Legal
Website Privacy Policy
How we handle the personal data you share with us through aurema.life.
This Privacy Policy explains how IT FACTORY d.o.o. handles personal data collected through the website aurema.life, through the forms on that website, and through messages sent to us by e-mail or through our social media accounts.
It applies to everyone who visits the website, sends us an enquiry, subscribes to our newsletter, or submits a booking request for one of our retreats.
1. Who we are
AUREMA is a retreat brand operated by IT FACTORY d.o.o., which also owns and runs this website.
IT FACTORY d.o.o.
Dr. Ivana Novaka 10, 40000 Čakovec, Croatia
OIB: 76657421101
andrijana@aurema.life
We are the data controller for the personal data you provide through this website, which means we decide why your data is processed and how. We process it in accordance with Regulation (EU) 2016/679 (the GDPR) and the Croatian Act on the Implementation of the General Data Protection Regulation.
Personal data means any information relating to an identified or identifiable person — a name, an e-mail address, a telephone number, an IP address or another identifier.
2. How we collect your data
You give it to us directly. When you complete the booking request form, the contact form or the newsletter form on this website, or when you write to us by e-mail, telephone, post or social media.
We collect it automatically when you use the website. When you browse aurema.life, technical data about your device and your visit is collected, largely through cookies and similar technologies. Section 8 explains this in detail.
We receive it from analytics providers in aggregated form, telling us how the website is used rather than identifying you personally.
3. What data we process
Identification and contact data. First name, last name, e-mail address, country of residence, and telephone number if you give it to us.
Booking data. Year of birth, preferred retreat date, and anything you choose to add about what drew you to the retreat. Year of birth is collected because AUREMA retreats are for adults only and because travel documentation requires it.
Dietary requirements and food allergies. This field is optional, and it deserves a separate mention. Information about a food allergy or an intolerance is information about your health. Under Article 9 of the GDPR it is a special category of personal data and receives additional protection. We process it only where you give us your explicit consent by entering it in the booking form; we use it solely to plan meals safely and to inform the people and accommodation providers who prepare your food; and we use it for nothing else. If you would rather not enter it in a form, tell us by e-mail or on arrival instead.
Payment-related data. Where a reservation proceeds to payment, the data necessary to issue an invoice and record the transaction. Card details are never collected or stored by us or by this website.
Technical data. IP address, browser type and version, operating system, device type, referring page, pages visited and time spent on them.
Correspondence. The content of messages you send us and our replies.
4. Why we process your data, and on what legal basis
| Purpose | Legal basis | Data used |
|---|---|---|
| Responding to a booking request, checking availability, sending payment instructions | Steps taken at your request before entering into a contract (Art. 6(1)(b)) | Identification, contact and booking data |
| Organising and delivering the retreat you have booked | Performance of a contract (Art. 6(1)(b)) | Identification, contact and booking data |
| Planning meals around allergies and dietary requirements | Explicit consent (Art. 9(2)(a)) | Dietary and allergy information |
| Answering enquiries sent through the contact form or by e-mail | Legitimate interest in replying to people who contact us (Art. 6(1)(f)) | Identification, contact data, correspondence |
| Sending the newsletter | Consent (Art. 6(1)(a)) | Name and e-mail address |
| Issuing invoices and keeping accounting records | Legal obligation (Art. 6(1)(c)) | Identification and payment-related data |
| Operating and securing the website | Legitimate interest in a functioning, secure website (Art. 6(1)(f)) | Technical data, strictly necessary cookies |
| Measuring how the website is used | Consent (Art. 6(1)(a)) | Technical data, analytics cookies |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) | As relevant to the claim |
The same data may be processed on more than one legal basis, depending on the purpose.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it. The newsletter can be unsubscribed from using the link in every message, or by writing to us.
Providing your data is not a statutory requirement, but without identification, contact and booking data we cannot process a booking request or organise your participation in a retreat.
5. Who we share your data with
We do not sell personal data, and we do not share it beyond what is described here.
The travel partner for the specific retreat. Each AUREMA retreat is operated together with a licensed travel agency, which handles booking documentation, payment and the legally required travel information. For The Nature of Coming Home this partner is True Colors. That partner acts as a separate controller for the documentation it issues, and its own privacy notice applies to that processing.
Accommodation and service providers taking part in the retreat. For The Nature of Coming Home this includes Terme Sveti Martin and Hotel Castellum in Čakovec, the transfer provider, and the people preparing meals. They receive only what they need: usually your name, the dates of your stay, and where relevant your dietary requirements.
Our processors. Providers of website hosting, form handling and newsletter delivery; Google Ireland Limited, which provides the Google Analytics 4 measurement service; Usercentrics A/S, which provides the Cookiebot consent banner and stores the record of your consent within the European Union; and our accountant. Each acts on our instructions under a data processing agreement and may not use your data for their own purposes.
Public authorities, where the law requires us to disclose data.
6. Transfers outside the European Economic Area
We prefer providers who process data within the European Economic Area, and most of the data described here stays within it.
The exception is website analytics. We use Google Analytics 4, provided by Google Ireland Limited, and Google may transfer data to servers outside the EEA, including to Google LLC in the United States. That transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Google is certified, and on the European Commission's standard contractual clauses as an additional safeguard. Analytics cookies are set only if you consent, so if you decline them no data reaches Google at all.
Where any other service we use processes data outside the EEA, the same safeguards apply.
7. How long we keep your data
- Booking and contract data — for the duration of the contractual relationship, and afterwards for as long as claims arising from it may be made.
- Invoices and accounting records — eleven years from the end of the business year to which they relate, as required by the Croatian Accounting Act.
- Dietary and allergy information — until the end of the retreat you attended, after which it is deleted. If you join us again, it is collected again.
- Enquiries that do not lead to a booking — up to two years from the last correspondence.
- Newsletter subscriptions — until you unsubscribe or withdraw consent.
- Technical and analytics data — as set out in Section 8.
8. Cookies and similar technologies
A cookie is a small text file placed on your device when you visit a website, and read again when you return. Similar technologies, such as pixels, work alongside cookies to record how a page is used.
Strictly necessary cookies make the site work — for example remembering your cookie choices. They are set on the basis of our legitimate interest and cannot be switched off.
Analytics cookies tell us how many people visit the site, which pages they read and how they arrived. We use Google Analytics 4 for this, and the cookies are set only if you consent. The Cookie Policy describes them in detail.
We do not use advertising or targeting cookies.
You can change or withdraw your cookie consent at any time through the cookie settings on this website, and you can block or delete cookies in your browser. Blocking strictly necessary cookies may stop parts of the site from working.
The typefaces used on this website are hosted on our own server rather than loaded from a font service, so visiting a page does not disclose your IP address to a third-party font provider.
9. Links to other websites
This website links to other websites and services, including social media. Following those links takes you outside our control. We are not responsible for how those sites handle your data, and we recommend reading their own privacy notices.
10. Your rights
You have the right to:
- be told whether we process data relating to you, and to receive a copy of it
- have inaccurate or incomplete data corrected
- have your data erased, where one of the grounds in Article 17 of the GDPR applies
- have processing restricted, where one of the grounds in Article 18 applies
- receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller
- object to processing based on our legitimate interests
- withdraw consent at any time, where processing is based on consent
To exercise any of these rights, write to andrijana@aurema.life or to IT FACTORY d.o.o., Dr. Ivana Novaka 10, 40000 Čakovec. We will respond within one month of receiving your request. Where a request is complex, that period may be extended by a further two months, and we will tell you if that happens.
If you believe your data is being handled unlawfully, you may lodge a complaint with the Croatian supervisory authority:
Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136, 10000 Zagreb
azop@azop.hr · azop.hr
11. Security
We apply technical and organisational measures appropriate to the risk, including encrypted transmission of everything submitted through this website, restricted access to booking data, and confidentiality obligations for everyone who works with us on a retreat.
12. Automated decision-making
We do not make decisions about you by automated means, and we do not profile you.
13. Changes to this policy
We may update this policy, for example when our services change or when a regulator requires it. The current version is always published at aurema.life/privacy-policy, together with the date it was last updated.