This policy explains what personal data we collect when you use adventuremontenegro.me or book an activity with us, why we collect it, how long we keep it, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and Montenegro's Law on Personal Data Protection.
1. What we collect
We keep data collection to the minimum we need to answer your enquiry and run your activity safely. We do not buy personal data from third parties, and we do not build advertising profiles.
- Enquiry and booking details — the name, email address, telephone number, chosen activity and message you submit through the contact form, or send us directly by email, WhatsApp or Instagram.
- Trip-planning details — dates, group size, experience level and similar practical information you share with us while we plan your activity.
- Health and safety information — where an activity requires it, relevant medical conditions, injuries, allergies, swimming ability, height and weight for equipment fitting, and an emergency contact. Some of this is "special category" data under GDPR Article 9; we collect it only with your explicit consent and only because it is necessary to keep you safe on the mountain or in the water.
- Technical data — our web server records standard log information such as your IP address, browser type, the pages requested and the time of the request. These logs are generated automatically by the hosting platform.
- Language preference — stored in a session cookie so the site remembers whether you are reading in English, Montenegrin or Russian.
We do not collect payment card details through this website. Any payment is arranged directly with us or, where applicable, through a third-party payment or booking provider that handles card data under its own privacy policy.
2. Why we use it, and our legal basis
- To reply to your enquiry and prepare your activity — necessary for the performance of a contract, or for steps taken at your request before entering into one (GDPR Art. 6(1)(b)).
- To run the activity safely — performance of a contract, and our legitimate interest in the safety of guests and guides (Art. 6(1)(b) and 6(1)(f)). Health information is processed on the basis of your explicit consent (Art. 9(2)(a)).
- To keep our website secure and working — legitimate interest in preventing abuse, spam and technical failure (Art. 6(1)(f)).
- To meet accounting and legal obligations — compliance with a legal obligation (Art. 6(1)(c)).
- To publish photographs or video of your activity — only with your consent (Art. 6(1)(a)). See section 7.
We do not send marketing emails or newsletters. If that ever changes, we will ask for your consent first and every message will carry a one-click unsubscribe link.
3. Cookies and tracking
This website uses a single, strictly necessary cookie. PHPSESSID is a session cookie set by our server to hold your chosen site language; it contains no personal information, is not used for tracking, and is deleted when you close your browser.
We do not use Google Analytics, advertising pixels, remarketing tags or any other analytics or profiling cookies. Because the only cookie we set is essential to providing the service you requested, no cookie consent banner is required.
Two third-party services load resources into the page and, in doing so, receive your IP address as a technical necessity of delivering those files: Google Fonts (typefaces) and jsDelivr (the Bootstrap and Fancybox libraries). Neither sets a tracking cookie through our site. You can block them with a browser extension, though parts of the page may then look or behave differently.
4. Who we share it with
We never sell or rent your personal data. We share it only where it is necessary to run our business, and only with:
- Our web and email hosting provider, which stores the enquiry emails and server logs on our behalf as a data processor.
- Guides and partner operators assigned to your activity, who receive only what they need to run it safely — typically your name, contact number, group size and any relevant health information.
- Messaging platforms you choose to use — if you contact us via WhatsApp or Instagram, that conversation is also processed by Meta Platforms under its own privacy policy.
- Insurers, emergency services and medical providers, if an incident occurs and disclosure is necessary to protect life or health.
- Accountants, auditors and public authorities, where we are legally required to disclose information.
5. International transfers
Montenegro is outside the European Economic Area but has data protection legislation aligned with the GDPR. Some of our providers — email, hosting, content delivery networks and the messaging platforms above — may process data on servers outside Montenegro or the EEA. Where that happens we rely on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Enquiries that do not lead to a booking — up to 12 months, then deleted.
- Booking and activity records — up to 5 years after the activity, so that we can deal with any insurance or liability question that arises.
- Health and emergency-contact information — deleted shortly after your activity finishes, unless an incident occurred and it forms part of the record.
- Accounting records — for the period required by Montenegrin tax and accounting law.
- Server logs — retained for a short rolling period by our hosting provider for security and diagnostics.
7. Photographs, video and drone footage
Our guides often photograph or film activities, and we also offer drone filming as a service. Photographs and video of the day are shared with the group on request. We will only publish images in which you are identifiable — on this website, on Instagram or in other promotional material — if you have agreed to it. You can withdraw that agreement at any time by emailing us, and we will remove the image from any channel we control. If you would prefer not to be photographed at all, simply tell your guide at the start of the day.
8. Security
The site is served over HTTPS, the contact form is protected against automated abuse, and access to enquiry emails is limited to the people who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. If a breach ever occurs that is likely to affect your rights, we will notify you and the supervisory authority as the law requires.
9. Children
Children are welcome on many of our activities, but this website is not directed at them and we do not knowingly collect data from children directly. Where a minor takes part, the booking, consent and health information must be provided by a parent or legal guardian. See our FAQ on whether children can participate.
10. Your rights
Under the GDPR and Montenegrin data protection law you have the right to:
- ask what personal data we hold about you, and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased where we no longer have a valid reason to keep it;
- restrict or object to our processing, including anything based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, where our processing relies on consent — this does not affect processing carried out before you withdrew it.
To exercise any of these, email contact@adventuremontenegro.me. We will respond within 30 days. If you are not satisfied with our response, you can complain to Montenegro's Agency for Personal Data Protection and Free Access to Information (AZLP), or to the supervisory authority in your own country of residence.
11. Changes to this policy
We may update this policy as our services or legal obligations change. The current version is always published on this page, with the revision date shown at the top. Material changes affecting how we use data you have already given us will be communicated to you directly where we hold your contact details.
12. Contact us
Questions about this policy, or about how we handle your data, are welcome. Email contact@adventuremontenegro.me, message us on WhatsApp at +382 69 69 26 69, or use the contact form. See also our terms & conditions.