ALMISSUM Privacy Notice
Privacy Policy
Last updated: July 2026
Data Controller
The controller responsible for the processing of personal data on this website is:
KARLO LEONE d.o.o.
Put stare Duće 33
21310 Duće – Omiš
Croatia
No separate Data Protection Officer is currently listed for this website. Privacy-related requests may be submitted using the contact details above.
Scope Of This Privacy Policy
This Privacy Policy applies to the ALMISSUM website and related online presentation pages, including ALMISSUM Collection, ALMISSUM Residences, ALMISSUM Private Stays, Acquisition, Private Access and selected project pages.
ALMISSUM is presented as a private European platform for selected Adriatic residences, hospitality-led assets, private stays and controlled acquisition-related access for qualified parties. Personal data is processed only where necessary for communication, requested information, private access requests, private stay enquiries, documentation review or legally required business purposes.
Categories Of Personal Data
Depending on how you interact with this website, the following categories of personal data may be processed:
- Name and surname
- Company name
- Position or professional role
- Email address
- Telephone number
- Country or location information voluntarily provided
- Message content and enquiry details
- Private access or acquisition-related interest information
- Private stay, reservation or hospitality-related enquiry information
- Communication history and qualification status where relevant
- Technical data such as IP address, browser type, device type, referrer URL and access time
Processing Purposes And Legal Bases
Personal data may be processed for the purposes listed below. Depending on the individual case, processing may be based on one or more legal grounds under Article 6 GDPR.
Communication
Purpose: responding to emails, contact requests and general questions.
Legal basis: Art. 6(1)(b) GDPR where the request relates to pre-contractual communication;
Art. 6(1)(f) GDPR for general business communication.
Qualified Review
Purpose: reviewing buyer profile, professional role, acquisition-related interest and
suitability for selected private materials.
Legal basis: Art. 6(1)(b) GDPR for request handling; Art. 6(1)(f) GDPR for protecting
confidential project information and managing qualified enquiries.
Reservation Enquiries
Purpose: handling stay requests, availability enquiries, guest communication and
reservation-related coordination.
Legal basis: Art. 6(1)(b) GDPR for pre-contractual or contractual communication;
Art. 6(1)(c) GDPR where statutory retention obligations apply.
Security & Functionality
Purpose: technical operation, security, troubleshooting, prevention of misuse and
maintaining website functionality.
Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is secure, reliable and
functional website operation.
Compliance
Purpose: complying with legal, accounting, tax, corporate, record-keeping or disclosure
obligations.
Legal basis: Art. 6(1)(c) GDPR and, where applicable, Art. 6(1)(f) GDPR for legal
documentation and defence of claims.
Consent-Based Services
Purpose: loading non-essential cookies, analytics, embedded content or external services
where consent is required.
Legal basis: Art. 6(1)(a) GDPR where consent is requested and given.
Legitimate Interests
Where processing is based on legitimate interests under Art. 6(1)(f) GDPR, such interests may include secure website operation, prevention of misuse, business communication, handling qualified private access enquiries, protecting confidential project information, documenting communication history and asserting or defending legal claims.
Private Access Requests
If you request ALMISSUM Private Access, ALMISSUM may process information relating to your identity, company, professional role, acquisition-related interest, intended use, transaction background, requested materials or advisory context.
This information is used to assess and respond to your request, manage communication, provide suitable materials where appropriate and protect confidential project, ownership, acquisition-related and review information.
Private Stays And Booking Tools
The ALMISSUM Private Stays section may use external booking or reservation tools, including Lodgify or related booking technology, to display availability, seasonal pricing and reservation options.
When using such tools, personal data may be processed by the relevant booking platform in accordance with its own privacy terms. ALMISSUM has limited influence over the processing of data by external booking providers.
External Platforms And Embedded Content
This website may include or link to third-party services such as Google Maps, Google Reviews, YouTube, Instagram, booking platforms, external documents or other embedded services.
When you access or interact with such third-party services, personal data may be processed by the respective external provider. This may include IP address, device information, browser data, location-related data, cookies, identifiers or interaction data. Please refer to the privacy policies of the respective providers for further information.
Cloudflare Turnstile
This website may use Cloudflare Turnstile to protect forms against spam, misuse and automated submissions. Turnstile may process technical information such as IP address, browser data, device information and interaction signals for bot detection and security purposes.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure operation of the website, protection of private access forms and prevention of misuse.
Cookies And Consent Management
This website may use cookies or similar technologies to ensure technical operation, remember cookie preferences, improve user experience, enable embedded content and analyse website functionality where applicable.
Necessary cookies and technically required storage may be used to provide the website and remember consent preferences. Non-essential cookies, analytics or external embedded services are used only where consent is required and has been given through the cookie banner or relevant consent mechanism.
You may adjust your browser settings to block or delete cookies. Some website functions or embedded services may not work properly if cookies or external content are disabled.
Server Log Files And Technical Data
When visiting this website, technical information may be automatically collected by the hosting provider or website system. This may include IP address, browser type, operating system, referrer URL, time of access and requested pages.
This data is processed for technical operation, security, troubleshooting, performance monitoring and protection against misuse or attacks.
Recipients And Service Providers
Personal data is not sold, rented or commercially transferred to third parties.
Data may be shared only where necessary for the requested service, website operation, communication, private access review, private stay enquiries, document delivery, professional advice, legal or tax review, notarial support, booking processing or compliance with legal obligations.
Service providers may include hosting providers, email providers, form processors, booking platforms, IT service providers, security providers, document delivery tools, analytics or consent tools where applicable, as well as professional advisors such as legal, tax, accounting, real estate or notarial advisors.
International Data Transfers
Where third-party services are used, personal data may be processed outside the European Economic Area, including in countries whose level of data protection may differ from that within the European Union.
Where required, transfers are intended to take place only on the basis of adequacy decisions, Standard Contractual Clauses or other legally recognised safeguards and transfer mechanisms.
Data Retention
Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected, manage ongoing communication, protect legitimate business interests or comply with applicable legal retention obligations.
Server Logs
Normally retained for a short period for security, technical operation and troubleshooting, unless longer retention is required due to misuse, security incidents or legal reasons.
General Enquiries
Retained for the duration of communication and a reasonable follow-up period, unless statutory retention duties or legitimate documentation interests require longer retention.
Private Access Communication
Retained as long as necessary for qualification, communication history, documentation review, legal/commercial review, transaction context and statutory retention duties.
Reservation-Related Data
Retained according to reservation communication, booking, accounting, tax and legal retention requirements.
Voluntary Or Required Data Provision
Providing personal data is generally voluntary. However, without certain contact, enquiry, qualification or reservation information, ALMISSUM may not be able to respond to enquiries, process private access requests, provide selected materials, arrange private stay communication or handle reservation-related communication.
Where data is required by law, contract or pre-contractual communication, failure to provide the relevant data may prevent the requested service or communication from being completed.
No Automated Decision-Making
ALMISSUM does not use automated decision-making, including profiling within the meaning of Art. 22 GDPR. Private access requests may be reviewed manually based on the information provided and the nature of the request.
Your Rights
Under applicable data protection law, you may have the following rights:
- Right to access your personal data
- Right to rectification of inaccurate or incomplete data
- Right to erasure of your personal data
- Right to restriction of processing
- Right to object to processing
- Right to data portability
- Right to withdraw consent where processing is based on consent
- Right to lodge a complaint with a competent supervisory authority
Requests may be submitted to:
office@almissum.eu
Withdrawal Of Consent
Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Supervisory Authority
You have the right to lodge a complaint with a competent data protection supervisory authority. For Croatia, the competent authority is:
Agencija za zaštitu osobnih podataka / Croatian Personal Data Protection Agency
Ulica Metela Ožegovića 16
HR – 10 000 Zagreb
Croatia
Email: azop@azop.hr
Phone: +385 (0)1 4609-000
Website: www.azop.hr
Data Security
Appropriate technical and organisational measures are used to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. However, no online transmission or storage system can be guaranteed to be completely secure.
External Links
This website may contain links to third-party websites. ALMISSUM and KARLO LEONE d.o.o. have no influence over the content, data processing or security practices of external websites and accept no responsibility for such external content or practices.
Updates To This Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in legal requirements, website functionality, external providers, services or the ALMISSUM platform structure.
Contact
For privacy-related enquiries, please contact:
office@almissum.eu
For private access enquiries, please contact:
invest@almissum.eu
Copyright
© 2026 ALMISSUM™ / KARLO LEONE d.o.o.
All rights reserved.