Privacy policy

Who we are

The controller of the personal data described here is „ВИРЖИНИЯ ТУРС“ ЕООД, UIC (ЕИК) 204050426, registered office and address of management: 11 Angel Karaliychev St., 5000 Veliko Tarnovo, Bulgaria. The company runs the Chiflik Hills & SPA family hotel and the website https://chiflikhills.com (below, "the hotel" or "we").

Contact us about anything to do with personal data: hotel@chiflikhills.com, phone +359 884 615 302, or at the hotel's address: 3 Kalchevska Street, Chiflik, Troyan municipality, Bulgaria.

[to follow: whether a data protection officer is appointed, after the lawyer's review]

When you book a stay

What: your name, email, phone and country, the note you may add, the dates, the number of adults, children and infants, the names of the guests in the other rooms or apartments if you book more than one, the bed preference, the payment method and its status, and the language of the booking.

Why: to make and carry out the contract for your stay: to hold the room or apartment, take the deposit, send you the confirmation, the transfer details and the reminders, welcome you, and handle a cancellation if you cancel.

Legal basis: carrying out the contract and the steps before it at your request (Article 6(1)(b) of the General Data Protection Regulation, GDPR). We keep the accounting records of payments because the law requires it (Article 6(1)(c)).

If you give us the names of other guests or details of children (how many and their ages, so we can find the right accommodation and bed), please let them know you are giving them to us for this booking.

When you write to us

The contact form and the holiday-package enquiry collect your name, email, phone (optional) and message, and for an enquiry also the dates and the number of guests. We use them only to reply to you. You also receive a short confirmation by email.

Legal basis: the steps before a contract at your request when you ask about a stay (Article 6(1)(b) GDPR), and our legitimate interest in answering the questions you ask us (Article 6(1)(f)).

Keeping the site safe

So that no one can hold rooms or apartments without paying or send many messages, we keep a coded trace of the internet connection (irreversibly converted, never the IP address itself) when you book and when you send a form. Our host and the site's security plug-in keep technical logs (IP address, time, page requested, browser, log-in attempts) to detect and stop attacks.

Legal basis: our legitimate interest in protecting the site, our guests and the hotel from abuse (Article 6(1)(f) GDPR).

Cookies

The site uses no cookies for analytics or advertising and loads nothing from other companies. What it stores in your browser, and how to change your choice: Cookie policy.

Who has access to the data

• The hotel's staff (reception and management), only as far as their work needs, each with their own account.
• Our host, SuperHosting.BG, whose servers run the site and the email, as a processor on our behalf.
• The card payment provider ([to follow: the card payment provider]) when you pay by card: you enter your card details on its secure page, and they never reach the hotel; from us it receives the email you gave, the amount and the booking reference. For some activities (fraud prevention, for example) it is a controller in its own right, under its own policy.
• Booking.com: we exchange with it only the occupied dates of each room, so nothing is double-booked. We send it no guest data. If you book through Booking.com, Booking.com also handles your data under its own policy.
• Public authorities, when the law requires us to.

We do not sell data and do not use it for advertising.

Transfers outside the EU

We do not transfer personal data outside the European Union and the European Economic Area. The card payment provider may transfer data to its affiliated companies outside them (in the USA, for example); it does so under the safeguards of Chapter V of the GDPR (a European Commission adequacy decision or standard contractual clauses), described in its own privacy policy.

How long we keep the data

• Bookings: the guest's personal data (name, contacts, notes, the other guests' names) for 5 years after check-out, then it is erased. We keep the accounting records of payments (booking reference, dates, amounts) for as long as the Accounting Act requires.
• Unpaid bookings (expired or cancelled without payment): 6 months.
• The coded trace of the connection for a booking: 90 days; for a form: with the message, and the counters against repeated sending for up to 8 days.
• Messages and enquiries: 2 years from sending.
• The receipts of cookie choices: 1 year.
• The backups we take when the site is updated are deleted within 30 days of a successful update; our host keeps its own copies under our contract with it.

Your rights

You have the right to ask for:

• access to your data and a copy of it (Article 15 GDPR);
• correction of inaccurate data (Article 16);
• erasure (Article 17), except for data the law requires us to keep, such as accounting records;
• restriction of processing (Article 18);
• your data in a machine-readable form (Article 20);
• to object to processing based on legitimate interest (Article 21);
• to withdraw a consent you gave, without affecting the lawfulness of the processing before you withdrew it (Article 7(3)), for example the consent to optional cookies.

How: write to hotel@chiflikhills.com or tell reception. We reply within one month (Article 12(3) GDPR), free of charge. We may ask you to confirm that the request is yours, for example from the email you booked with.

Right to complain

If you think we handle your data unlawfully, you can complain to the Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; kzld@cpdp.bg; cpdp.bg. It helps if you write to us first: often we can sort it out straight away.

No automated decisions

We make no decisions based solely on automated processing, including profiling, that have legal effects on you or affect you significantly (Article 22 GDPR). The only automatic step is that an unpaid booking expires after the payment deadline you were shown when you booked.

How we protect the data

The site works only over a secure connection (HTTPS). Your card details never pass through our server. Staff log in with their own accounts, with rights only for their work, and their actions are recorded. The network data kept against abuse is stored only in coded form. Backups cannot be reached from the internet. The links to your booking in our emails work only for a while after your stay, so an old or forwarded email cannot show your details.

Children

The site is not meant for people under 18, and we do not knowingly collect data from them. We receive details of children (how many and their ages) only from the adult who books.

Changes

When we change this policy, we update it on this page and change the date at its top.