevention
In order to protect our services and users, as well as to prevent fraud, we use sophisticated fraud prevention tools offered by Stripe. These tools analyze transaction and user behavior data to detect potential threats and fraudulent activities. The processing of this data is based on our legitimate interest in maintaining the security of the AdriaticBooking platform.
Stripe may process your personal data in the USA. To ensure compliance with regulations, we have concluded standard contractual clauses with this company pursuant to Article 46(2)(c) of the GDPR. You can find more information about the processing of personal data by Stripe on their official website.
11. Cookies and Tracking Technologies
To improve the functionality of our websites and applications and to optimize marketing activities, we use cookies and other tracking technologies.
We use several types of cookies and tracking technologies:
- Session cookies – used to store technical data during a session, such as your login status.
- Persistent cookies – allow data to be stored outside of a single session.
- Web beacons – allow information to be collected about your device and the time of your visit.
- Scripts – small computer programs that support various functionalities on the website, including analytics and security features.
- URL tracking – allow us to track the source of traffic to our website.
- SDKs – are used in mobile applications to analyze usage and send personalized notifications.
We categorize these technologies into three basic categories:
- Essential technologies – without which the website or application would not be able to function.
- Analytical technologies – to track and improve services based on user behavior.
- Marketing technologies – to personalize content and advertise based on user data.
You can customize the use and management of cookies in the "Cookies and Marketing Settings" settings at the bottom of the page or in the "Privacy Settings" section of the application. You can choose which technologies you want to enable or disable, and your decision will apply across all devices and platforms.
12. User activity recordings
We use the services of Hotjar Ltd. ("Hotjar") to analyze the behaviour of visitors on our site. These services allow us to track the areas of the website where visitors most often move their mouse or click, which helps us understand their interests. The recording of data is limited to specific pages and random visits. The data is stored for up to 365 days, after which it is automatically deleted. The processing of this data is based on your consent (Article 6(1)(a) GDPR). Hotjar also complies with "Do Not Track" requests, more information about which can be found here. Details of the data processing by Hotjar can be found in their privacy policy.
13. Marketing and Remarketing Services
We use various marketing and remarketing services based on your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time via the "Cookies and Marketing Preferences" settings in the footer of our website or in the "Privacy Settings" section of the app. Withdrawal of consent will not affect the lawfulness of the processing of data up to the moment of withdrawal of consent.
13.1. Google Services
We use the services of Google Ireland Limited ("Google"). Google may process personal data in countries outside the European Economic Area, in particular in the USA. Google is party to the EU-U.S. Data Protection Framework, the UK extension to the EU-U.S. Data Protection Framework, as well as the Swiss-U.S. Data Protection Framework, which ensures adequate protection of all personal data transferred. You can find more information about how Google processes personal data here.
13.1.1. Google Analytics 360
With your consent, we use Google Analytics 360, a web analytics service. Google Analytics 360 collects pseudonymised data about the use of our website, including an abbreviated IP address. Google uses this data to analyse website and app activity. Your data will be stored for up to 26 months, after which it will be deleted, while only aggregated statistics will be retained.
13.1.2. Google Ads and Campaigns
If you have given your consent, we use Google advertising products for personalized ads. These products help us show you relevant ads based on your interests. For more information about privacy settings, you can visit Google's pages.
13.2. Meta Services (Facebook, Instagram)
We use the services of Meta Platforms Ireland Limited ("Meta"). Meta may process personal data in countries outside the European Economic Area, including the USA. Meta complies with the EU-U.S. Data Protection Framework, which ensures adequate protection of personal data. Details of Meta's processing of personal data can be found in their privacy policy.
13.3. TikTok Ads
Our site uses the services of TikTok Technology Ltd. ("TikTok").
If you have given your consent, we will use TikTok's services to display ads that are relevant to your interests on this platform. The data you share with TikTok when interacting with ads helps us track and analyze the effectiveness of our marketing campaigns. TikTok may transfer personal data to countries outside the European Economic Area. In order to ensure the protection of your data, we have concluded standard contractual clauses with TikTok that have been approved by the European Commission pursuant to Article 46(2)(c) of the General Data Protection Regulation (GDPR).
For more information about TikTok's processing of your personal data and your privacy control options, please visit TikTok's privacy policy here.
Further information about data processing on Reddit and your privacy options can be found in Reddit's privacy policy here.
14. Social networks
14.1. Facebook
Our official Facebook page can be found here.
Facebook is owned by Meta. If you visit our Facebook page as a registered user, Meta may collect your personal data. Even if you are not registered with Facebook, it will collect data about your behavior on the page. Together with Meta, we are responsible for processing data resulting from the so-called "Page Insights" functionality. Meta uses this data to analyze user behavior on our Facebook page and provide us with anonymous information about it. For this, we have concluded a joint data processing agreement with Meta Ireland, which you can view here. Meta assumes responsibility under the GDPR for the processing of data related to Page Insights.
For more information about the protection of your data on Facebook, please visit Meta's privacy policy here. You will also find information about the privacy settings for your Facebook account. Your data may be transferred to other companies within Meta’s system, including to the United States and other countries. Meta adheres to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework to ensure adequate protection of your personal data.
14.2. Instagram
Our official Instagram page is available here.
Instagram also belongs to Meta. For more information about Instagram’s privacy policy and options to control your account, please visit here.
Data about your use of the Instagram page may be available to other companies within Meta’s system. This data may be transferred to the United States and other countries, and Meta ensures adequate data protection in accordance with the above framework. As with Facebook, we are jointly responsible with Meta for analyzing behavior on the Instagram page through so-called Page Insights. This information provides us with anonymous data that helps us optimize our Instagram strategy. We have concluded a joint data processing agreement with Meta, which you can view here.
The data processing is based on our legitimate interest in optimising your activity on Instagram, in accordance with Article 6(1)(f) GDPR.
14.3. X (formerly “Twitter”)
You can find our account on X here.
X is operated by X Corp. (“X”). You can find X’s privacy policy and details of your account management options here.
It is important to note that X may transfer your personal data to third countries outside the European Economic Area, in particular the USA. X participates in the EU-US Data Protection Framework, the UK extension of this framework and the Swiss-US framework, ensuring adequate protection of the data transferred.
14.4. TikTok
You can find our TikTok profile here.
TikTok is operated by different subsidiaries depending on your location. TikTok’s privacy policy is available here.
Please note that TikTok may transfer personal data to countries outside the European Economic Area. In the event of such transfers, TikTok takes appropriate data protection measures, including the use of standard contractual clauses approved by the European Commission.
We are also jointly responsible with TikTok for the processing of TikTok analytics as part of the management of our TikTok profile. With these analytics, TikTok analyzes user behavior on our site and provides us with reports that are not linked to personal data. We have concluded a joint data processing agreement with TikTok, which you can view here.
14.5. LinkedIn
You can find our LinkedIn profile here.
For users within the European Economic Area and Switzerland, LinkedIn is operated by LinkedIn Ireland Unlimited Company ("LinkedIn"). LinkedIn's data protection policy is available here, where you will also find options to manage your LinkedIn profile settings.
LinkedIn may transfer personal data outside the European Economic Area, and in such cases uses standard contractual clauses approved by the European Commission. You can find further information on data transfers here.
We also receive aggregated data from LinkedIn that helps us analyze and optimize the effectiveness of our LinkedIn activities. This processing is based on our legitimate interest in improving our LinkedIn activities (Art. 6, para. 1, lit. f GDPR).
14.6. WhatsApp
You can also contact us via WhatsApp for further inquiries. WhatsApp is operated by Meta. WhatsApp's privacy policy is available here.
Your data is processed to respond to your inquiries (Art. 6, para. 1, lit. b GDPR). Further storage of data is based on our legitimate interest in the proper documentation of our business and the protection of our legal positions (Art. 6, para. 1, lit. f GDPR) and, where applicable, in compliance with legal obligations (Art. 6, para. 1, lit. c GDPR).
14.7. Social media management
In order to measure the success of our social media activities, we monitor when users tag us in their posts. We also process data about the people who tag us. This processing is based on our legitimate interest in improving and optimizing our social media activities (Art. 6, para. 1, lit. f GDPR).
14.8. Evaluation of our social media activities
We regularly analyze the effectiveness of our social media posts. The number of times individual posts are viewed or clicked on is monitored. For this analysis, we use advanced business intelligence platforms, such as Looker, a service provided by Google, and Google Analytics. The data processing is based on our legitimate interest in assessing the reach of our posts and the success of social media, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).
14.9. Competitions
From time to time, we organize competitions via social networks. To participate, you should, for example, comment on the content, tag us or like us. We process your data for the purpose of organizing the competition and notifying the winners (Art. 6(1)(b) GDPR).
15. Customer Relationship Management (CRM) System
In order to better manage our relationships with our users, we store their personal data in a CRM system. This allows us to respond to their inquiries more effectively and to send targeted advertising within the legally permitted framework. The data processing in this context is based on our legitimate interest in better managing our customer relationships (Art. 6(1)(f) GDPR). For this purpose, we use the services of Braze, a marketing automation platform provider. Braze may process personal data in countries outside the European Economic Area, such as the United States, where it is certified under the EU-U.S. and Swiss-U.S. data protection frameworks. With your consent (Article 6(1)(a) GDPR), through our cookie settings or marketing preferences, we send you personalized notifications or in-app messages based on your interests and activities on our site.
16. Personalization of content on our website
In order to provide you with relevant information and offers, we process your data to display personalized content on our website. This is based on our legitimate interest in providing you with offers that may be of interest to you, in accordance with Article 6(1)(f) GDPR.
17. Further sharing of data
Apart from the cases mentioned above, your personal data will only be forwarded in the following situations, without your express consent:
- If there is suspicion of illegal use of our services or in the event of a legal investigation, your data may be forwarded to law enforcement authorities or injured parties, if there is concrete evidence of misuse. Also, data transfer may occur if it is necessary to implement our terms of use or other agreements.
- As required by law, we will pass on information to certain public authorities, including law enforcement and tax authorities, where required by law. This data will be forwarded on the basis of our legitimate interest in preventing abuse and prosecuting criminal offences, in accordance with Article 6 paragraph 1 point f of the GDPR.
In addition, we may share data with our partners when it is linked to promotional content on their websites or applications, based on our legitimate interests to analyze the success of our joint campaigns or to compensate our partners, in accordance with Article 6(1)(f) of the GDPR.
Personal data may be shared with third parties, such as auditors, accounting firms, lawyers, tax advisors or banks, for the purpose of providing our services or to comply with legal obligations.
18. Automated decision-making processes and profiling
In order to protect the security of our platform and prevent fraud, we use automated decision-making tools. Based on the results of the fraud assessments, we automatically block transactions that are considered high risk. If your transaction is blocked, you will not be able to complete your reservation on the platform, but you have the right to request human intervention and challenge the decision by contacting our customer service team at support@adriaticbooking.com privacy team.
19. Your rights regarding the processing of personal data
You have rights that allow you to control your personal data. To exercise these rights, you can contact our team by email or post to the contact details above. Our privacy email address is:
19.1. Right to rectification
You have the right to request the rectification of inaccurate personal data without undue delay, pursuant to Article 16 of the GDPR.
19.2. Right to access data
You have the right to request information about the personal data we process concerning you, pursuant to Article 15 of the GDPR.
19.3. Right to erasure
You have the right to request the erasure of your personal data if they are no longer necessary for the purposes for which they were collected, or in the event of unlawful processing, pursuant to Article 17 of the GDPR.
19.4. Right to restriction of processing
In certain situations, you may request the restriction of processing of your data, as provided for in Article 18 of the GDPR.
19.5. Right to data portability
You have the right to request the transmission of your personal data in a structured, commonly used and machine-readable format, pursuant to Article 20 of the GDPR.
19.6. Right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is carried out, inter alia, on the basis of Article 6(1)(e) or (f) GDPR, in accordance with Article 21 GDPR. In such a case, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your rights, interests and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
19.7. Right to lodge a complaint with a supervisory authority (Art. 77(1) GDPR)
You have the right to contact a supervisory authority of your choice in the event of a complaint.
19.8. Right to withdraw consent (Art. 7(3) GDPR)
You have the right to withdraw your consent in accordance with Art. 7(3) GDPR (e.g. you can contact us if you wish to withdraw your previously given consent to the newsletter).
19.9. Data processing when exercising your rights
Finally, we would like to point out that we process the personal data you have provided to us when exercising your rights under Articles 15 to 22 GDPR for the purpose of exercising these rights and in order to be able to provide evidence of this. This processing is based on the legal basis of Article 6(1)(c) GDPR in conjunction with Articles 15 to 22 GDPR.
20. Rights of residents of the United States
20.1. Disclosure
If you are a resident of certain states, including California, Colorado, Connecticut or Virginia, you may have specific rights. Additional disclosures and rights applicable to residents of certain U.S. states that have enacted data protection laws and regulations are set forth below.
The California Consumer Privacy Act of 2018 ("CCPA"), the California Privacy Rights Act of 2020 ("CPRA"), and other state privacy laws provide certain U.S. residents with specific rights regarding their personal information. This section of the Privacy Policy describes those rights and how to exercise them. This section does not apply to information that is publicly available.
Some information is collected automatically when you access our website (See Section 4 of this Privacy Policy).
You can find more information about the personal information we collect, how we collect it, and why we collect it below:
- When you create an account on our website (see Section 2);
- When you choose to leave reviews (see Section 3.4);
- When you need customer support (see Section 4);
- Through our service providers.
- When you sign up for our newsletter (see Section 7);
- When you book activities on our platform (see section 8);
- For fraud prevention (see section 10);
- For protection against bots
- By using cookies (see section 9);
- For marketing purposes (see section 12);
- Some of our trusted partners may collect your personal data
- When you interact with us on social media (see section 14);
- For customer support purposes (see section 15);
- For product development;
- To personalize the content of the website (see section 16);
If necessary to provide the service you request, we will collect, process or you may provide us with sensitive personal data, such as usernames and passwords, government identification documents (e.g. driver's licenses) and passport numbers. For example, in very limited cases, some tour providers selling tickets and activities may require the collection of your passport number or other valid identification document during the purchase process, as well as, if applicable, additional specific requirements for the provision of the activity.
Depending on your cookie settings, we may "share" categories of personal information, as defined by California law, with third parties for the business and commercial purposes described in this Privacy Policy. Under the CPRA, "sharing" means disclosing your personal information to a third party or engaging in cross-context behavioral advertising, whether for monetary or other valuable consideration. See below for more information about the context in which we share your personal information and how to opt out.
We do not "sell" personal information as defined in the CPRA or the Consumer Data Protection Act (Virginia Privacy Act) ("CDPA").
We do not "sell" your personal information as defined in the CCPA.
We do not knowingly "share" personal information of known minors under the age of 16.
20.2. Right to access specific information
You have the right to request that we disclose to you certain information about how we have collected and used your personal information. Upon receipt of a valid request from you, we will disclose to you, to the extent permitted by law:
- The categories of personal information we have collected about you.
- The categories of sources of your personal information that we have collected.
- The business or commercial purpose for which we collect, sell or share your personal information, if applicable.
- The categories of third parties with whom we share your personal information.
- If we have disclosed your personal information for business purposes, the categories of personal information that each category of recipient has received.
20.3. Right to rectification and right to restriction
Residents of certain countries have the right to request that we correct inaccurate personal information we maintain about them, as explained in Section 20.1 of this Privacy Policy, subject to the exceptions set forth in applicable law. Residents of certain countries also have the right to request that we restrict our use of sensitive personal information (for example, your social security number, financial information, precise geolocation information, or your health information, etc.) for limited purposes, such as providing the services you have requested.
20.4. Right to erasure
Residents of certain countries have the right to request that we delete the personal information we have collected about them, subject to the exceptions set out in Section 20.3 of this Privacy Policy and as set out in applicable law
20.5. No discrimination
We will not discriminate against you for exercising any of your privacy rights.
20.6. Do not sell or share my personal information
You may change your cookie settings at any time and request that we opt out of sharing your personal information with third parties, subject to the exceptions set out in applicable law.
20.7. Do not share or disclose my sensitive personal information
You have the right to restrict how your sensitive personal information is disclosed or shared with third parties.
20.8. Opt-out of Targeted Advertising
Certain collection and processing of data on our website for the purposes of interest-based advertising may be considered "targeted advertising", or the "selling" or "sharing" of personal information under some state laws, such as the CDPA.
20.9. Exercising your rights
You may exercise your rights as described in this Privacy Policy, subject to applicable laws.
Conclusion
We care about the protection of your personal information and do everything we can to ensure transparency and security in its processing. If you have any questions or would like to learn more about our privacy practices, please feel free to contact us.
Changes to this Privacy Policy
You can always find the most current version of this Privacy Policy at: https://www.adriaticbooking.com/hr/pages/privacy .