Privacy & Cookie Policy

Who we are

visitbanja.com (“we”, “us”) is an editorial guide to Serbia’s thermal spa towns. The controller responsible for your personal data is VisitBanja.com, operated by Milos Pavic, Carl Møllers Allé 4, 2860 Søborg, Denmark. You can reach us about privacy at contact@visitbanja.com.

The short version

This is a static site. We don’t run accounts, comments, a login or a database. We set one strictly-necessary cookie to remember your cookie choice, and — only if you agree — Google Analytics to see which banje readers are interested in, and Microsoft Clarity to see how pages are actually used. Until you choose, no analytics cookies are set, Clarity never loads, and nothing here identifies you — Google receives only an anonymous count that a page was viewed. You can change your mind any time via Cookie settings.

What we collect and why

Analytics (with consent). If you accept analytics, Google Analytics 4 collects usage data — pages viewed, approximate location (from a truncated IP), device and browser type, and referring links. We use it only in aggregate to decide what to write next. The GA identifier can single out a browser, so we treat it as personal data.

Before you choose. The Google Analytics tag loads with every storage permission denied, so it sets no cookies and sends no identifier. It does send Google an anonymous signal that a page was viewed, which Google counts in aggregate and cannot link to you or to any other visit. Nothing is stored on your device, and no such signal is sent to Microsoft at all — Clarity is not loaded until you accept.

Session replay and heatmaps (with consent). If you accept analytics, Microsoft Clarity records how you use the page — mouse movement, clicks, scrolling and the pages you move between — and replays it back to us so we can see where a guide is confusing or a layout fails. It is a recording of your interaction with our pages, not of your screen, your other tabs, or anything outside this site. There is nowhere on this site to type personal data: we run no forms, no login, no comments and no search box that reaches us.

Strictly necessary (no consent needed). A single first-party cookie stores your cookie choice so we don’t ask on every page. It contains no tracking identifier.

We do not collect names, emails or payment data — we take no bookings ourselves. Accommodation links pass through our affiliate partner Stay22, so that a booking can be credited to us, and then send you to Booking.com. Both are separate companies with their own privacy policies.

Legal basis (GDPR Article 6)

Analytics and session-replay cookies are processed on the basis of your consent (Art. 6(1)(a)), which you may withdraw at any time. The strictly-necessary cookie relies on our legitimate interest (Art. 6(1)(f)) in operating the site and honouring your preference.

Cookies we use

Analytics cookies are set only after you accept them. If you reject or ignore the banner, none are placed — and Clarity is not merely held back but never loaded at all, so no request reaches Microsoft in the first place.

Sharing and international transfers

Analytics data is processed by Google as our processor. This can involve transfer to servers in the United States. Google LLC self-certifies under the EU-U.S. Data Privacy Framework, which currently provides a legal basis for such transfers, and Google additionally applies the EU Standard Contractual Clauses as a safeguard. See Google’s Privacy Policy.

Session-replay data is processed by Microsoft as our processor, which can likewise involve transfer to servers in the United States. Microsoft Corporation self-certifies under the EU-U.S. Data Privacy Framework and applies the EU Standard Contractual Clauses as an additional safeguard. See Microsoft’s Privacy Statement and Clarity’s documentation. We share your data with no one else.

How long we keep it

Your cookie choice is stored for up to 180 days, after which we ask again. Google Analytics data is retained for up to 14 months and then deleted automatically. Clarity keeps session recordings for 30 days from the time of recording, except that recordings we mark as favourites, and a randomly selected sample, are kept by Microsoft for up to 9 months. Heatmap data is available for up to 9 months.

Your rights

Under the GDPR you may request access to your data, correction, erasure, restriction, portability, and you may object to processing. You can withdraw analytics consent at any time via Cookie settings — it is as easy to withdraw as to give. To exercise any right, email us at contact@visitbanja.com.

You also have the right to complain to a supervisory authority — in Denmark, that is Datatilsynet.

Changes to this policy

When we change what we collect, we update this page and its version number, and — where the change is material — ask for your consent again.