Privacy notice

Who processes the data

The data controller is the trader in the identity block below. GDPR questions, access or erasure: the same e-mail, subject "GDPR".

What data, and why

Booking (contract): name, e-mail, phone, stay dates, guest count. Without them there is no contract.

ЕСТИ register (legal duty, art. 116 Tourism Act): at check-in, per guest — full name, date of birth, nationality, ID type and number, arrival and departure. Entered in the Ministry of Tourism system.

Invoicing and taxes (legal duty): billing details, payment history. Accounting is kept 10 years.

Card: the card number goes straight to Stripe; we see the last 4 digits and the result.

Technical logs (legitimate interest): IP, requested pages, errors — security and uptime, 30 days.

Marketing (consent): only if you accept statistics and marketing cookies. Withdrawable at any time.

Who we share with

Stripe (payments), our EU hosting provider, the mail service, our accountant, and — for guests — the municipality and the ЕСТИ system where the law requires it. We do not sell data and do not hand it to ad networks beyond the cookies you accepted.

Processors work under a data-processing agreement (GDPR art. 28). Transfers outside the EEA: covered by standard contractual clauses.

Your rights

You have the right to access, rectification, erasure, restriction, portability, objection and withdrawal of consent. We answer within 30 days at the address in the identity block.

Complaint: Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, cpdp.bg. Write to us first — it usually resolves faster.