Privacy Policy

1. General Information

This policy describes how we process your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian law.

2. Categories of Personal Data

• Name, email, phone, passport, ID card;
• Payment data (via payment service providers);
• Order and reservation history;
• Website usage information (cookies, analytics).

3. Purposes of Processing

• To provide services and access to reservations;
• To submit data to ESTI (Ministry of Tourism), in accordance with the Tourism Act;
• To issue invoices and financial documents;
• To send important communications and marketing (only with given consent);
• To improve our services and content.

4. Legal Basis for Processing

The processing of personal data is carried out on the following grounds under Article 6 of the GDPR:

• Contract performance — for reservations, accommodation and related services;
• Legal obligation — to comply with obligations under the Tourism Act and tax legislation (incl. submission of data to ESTI and retention for accounting purposes);
• Legitimate interest — to ensure the security of services, prevent abuse and maintain the platform;
• Consent — to receive marketing communications and newsletters.

5. Storage and Security

• Data is stored in a secure environment with restricted access.
• We apply technical and organizational security measures.
• Data related to reservations and payments is retained for up to 5 years, in accordance with accounting and tax requirements.
• Data for ESTI registration is retained for the period specified by the Tourism Act.

6. Data Subject Rights

You have the right to:

• access your personal data;
• rectification of inaccurate or incomplete data;
• erasure (the “right to be forgotten”) under applicable conditions;
• restriction of processing;
• objection to processing;
• data portability to another controller.

7. Third Parties

Your data may be provided only to partners necessary for the functioning of the service:

• payment operators;
• hosting and IT providers;
• public authorities (Ministry of Tourism, NRA, etc.), where required by law.

8. Right to Complain

If you believe that your rights have been violated, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) – Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg.

9. Contact

For questions regarding personal data, you can contact us at: office@booklazy.org