Your privacy, in plain words.
We keep it simple: no cookies, no tracking, no forms. Here’s what we learn about you when you visit the site or book a tour with Boris, why, how long we keep it — and what you can ask us to do with it.
Draft for the client’s approval — the highlighted details are still to come.
In short
No tracking
No cookies of our own, no analytics, no forms. Content from Google, such as the map, follows Google’s own rules (section 3).
Only what a booking needs
Your name, number and messages on WhatsApp or the phone — used only to arrange and run your tour.
Never sold
We don’t sell your data or use it for advertising, and we share it only when a tour or the law requires it.
Your data, your call
Ask us anytime what we keep about you, to correct it or to delete it — one message is enough.
Who we are
The controller of your personal data is Cupara d.o.o., the company behind Montenegroni Boat Tours — a small local boat tour business from Tivat, run by skipper Boris Cupara.
- Company
- Cupara d.o.o. (Montenegroni Boat Tours)
- Registered office
- to follow
- Tax ID (PIB)
- to follow
- Meeting point
- Šetalište Kapetana Iva Vizina, 85320 Tivat, Montenegro
- WhatsApp & phone
- +382 69 183 544
- info@montenegroni.me (address being set up)
For anything about your personal data, write to us or call us — Boris answers personally, every day from 09:00 to 23:00.
Visiting the website
You can browse the whole site without telling us who you are. It has no user accounts, contact forms or newsletter, no analytics or advertising tools, and it sets no cookies of its own. Nor does it store anything in your browser: the local time in Tivat and the seat planner on the Our boats page work entirely on your device.
Like any website, the server that hosts it automatically receives technical data when you open a page — your IP address, the date and time, the page you asked for, your browser and device type — and records it in log files. We need this to deliver the pages and keep the site secure; the logs are kept only for a short time and then deleted. The legal basis is our legitimate interest in a working, secure website. The hosting company processes this data on our behalf and only on our instructions.
Content from other services
Some parts of our pages are loaded from other companies’ servers. Your browser then connects to them directly and sends them at least your IP address; what they do with it is governed by their own privacy policies:
- Google Fonts — the typefaces used on every page;
- Google Maps — the map of our meeting point on the home page and the Contact page, which loads as you scroll to it; Google may set its own cookies in the map;
- Unsplash and Pexels — for now, many of the photos on the site are served from these photo libraries.
Their privacy policies: Google, Unsplash, Pexels. The legal basis is our legitimate interest in showing the site properly.
Links to WhatsApp, Instagram, Google (reviews, directions) and OpenStreetMap take you to those services only when you click them — from then on, their own terms and privacy policies apply. We draw the charts of our routes ourselves from OpenStreetMap data, so looking at them sends nothing to OpenStreetMap.
Booking and questions
We take bookings only on WhatsApp or by phone. When you get in touch, we receive:
- your name and phone number, as WhatsApp shows them or as you tell us;
- what you write or tell us: the tour, the date, how many of you are coming, the ages of any children (for the right boat and life jackets), where you’re staying if you’d like a transfer, and your wishes;
- payment details: for a bank transfer, the payer’s name, account and the amount, as shown on our bank statement; for cash, the receipt we issue.
We use them to answer you, make you an offer, arrange and run your tour, and take care of payment and invoices. The legal bases are the steps you ask for before booking and the performance of our contract with you — and, for invoices and accounting, our legal obligations. Without these details we can’t arrange a tour.
If you choose to tell us about your health — that you get seasick or are pregnant, for example — we use it only to plan a safe and comfortable trip for you, with your consent, which you can withdraw at any time. Please don’t send us anything we don’t need.
WhatsApp is a service of Meta. Your messages are end-to-end encrypted, but WhatsApp itself processes your account data under its own terms and privacy policy. Rather not use WhatsApp? Just call us — we don’t record calls.
On the tour
If the maritime or other authorities require a list of the passengers on board, we record our guests’ names for that purpose only and keep the list for as long as the regulations require.
Boris is happy to take photos of you during the tour — for you. We publish photos in which you can be recognised, on our website or Instagram, only with your permission, and you can withdraw it at any time: we’ll take the photo down.
If you leave a review on Google, it’s published under Google’s terms. On our website we may quote short excerpts of public reviews with the reviewer’s first name and initial; ask us and we’ll remove yours.
Who we share it with
We never sell your data and we don’t use it for advertising. We share it only when your tour needs it or the law requires it:
- the skipper and crew who run your tour, if it isn’t Boris himself (on the larger boat, for example);
- the driver or partner who looks after your transfer, if you ask for one — your name, number, pick-up place and time;
- our bank and our accountant, for payments, invoices and the books;
- the company that hosts our website (section 2);
- state authorities — tax, maritime or police — when the law requires it.
Those who work for us — the hosting company and our accountant — may use your data only on our instructions and must keep it confidential.
Data outside Montenegro
WhatsApp (Meta), Google, Unsplash and Pexels are international companies with servers in the European Union, the United States and elsewhere, so data that passes through their services may be processed outside Montenegro — under their own terms and the safeguards they provide, such as the EU standard contractual clauses and the EU–U.S. Data Privacy Framework. We don’t send your data abroad ourselves for any other purpose.
How long we keep it
- Your WhatsApp messages
- Until your tour is over and any questions are settled — no longer than 12 months after the tour.
- Health details you shared
- Only until your tour is over.
- Invoices and payment records
- As long as Montenegrin accounting and tax laws require.
- Passenger lists
- As long as the regulations that require them say.
- Photos published with your permission
- Until you withdraw your permission.
- Server log files
- A short time, for security — then they are deleted automatically.
When a period ends, we delete the data or make it anonymous.
Your rights
You have the right to:
- find out whether we process your data, and get a copy of it;
- have incorrect data corrected and incomplete data completed;
- have your data deleted when we no longer need it or process it unlawfully;
- ask us to restrict processing, or object to processing based on our legitimate interest;
- receive the data you gave us in a common format, where the law provides for it;
- withdraw your consent at any time — this doesn’t affect what we did before.
Just send us a message on WhatsApp, call us or write to us (contacts in section 1). We may ask you to confirm who you are, and we’ll reply without undue delay — within 15 days at the latest. It costs you nothing.
If you think we’ve handled your data wrongly, please tell us first — we’ll put it right. You can also lodge a complaint with the supervisory authority, the Agency for Personal Data Protection and Free Access to Information (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama), Bulevar revolucije 11, 81000 Podgorica, www.azlp.me. If you live in the European Union, you can also turn to the data protection authority of your country.
How we protect it
We keep your data only where we need it — on our business phone and in our accounting records — protected by passwords and screen locks, and only those who run your tour or keep our books can see it. WhatsApp messages are end-to-end encrypted, and the website is served over an encrypted connection (HTTPS).
Children
Our website isn’t meant for children, and we don’t knowingly collect data from them. When a family books, a parent or guardian tells us the children’s ages, so that we can prepare the right life jackets.
Changes and the law
We follow the Montenegrin Law on Personal Data Protection (Official Gazette of Montenegro 133/2026, which applies from 19 March 2027; until then the Law of 2008, Official Gazette 79/08, 70/09, 44/12 and 22/17) and, where it applies to guests from the European Union, the EU General Data Protection Regulation (GDPR).
If something changes — a new service on the site, for example — we’ll update this page and the date at the top. The version published here is always the current one.