The Excellence Platform is a five-day culinary programme at San Canzian, Istria, created with École Ducasse. We treat applicants’ data with the same care we bring to the programme.
This policy explains what personal data we process when you visit this website or apply through the application form, why we process it, who we share it with and what rights you have under the EU General Data Protection Regulation (GDPR) and Croatian law. How we use cookies is explained in more detail in our Cookie Policy (opens in a new tab).
Who we are
The controller responsible for your personal data is:
Sileo Resorts d.o.o.
Ulica kneza Branimira 41/1, Zagreb, Croatia
OIB: 42460248495
Email: gdpr@san-canzian.hr
Sileo Resorts d.o.o. also operates San Canzian Hotel & Residences in Buje, Istria. In this policy “we”, “us” and “our” mean that company. You can reach our Data Protection Officer at gdpr@san-canzian.hr.
The data we collect
Information you give us in the application form
- First and last name, email address, phone number and country.
- Your current professional role and your restaurant, hotel or company.
- Dietary requirements, food allergies or intolerances you choose to tell us about. Allergy and intolerance information can count as health data, a special category under the GDPR.
- Your confirmations in the form, such as acceptance of the Terms and Conditions and any consent to hear from us about future editions.
If you are selected, we will also process the information needed to register you, take payment, issue invoices and your certificate of attendance.
Information collected automatically
- Technical data sent by every browser: IP address, browser and device type, the page requested and the referring page. Our hosting provider processes this to deliver the site and protect it from abuse.
- Analytics data, only if you allow analytics cookies: pages viewed, time on site, approximate location derived from your IP address, the device used and how you reached us.
- Advertising data, only if you allow advertising cookies: cookie identifiers, ad click identifiers (such as Google’s
gclidor Meta’sfbclid), the fact that you submitted an application, and a hashed version of the email and phone number you entered (see section 04).
Information from others
Google and Meta give us aggregated reports on how our adverts perform. These reports do not identify you. We do not buy personal data from third parties.
Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Reviewing your application, selecting participants and contacting you about it | Application form data | Steps you asked us to take before entering into a contract, Art. 6(1)(b) |
| Registering selected participants, running the programme, payment, certificate | Form data, registration and payment details | Performance of a contract, Art. 6(1)(b) |
| Catering safely for allergies, intolerances and dietary needs | Dietary and allergy information | Your explicit consent, Art. 9(2)(a), given in the form; you can withdraw it at any time |
| Accounting and tax records | Invoice and payment data | Legal obligation, Art. 6(1)(c) |
| News about future editions and related programmes | Name, email | Your consent, Art. 6(1)(a); every email has an unsubscribe link |
| Delivering the website securely, preventing spam and abuse of the form | Technical data, strictly necessary cookies | Legitimate interest in a secure, working website, Art. 6(1)(f) |
| Measuring how the site is used (Google Analytics 4) | Analytics data | Your consent, Art. 6(1)(a), and the Croatian Electronic Communications Act |
| Measuring and personalising our adverts on Google and Meta, including matching applications to adverts | Advertising data, hashed email and phone | Your consent, Art. 6(1)(a), and the Croatian Electronic Communications Act |
| Aggregated, cookieless measurement when you decline cookies (see below) | Cookieless signals without identifiers | Legitimate interest in understanding, in aggregate, whether our advertising works, Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | Data relevant to the claim | Legitimate interest, Art. 6(1)(f) |
If you decline cookies. We use Google Consent Mode. When you decline, Google’s tags do not store or read cookies on your device. They may still send Google limited signals, such as that a page was viewed or an application was submitted, together with technical information your browser always sends (for example the time, the browser type and the page address). These signals contain no cookie or advertising identifier. Google uses them to estimate, in aggregate, how many conversions our campaigns produce. You can object to this at any time by contacting us.
Advertising on Google and Meta
We advertise the programme on Google (Search, YouTube and partner sites) and on Meta (Facebook and Instagram). If you allow advertising cookies, we use the Google Ads tag and the Meta Pixel to:
- measure which adverts lead people to the site and to submit an application;
- build audiences, for example people who visited the site, so we can show them relevant adverts later, or exclude people who have already applied;
- improve the accuracy of our measurement by matching an application to an advert using your email address and phone number (Google “enhanced conversions” and Meta “advanced matching”).
How matching works. When you submit the application form, your email address and phone number are converted in your browser into a one-way code (a SHA-256 hash) before they are sent to Google and Meta. The platforms compare that code with the codes of their own users to attribute the application to an advert, and they do not use it to contact you. This happens only if you have allowed advertising cookies.
Roles. For data collected with the Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers for the collection and transmission of the data to Meta, under Meta’s Controller Addendum. Meta is responsible on its own for what it does with the data afterwards. Google Ireland Limited processes Google Analytics data on our behalf. For advertising purposes Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. You can read how these companies use data in the Google Privacy Policy (opens in a new tab) and the Meta Privacy Policy (opens in a new tab).
You can change your choice at any time in . You can also manage ad personalisation in your Google My Ad Center (opens in a new tab) and Meta ad preferences (opens in a new tab).
Who receives your data
We share personal data only where needed for the purposes above:
- HubSpot Ireland Limited: provides the application form and our contact database (CRM). Our HubSpot account stores data in HubSpot’s EU data centre.
- Cloudflare, Inc.: hosts the website and protects it from attacks.
- Google Ireland Limited: Google Tag Manager, Google Analytics 4, Google Ads and, if active on the form, Google reCAPTCHA spam protection.
- Meta Platforms Ireland Limited: the Meta Pixel, used for advertising on Facebook and Instagram.
- Our bank and payment service providers, our accountants and legal advisers, under a duty of confidentiality.
- Public authorities, where the law requires us to share data.
Service providers that act on our behalf (processors) may use the data only on our instructions and under a data processing agreement. We do not sell personal data.
Transfers outside the EEA
Google, Meta, HubSpot and Cloudflare are part of groups headquartered in the United States, and data may be accessed from or transferred to the US. These companies are certified under the EU–U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection (decision of 10 July 2023). Where a transfer is not covered by that framework, it is protected by the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.
How long we keep it
| Data | Kept for |
|---|---|
| Applications that are not selected | 12 months after the selection decision, then deleted, unless you agree that we may keep your application for a future edition |
| Participant records | For the programme and up to 5 years afterwards, so we can confirm attendance and handle any claims |
| Dietary and allergy information | Deleted within 30 days after the programme ends |
| Invoices and accounting documents | 11 years, as required by the Croatian Accounting Act |
| Marketing consent and email preferences | Until you withdraw consent or unsubscribe, plus a record of the withdrawal |
| Google Analytics data | 14 months, then deleted automatically |
| Cookies | See the durations in our Cookie Policy (opens in a new tab) |
Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased where there is no longer a reason to keep it;
- restrict how we use your data in certain cases;
- receive data you gave us in a portable format (portability);
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting processing that took place before. For cookies, use ; for emails, use the unsubscribe link.
To use any of these rights, email gdpr@san-canzian.hr. We reply within one month, and may ask you to confirm your identity first.
You also have the right to lodge a complaint with the Croatian supervisory authority, the Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr (opens in a new tab), or with the authority in the EU country where you live or work.
Required information and decisions
Fields marked as required in the application form are needed to assess your application. Without them we cannot consider it. Everything else, including all non-essential cookies, is optional.
Participants are selected by people, not by automated decision-making. Google and Meta use automated systems to decide which adverts to show, based on data they hold and, where you allow it, data from this site.
Security
The site is served only over encrypted connections (HTTPS). Access to application data is limited to the people who need it to run the selection and the programme, and our providers are bound by confidentiality and security obligations.
Age
The programme is for working professionals and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes to this policy
We will update this policy when our practices or the law change, and show the new date at the top. If a change affects how we use data you have already given us, we will tell you before it takes effect.
Questions? Write to gdpr@san-canzian.hr.