Personal Data
PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA
The policy of ALVANI TOUR Ltd. aims to ensure compliance with the provisions of the Regulation.
ALVANI TOUR Ltd. collects and processes personal data lawfully, fairly, and in accordance with the principles and rights of natural persons in relation to the processing of their personal data.
ALVANI TOUR Ltd. processes personal data of natural persons only in the following cases:
the processing is necessary for compliance with a legal obligation of ALVANI TOUR Ltd.;
the processing is necessary for the performance of a contract (including an order) with ALVANI TOUR Ltd., to which the natural person is a party, or in order to take steps at the request of the natural person prior to entering into a contract, where identification is required;
the natural person has given their explicit consent for a clear and transparently defined purpose of ALVANI TOUR Ltd., for which the processing of their personal data is required;
the processing is necessary to protect the vital interests of the natural person whose personal data is processed or of another natural person;
the processing is necessary for the purposes of the legitimate interests of ALVANI TOUR Ltd. or of a third party, in accordance with the provisions of the Regulation;
other cases provided for in the Regulation.
ALVANI TOUR Ltd. does not collect or process personal data of natural persons that exceeds its legal obligations or its business needs.
In all cases where it is necessary to use collected and processed personal data for purposes other than the original ones, ALVANI TOUR Ltd. informs the respective natural persons, requests their consent, and processes their personal data for other purposes only after receiving their explicit consent.
ALVANI TOUR Ltd. collects and processes only the minimum necessary personal data of natural persons that:
is required by law;
is necessary for the performance of a contract;
is necessary for achieving the purposes for which it is collected.
ALVANI TOUR Ltd. ensures that the processing of personal data of natural persons is carried out with maximum accuracy and, where possible, always kept up to date.
ALVANI TOUR Ltd. ensures that access to and processing of personal data is performed by the minimum necessary number of persons (operators) who possess the required competence and commitment to protect such data.
DATA RETENTION PERIODS
ALVANI TOUR Ltd. stores personal data for the following periods:
Data from the register of accommodated tourists under Article 116 of the Tourism Act, including identification data and accommodation-related information – in accordance with the procedure and retention periods provided for in the Tourism Act and related secondary legislation.
Information related to requested and used hotel accommodation services, events, and restaurant services, including canceled hotel reservations (where related to refunds and/or retention of amounts due) – from the date of reservation/request up to 5 (five) years after the provision of the service / completion of the contract / cancellation of the reservation. Where services are provided under a long-term contract, the period starts from the final performance and/or termination of the contract.
Financial and accounting documents; invoices; authorization forms; and other information related to tax and social security control – up to 10 (ten) years, calculated from the beginning of the year following the year in which the obligation became due.
Unstructured communication, correspondence, complaints, reports, and similar materials – 5 years.
Video surveillance data – up to 1 week.
Data processed based on the explicit consent of the Data Subject – from the moment consent is given until it is withdrawn by the Data Subject.
Until a request for deletion is submitted by the natural person, where there are legal grounds for such a request.
The personal data specified in this Policy may be processed for a longer period than those stated above if this is necessary to achieve the purposes set out herein or to protect the rights and/or legitimate interests (including through legal proceedings) of ALVANI TOUR Ltd., or if applicable legislation provides for longer retention periods.
In all cases, ALVANI TOUR Ltd. ensures that at least once per year a review of the collected and processed personal data is carried out, and data falling within any of the above categories is deleted without undue delay.
RULES FOR THE PROCESSING OF PERSONAL DATA
Personal data is processed with appropriate levels and measures of protection
ALVANI TOUR Ltd. ensures the necessary physical, organizational, and technological protection measures, taking into account:
the nature, scope, context, and purpose of the processed personal data;
the likelihood and severity of risks to the rights and freedoms of natural persons in the event of a data breach;
its financial and organizational capabilities.
ALVANI TOUR Ltd. also ensures all necessary measures for timely recovery of collected and processed personal data in case of loss due to accidental, malicious, or force majeure events.
Personal data is processed with controlled and traceable access
ALVANI TOUR Ltd. provides appropriate technical, organizational, and technological measures for controlled and traceable access to personal data.
Personal data is processed with accountability for compliance with the Regulation
ALVANI TOUR Ltd. maintains the necessary accountability mechanisms and records to demonstrate compliance with the Regulation.
DATA SUBJECTS
In connection with the provided services, ALVANI TOUR Ltd. processes information relating to the following Data Subjects:
natural persons visiting the hotel website;
natural persons making reservations on their own behalf or on behalf of another natural or legal person via the Website;
natural persons using services provided by ALVANI TOUR Ltd., including but not limited to hotel accommodation, restaurant services, and event facilities, as well as natural persons representing or acting on behalf of legal entities using such services.
The services of ALVANI TOUR Ltd. may only be requested by legally capable persons who are 18 years of age or older.
RIGHTS OF DATA SUBJECTS
ALVANI TOUR Ltd. ensures compliance with the rights of natural persons whose personal data is processed, including:
the right to be informed about the processing of personal data;
the right of access to personal data;
the right to rectification of inaccurate personal data;
the right to erasure (“the right to be forgotten”);
the right to restriction of processing;
the right to be informed of actions taken following requests for rectification, erasure, or restriction;
the right to data portability;
the right to object to the processing of personal data;
the right not to be subject to automated decision-making, including profiling.
PROCESSED PERSONAL DATA
Personal Data Processed in the Capacity of Data Controller:
of employees;
of individual customers;
of individual suppliers.
PURPOSES OF PERSONAL DATA PROCESSING
As a Data Controller, ALVANI TOUR Ltd. performs the following activities and processes only the necessary personal data for the purposes of:
concluding, performing, and terminating employment contracts and calculating salaries and compensations;
accepting, administering, processing, and canceling reservations;
administering, fulfilling, and delivering purchases made via the Website;
administering and receiving payments for provided services, including remotely;
providing services to clients;
ensuring a personalized approach in service delivery based on users’ stated preferences;
concluding and performing contracts with individual suppliers;
direct marketing for sales purposes.
RECIPIENTS AND CATEGORIES OF RECIPIENTS
For the purposes listed above, ALVANI TOUR Ltd. provides personal data to the following recipients:
National Revenue Agency (NRA) – for payroll calculation;
National Social Security Institute (NSSI) – for employee benefits calculation;
Occupational health service providers – for maintaining employee health status and conducting periodic medical examinations;
General Labour Inspectorate, NSSI, and Ministry of Interior – in relation to workplace accidents;
Ministry of Interior – for providing information about hotel guests;
Other state and municipal authorities and/or institutions – in connection with statutory obligations or lawful requests for information containing personal data;
Subcontractors for the performance of contractual obligations.
VIDEO SURVEILLANCE AND SECURITY
In accordance with applicable legislation, ALVANI TOUR Ltd. implements security measures that include technical and organizational means for access control and physical security, including a video surveillance system operating 24/7 with recording and storage devices.
Video surveillance and recording may be carried out in publicly accessible areas and areas with restricted access. No video surveillance is conducted in guest rooms, sanitary facilities, rest areas, or similar premises. Video data is stored for a period of seven days.
Data Subjects and visitors are informed of the video surveillance through clearly visible information signs.
PROCESSING OF PERSONAL DATA FOR MARKETING PURPOSES
We collect and process personal data for marketing purposes in order to provide personalized offers, news, and promotions that may be of interest to you. This includes sending marketing communications via email, SMS, telephone calls, or other communication channels.
Categories of personal data may include:
First and last name
Email address
Telephone number
Legal basis:
Processing for marketing purposes is carried out based on your explicit consent. You have the right to withdraw your consent at any time by contacting us or using the unsubscribe option provided in each marketing message.
Data retention period:
Personal data will be stored until consent is withdrawn or until the expiration of the legally prescribed retention period.
Your rights:
You have the right to access, rectify, erase, restrict processing, object to processing, and request data portability. For more information, please contact us.
COMPANY CONTACT DETAILS
If you have questions regarding the processing of your personal data or wish to exercise your rights, you may contact us at:
Email: dachevasen@abv.bg
Phone: +359 887 624 578
Address: Bulgaria, Veliko Tarnovo, 4 “Deseti Fevruari” Street
COMPETENT SUPERVISORY AUTHORITY
Within the territory of the Republic of Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection.
If you believe that your rights regarding the protection of your personal data have been violated, you may file a complaint with:
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Email: kzld@cpdp.bg
Phone: +359 2 915 3518