Privacy policy

In short: this website has no contact form, no account and no database. It sets no cookies unless you actively agree, and it loads nothing from third parties on its own. We ask once whether we may run web analytics and whether we may load our interactive map — you can answer the two separately. If you decline, or simply ignore the question, nothing is fetched from Google or Mapbox at all. Everything else you see here is served from our own site.

1. Controller

We process your personal data in accordance with the Law on Personal Data Protection of the Republic of North Macedonia (Official Gazette of the Republic of North Macedonia nos. 42/2020 and 294/2021). The controller — the party that decides why and how your data is processed — is:

Zoran Apostoloski
Dejan Vojvoda 32, 6000 Ohrid, North Macedonia
Email: joanasapartments@gmail.com
Phone: +389 77 647 561

The apartments, the owners and this website are based in North Macedonia, and Macedonian data protection law applies to them. That law is closely modelled on European data protection rules, so the protections described below — lawful basis, transparency, your rights of access and erasure — will look familiar if you are used to the European framework.

2. Data collected automatically when you visit

Using this website is possible without providing any personal data of your own. As with every website, however, our hosting provider automatically records technical access data in server log files:

• the IP address of the requesting device,
• date and time of the request,
• the page or file requested,
• the referring page, where transmitted by your browser,
• browser type and version, and operating system.

This data is technically necessary to deliver the website and to keep it stable and secure. It is not merged with other data and is not used to identify individual visitors. We rely on our legitimate interest in providing our online offering securely and efficiently. Details of the provider are in section 5.1.

3. Enquiries and bookings

There is no contact form on this website. If you select dates in our calendar, that selection happens entirely in your browser — nothing is transmitted to us at that moment. Data only reaches us once you actively click through to WhatsApp or to Booking.com, or write to us by email.

When you do contact us, we process the details you provide — typically your name or WhatsApp display name, your phone number or email address, your travel dates and whatever you tell us about your stay — in order to answer your enquiry and, if you go on to book, to perform the accommodation contract. The processing is necessary for taking steps at your request before entering into that contract and for performing it; for enquiries that never lead to a booking we rely on our legitimate interest in answering you.

Retention: enquiries that do not lead to a booking are deleted once the matter is settled and it is clear that no further questions will arise, at the latest after six months. Where a booking is concluded, the associated records are kept for as long as commercial and tax law requires us to keep them, and are deleted thereafter. You may ask us to delete your enquiry earlier at any time (section 6).

What this policy covers. Everything described here is the data that reaches us through this website and through your enquiry. Your stay itself involves further data — in particular the details from your identity document, which we are required by law to record and to report to the authorities, and the details needed to settle payment and the tourist tax. We inform you about that separately when you arrive, and we will gladly send you that information beforehand if you ask.

4. Transfers abroad

Some of the technical service providers named in section 5 — our host, the mapping service and the analytics service — process data outside North Macedonia, in particular in the European Union and in the United States. Where that happens, it is because delivering the page, the map or the statistics is not technically possible otherwise, and in the case of the map and the statistics only after you have agreed.

We choose providers that contractually commit to recognised data protection safeguards, and we have concluded the corresponding data processing terms with them. We point out nonetheless that data protection standards outside North Macedonia differ, and that in the United States public authorities may in certain circumstances gain access to such data.

5. Services used on this website

5.1 Hosting (Netlify)

This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Netlify processes the access data described in section 2 on our behalf in order to deliver the pages, under a data processing agreement and on the basis described in section 4.

5.2 Fonts

The typefaces used here (Cormorant Garamond, Jost and Dancing Script) are downloaded once when the site is built and are then delivered from our own server together with the rest of the page. No connection to Google Fonts is established when you visit and no data is transmitted to Google for this purpose.

5.3 Interactive map (Mapbox)

On our “Insider Map” page we embed map material from Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA. The map is loaded only after you have agreed. Until then we show a note with a “Load map” button in its place, and no connection whatsoever is made to Mapbox — not even the program code for the map is downloaded.

Once you release the map — either with the switch in our cookie banner or with the button on the map page — your IP address is transmitted to Mapbox so that the map tiles can be delivered to your browser, together with technical information about the map section you are viewing. Mapbox may also store data locally in your browser in order to operate and cache the map. The legal basis is your consent, which you can withdraw at any time with effect for the future via “Cookie settings” in the footer. The map is embedded on the Insider Map page only — no other page of this website loads anything from Mapbox. Further information: mapbox.com/legal/privacy.

5.4 Cookies, local storage and your consent

We set no cookies of our own, use no advertising pixels and no social-media trackers.

The only cookies that can occur on this website are those of Google Analytics, and only if you have expressly agreed via our banner. Until then — and permanently if you decline — no script is loaded from Google and no cookie is set. The legal basis for storing this information on your device is your consent.

The banner asks about the two purposes separately, and nothing is pre-ticked: declining is a single click and is exactly as prominent as agreeing. Your answer itself is stored in your browser’s local storage under the key aj-cookie-consent-v2. This is not a cookie, is never transmitted to us, and exists solely so that we do not ask you again on every page. After twelve months we ask again. You can withdraw or change your decision at any time with effect for the future via “Cookie settings” in the footer; cookies already set are then deleted immediately. Clearing your browser storage has the same effect and simply means you will be asked again.

5.5 Web analytics (Google Analytics 4)

Subject to your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand which pages our guests find useful and how they reach us, so that we can improve the site.

For this purpose Google sets the cookies listed in section 5.4 and processes in particular a shortened IP address, the pages you view, the time and duration of your visit, the referring website, and general device and browser information. IP anonymisation is active. Advertising features, Google Signals and ad personalisation are switched off, so the data is not used for advertising or to recognise you across devices. The data is retained for a maximum of 14 months and is then deleted automatically.

The legal basis is exclusively your consent. Nothing is loaded before you agree, and you can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer — the cookies are then deleted. Withdrawal does not affect the lawfulness of processing carried out beforehand. Google may also process the data in the USA; see section 4. Where Google uses the data for its own purposes beyond the analysis it performs for us, it is itself responsible for that processing and we have no influence over it. Further information: policies.google.com/privacy. Independently of our banner you can also install Google’s opt-out browser add-on: tools.google.com/dlpage/gaoptout.

5.6 Links to other services

The following are ordinary links. Nothing is embedded in our pages and nothing is loaded from these services until you actively click. Once you do, the privacy policy of the respective provider applies:

• WhatsApp — our WhatsApp button opens the WhatsApp app or WhatsApp Web with a chat prepared for our number. Merely visiting our site transmits nothing to WhatsApp. When you write to us there, your phone number and the content of your messages are processed by WhatsApp Ireland Ltd. (a Meta company), which may involve a transfer to the USA. We have no influence over that processing. See whatsapp.com/legal/privacy-policy-eea. If you would rather avoid it, please email us instead.
• Booking.com — “Book” buttons link to our listing on Booking.com, with your selected dates appended to the address. Any booking made there is subject to Booking.com’s terms and privacy policy, and Booking.com acts as its own controller.
• Google Maps — “Directions” links open Google Maps in a new tab. No Google Maps content is embedded in our pages.
• Instagram — our profile link opens Instagram in a new tab. No feed or widget is embedded.
• Komoot — where a walking or cycling route is shown on our insider map, the pop-up links to the original tour on Komoot.

5.7 Availability calendar

The prices shown, and part of the occupied dates, are maintained by us by hand and are delivered as part of the page itself. The remaining occupied dates come from the calendars of our booking channels, such as Booking.com. So that these stay current, your browser makes one request to our own server while the calendar is being displayed, which answers with nothing but a list of dates. No request goes from your browser to a booking platform, and nothing about you is transmitted beyond the access data described in section 2. We retrieve the channel calendars ourselves, from our own server, and read only arrival and departure dates from them — never the names of other guests. The dates you select in the calendar stay in your browser, as described in section 3.

6. Your rights

Under the Law on Personal Data Protection you have the right, within the statutory limits, to:

• obtain information about the data stored about you,
• have inaccurate data rectified,
• have your data erased,
• have processing restricted,
• receive your data in a portable format, and
• object to processing based on our legitimate interests.

Where processing is based on your consent, you may withdraw it at any time with effect for the future — for analytics and the map, the “Cookie settings” link in the footer does exactly that. An informal message to the address in section 1 is enough to exercise any of these rights. Since this website itself collects no personal data beyond the server logs, there is in most cases nothing from your visit to disclose, correct or erase — a request will usually concern your enquiry or your stay.

Right to lodge a complaint. Without prejudice to any other remedy, you may lodge a complaint with the competent supervisory authority if you believe that your data is being processed unlawfully:

Agency for Personal Data Protection (Агенција за заштита на личните податоци)
Bul. Goce Delčev 18, 1000 Skopje, North Macedonia
azlp.mk

7. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” at the start of your browser’s address bar.

8. Objection to advertising emails

The use of contact details published in the legal notice to send unsolicited advertising and information material is hereby objected to. We expressly reserve the right to take legal action in the event of unsolicited advertising being sent, for example by spam email.

Last updated: August 2026

See also our legal notice.