Privacy Policy

Last updated: 10 September 2026

This policy explains what personal data the Adria HEARTS Summit collects through adriahearts.com, why we collect it, who we share it with, and the rights you have over it. We have tried to write it in plain language rather than legal boilerplate.

Who is responsible for your data

What we collect, and why

When you make a reservation

The booking form asks for your name, email address, telephone number and country. Depending on the room and package you choose it may also record the name of a partner or roommate you are travelling with, whether you would like us to pair you with someone, which tribe you have chosen, and any discount code you use.

We need this to hold your place, to arrange rooms, and to write to you about the summit. The legal basis is performance of a contract with you.

When you register for the HEARTS in Action workshop or send an expression of interest

The two forms on the HEARTS in Action page ask for your name, email address, country and city, and time zone, and optionally your organisation and role, a telephone number and a link to a public profile. Depending on how you would like to take part, they may also record a description of a project or initiative, your areas of expertise, or your interest in partnership, sponsorship or investment.

We use this to register you for the workshop, to review your expression of interest, and to contact you and coordinate your participation. The legal basis is steps taken at your request before entering into an agreement with you. If you also tick the box asking for news and invitations, the legal basis for sending those is your consent, which you can withdraw at any time.

Please do not send confidential or commercially sensitive information through these forms.

When you pay

Payments are processed by Stripe. Your card details are entered on Stripe's own secure page and never reach our servers — we never see or store your card number. Stripe tells us only whether the payment succeeded, the amount, and the reference.

We keep the record of your payment because tax and accounting law requires us to.

When you simply visit

Our hosting provider keeps standard server logs (IP address, browser type, time of request) to keep the site running and to defend against abuse. The legal basis is our legitimate interest in a secure, working website. We also apply basic rate limiting to the booking, discount-code and HEARTS in Action forms for the same reason.

Cookies and measurement

With your permission we use analytics and marketing cookies from Meta, TikTok and Google. These help us understand how the site is used and measure whether our advertising works. They are switched off until you agree, the legal basis is your consent, and you can withdraw it at any time. Full detail is in our Cookie Policy.

Who we share it with

We do not sell, rent or trade your personal data. We share it only with the services that make the summit work:

Who	What they receive	Why
Stripe	Name, email, amount	To take payment securely
WMD	Everything stored on the site	Website hosting and email
HEARTS in Action facilitators	What you sent through the HEARTS in Action forms, where needed	To match you with a Live Case, a project team or a partner
Meta, TikTok, Google	Pseudonymous event data, such as that a page was viewed or a booking completed	Advertising measurement — only with your consent
Our marketing partner	Access to the advertising accounts above; no access to your booking record	Running and measuring the summit's advertising on our behalf

Some of these companies are based outside the European Economic Area, mainly in the United States. Where that is the case, transfers rely on the European Commission's adequacy decisions or on Standard Contractual Clauses.

How long we keep it

• Reservation and payment records — 11 years from the end of the business year in which the booking was paid. We would keep these for a shorter time if we could, but Croatian accounting law sets this period for accounting records and we are not free to delete them earlier.
• Email enquiries that do not lead to a booking — 12 months after our last message to each other. If your enquiry becomes a booking, it is kept with the booking record above.
• HEARTS in Action workshop registrations and expressions of interest — 12 months after our last message to each other, the same as other enquiries. News and invitations stop as soon as you ask.
• Cookie consent records — 24 months from the date you made the choice, as evidence that it was given. The choice itself is stored on your own device for 6 months, after which we ask you again.
• Server logs — a short rolling window kept by our hosting provider, then overwritten.

When a period ends the data is deleted, or anonymised so that it can no longer be traced back to you.

Your rights

Under the GDPR you may ask us to:

• See the personal data we hold about you;
• Correct anything that is wrong or incomplete;
• Delete it, where we are not required to keep it;
• Restrict or object to how we use it;
• Receive a copy in a portable format;
• Withdraw consent at any time, without affecting anything done before you withdrew it.

Write to info@adriahearts.com and we will respond within one month. To change your cookie choices, use Cookie settings.

Complaints

If you believe we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Croatian supervisory authority:

Security

The site is served over HTTPS. Payment card data never touches our servers. Access to the reservation records is limited to the small team running the summit and is protected by individual logins.

Changes

If we change how we handle your data we will update this page and the date at the top. If the change affects what you consented to, we will ask you again.