Privacy

1. Who we are

Data controller: Izvorat Arda Ltd (ЕИК 207760666, VAT BG207760666). Registered office: 26 Dicho Petrov St, Smolyan, Smolyan region. Tourist establishment: Hotel Izvorat Arda — a family hotel, 2 stars, village of Arda, Smolyan municipality. Tourism register ID (UIN): СЛ-ИЛК-2ШФ-1Б. Phone: 0882319999. Email: [email protected]. Website: https://izvoratarda.com.

The supervisory authority in Bulgaria is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, www.cpdp.bg.

2. Who this policy covers

We process the personal data of:

• visitors to the website izvoratarda.com;
• people who submit a booking request through the website, by phone or by email — for themselves or for others;
• guests who stay at the hotel and use its services;
• people who contact us with an enquiry, request, report or other correspondence.

The hotel’s services may be requested by persons aged 18 or over.

3. What personal data we process

On check-in (legal requirement). The Tourism Act requires us to register every guest in the Unified Tourist Information System (ESTI). For this purpose we process: first and last name; date of birth; sex; nationality; national identification number (ЕГН for Bulgarian citizens) or date of birth; type, number and issuer of the identity document.

Contact and booking data. Phone and email; arrival and departure dates, number of nights, number of guests, room type and number, special requests, use of a tourist package.

Financial data. Method of payment (cash, bank transfer, partner platform) and information about amounts due and paid. The hotel does not accept card payments through the website and does not store bank card numbers or CVC codes.

On a website request. We process the name, email, phone and desired-stay details you provide, together with technical data accompanying the submission — IP address and browser type — for security and to protect the form against abuse.

Correspondence. The information you yourself include in enquiries, requests, reports or complaints to us.

Video surveillance

The common areas of the hotel — entrances, reception, corridors and other publicly accessible zones — are covered by video surveillance for security and the protection of property and of the life and health of individuals. Monitored areas are marked with information signs at the entrance. The hotel does not process health data.

The legal basis is a legal obligation — the surveillance is required by an act of a competent state authority — as well as the hotel’s legitimate interest in security. Recordings are kept for 30 days and then automatically deleted, unless they are needed to investigate a specific incident. Only authorised persons have access to the recordings; disclosure to third parties is made only to competent authorities in the manner established by law.

4. Purposes and legal bases

• Performance of a contract — accepting and confirming bookings, accommodation and servicing the stay.
• Legal obligation — ESTI registration, tourist tax, accounting and tax requirements.
• Legitimate interest — security of the website and the premises, prevention of abuse, service improvement.
• Consent — marketing messages, only if you have expressly agreed; consent may be withdrawn at any time.

5. Whom we disclose data to

We do not sell or rent your personal data. We disclose it only where necessary and in the cases provided by law:

• to the Unified Tourist Information System (ESTI) at the Ministry of Tourism — as required by law;
• to competent state authorities — where we are legally obliged;
• to our accountant — for accounting and tax purposes;
• to Cloudflare — the network provider through which the site operates, which processes technical data (including IP address) for security and content delivery;
• where you booked through an external platform (e.g. Booking.com), we exchange with it the data needed for your booking.

6. Where data is stored

The hotel’s data is stored on its own server infrastructure located in the European Union. The hotel’s email is likewise served from its own infrastructure. When Cloudflare is used, technical data may be processed outside the EU under safeguards compliant with the GDPR.

7. How long we keep data

• Accommodation data registered in the Guest Register (ESTI) — 10 years. This period is set by law; during it the data is kept on the basis of the controller’s legal obligation and the guest’s consent is not required.
• Accounting and tax documents — 10 years, as required by law.
• Website requests that led to a booking — 24 months (this concerns the request itself; the accommodation and payment data are kept under the periods above).
• Requests that did not lead to a booking, and form submission attempts — 12 months, after which they are automatically deleted.
• Video surveillance recordings — 30 days, after which they are automatically deleted, unless needed to investigate a specific incident.
• Technical logs — for a short period needed for security and diagnostics.
• Database backups — up to 30 days; used solely for disaster recovery. Data deleted from the live system may persist briefly in these backups until the backup cycle replaces them; on restoring a backup, the deletions are applied again.

Deletion of a guest’s data is carried out by anonymisation, whereby the accounting and statistical history is retained without a link to a specific person.

8. Your rights

• access to your personal data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure (“the right to be forgotten”) in the cases provided by law;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interest;
• withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal;
• not to be subject to a decision based solely on automated processing.

The right to erasure is not unlimited: where the law obliges us to keep certain data for a set period — as is the case with the data submitted to the Guest Register (ESTI) and with accounting documents — we are obliged to refuse its erasure until that period (10 years) expires. Your other rights remain in force for that data as well.

To exercise your rights, contact us at [email protected]. You also have the right to lodge a complaint with the CPDP.

9. Data security

We apply technical and organisational measures against loss and unauthorised access — encrypted connections, access control, restriction of access to authorised persons only, and regular backups. The measures apply both to data on electronic media and on paper.

10. Changes to this policy

We reserve the right to update this policy. The current version is always the one published on our website.