Privacy policy

Who is responsible

The controller is Dimitar Mitev, the natural person identified on the Legal notice page. Privacy enquiries and requests should be sent to the email published there.

What we collect

Booking requests collect your name, email, telephone number, selected dates and accommodation, guest count and any notes you provide. Enquiries collect your contact details and message.

At check-in, guests provide the identification and registration data required by the Tourism Act and the applicable rules for the guest register and the Unified Tourist Information System (ESTI). Necessary billing details are collected when an invoice is requested. Please do not submit identity document copies or payment card details through the forms.

Use of the website involves processing technical data, including IP address, requested pages and browser information, to operate and secure the website.

Why we use it, and on what legal basis

• Handling requests, confirming bookings and providing accommodation: steps before entering into a contract and performance of a contract, Article 6(1)(b) GDPR.
• Maintaining the guest register and submitting required information to ESTI under Article 116 of the Bulgarian Tourism Act; accounting for tourist tax under the Local Taxes and Fees Act and maintaining records under the Accountancy Act: legal obligation, Article 6(1)(c) GDPR.
• Responding to general enquiries, protecting the website from abuse and establishing, exercising or defending legal claims: legitimate interests, Article 6(1)(f) GDPR.

Data needed for a booking and mandatory guest registration is required to provide accommodation. Without it, we may be unable to confirm a booking or check you in. Additional notes are optional. We do not use your personal data for advertising messages or profiling.

How long we keep it

Booking data is retained for the stay and up to five years afterwards to settle contractual matters and protect legal claims. Where a dispute is ongoing, relevant data is retained until it is resolved.

Accounting and tax documents are retained for the statutory period applicable to each document type. Under the Accountancy Act, accounting registers, financial statements and tax-control documents are retained for 10 years from 1 January of the following reporting period. Mandatory tourist registration data is retained in accordance with applicable statutory requirements.

Requests that do not result in a stay are deleted after 12 months; general enquiry correspondence is deleted 12 months after the conversation ends. Technical records are retained for limited periods according to their purpose and service settings; operational error records are retained for up to 90 days.

Who else sees it

Data is accessible to authorised persons handling your booking and to providers of cloud hosting, data storage, messaging, analytics and accounting services, to the extent necessary for their services. Where a provider acts as a processor, the relationship is governed by Article 28 GDPR.

Legally required data is provided to the Ministry of Tourism through ESTI, the relevant municipality, tax authorities and other competent authorities. Banks process payment data under their own legal obligations. The external mapping service receives data when you open the map, as described below.

Transfers outside the EU

Some information services may involve transferring personal data outside the European Economic Area, including to the United States. Such transfers are subject to a European Commission adequacy decision where it covers the recipient, or appropriate safeguards such as standard contractual clauses and any necessary supplementary measures.

You may request information about the applicable transfer mechanism and a copy of the relevant safeguards using the email address on the Legal notice page.

Cookies and what is stored on your device

The website uses a functional cookie to remember your language preference. It is not used for advertising tracking.

We use cookieless services for visitor statistics and website performance measurement. Booking-step events include the selected language but do not send names, email addresses, telephone numbers, messages, stay dates or the selected name.

The external map loads after you choose to open it. When it loads, the mapping provider receives your IP address and may use its own device storage under its privacy policy.

Your rights

Subject to Articles 15–22 GDPR, you have rights of access, rectification, erasure, restriction and data portability, and the right to object to processing based on legitimate interests. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Send requests to the email address on the Legal notice page. We respond without undue delay, normally within one month. Complex or numerous requests may require up to two additional months; we will notify you within the first month. We may request information to verify your identity where necessary.

Exercising your rights is generally free of charge. Statutory retention obligations and the protection of legal claims may limit erasure. Any refusal will include reasons and information about your options for challenging it.

Right to complain

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, cpdp.bg, or with the supervisory authority where you habitually reside, work or where the alleged infringement occurred. You do not need to contact us before lodging a complaint.

Changes to this policy

We update this policy and its revision date when our processing changes. Where necessary, we provide an additional notice of material changes.