Privacy Notice

This document constitutes a privacy notice within the meaning of the General Data Protection Regulation (GDPR). It is prepared especially for the guests of Park Hotel Pirin (hereinafter referred to as “the Hotel (s)” or the Administrator (s)). Below you will find information:

• about the controller who processes your personal data;
• what categories of personal data we process;
• under what conditions we process the data;
• the purposes and legal grounds for the processing;
• storage periods and data security measures;
• how to exercise your rights under the General Data Protection Regulation;
• as well as in which cases and in what order we provide your personal data to third parties.

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

Responsibility for the processing of your data, as the administrator of personal data, lies “Pirin Sharlopov Hotels” Ltd., owner of Park Hotel Pirin, with registration in the Commercial Register, kept by the Registry Agency with EIC: 101152503 and registered office in Pirin. Sandanski 2800,
District “Hydrostroy” 27, tel: 0746 35 600, e-mail address marketing @parkhotelpirin.com.

In the event that you wish to access, correct or delete the data collected about you, suspect that it has been accessed unlawfully, wish to object or withdraw your consent to processing, or if you have questions and comments related to this Notice, you can contact both the company and the hotel at the addresses indicated above, with the designated Data Protection Officer “Amatas” EAD at the address: Gr. Sofia, blvd. “Tsarigradsko shose” 141, tel: +359 899 911911 and e-mail: dpo@amatas.eu

WHAT INFORMATION DO WE COLLECT ABOUT YOU?

In the context of our activities, it is normal and necessary to collect and process information about our guests. The information is collected directly from our guests and relates in particular to:

• Your identification data by identity document — names, personal identification number, date of birth, gender, nationality, number, validity and country of issue of personal identity document;
• Contact details - e-mail address, address, telephone;
• Video image, insofar as video surveillance activities are carried out in certain places on the territory of the Hotel, which is indicated by the corresponding information plates and signs.

WHY DO WE COLLECT YOUR DATA?

The main reason we collect your personal data is to be able to provide you with a quality service by identifying you in order to:

• fulfillment of commitments made to you — as our guests, related to the reservation and your stay on the territory of the Hotel;
• fulfillment of legal requirements for accounting of services provided;
• making a complaint or complaint about our services;
• to ensure your safety, the security of our employees and hotel equipment;
• if you give your consent, your data may also be used to provide information about promotions and other interesting information related to our services.

ON WHAT LEGAL BASIS DO WE PROCESS YOUR DATA?

The hotel only processes personal data on a valid legal basis. The legal basis for processing your data is the fulfillment of the commitments made to you under the contract for hotel services to which you are a party, mainly to identify you as a guest on the territory of the Hotel. Like any trader, we process your personal data for the accounting of the services we provide you, referring to the Law on Accounting and the Tax and Insurance Procedure Code.

Furthermore, data processing is also necessary to protect your rights as a user when submitting a complaint or complaint in connection with our services.

Thirdly, as guests of the Hotel, we are obliged to collect certain categories of personal data, which we provide to the Ministry of Interior by virtue of the obligation imposed on us by the Law on Civil Registration.

Video surveillance in the Hotel is carried out for security purposes based on our legitimate interest to protect the security of the object, the hotel equipment in it, our employees, as well as your own security. The same is done only in the publicly accessible places marked with the appropriate signs. In order to ensure your peace of mind as much as possible, we inform you that video surveillance is not carried out in any way in the guest rooms, toilets and rest and recreation rooms.

The implementation of the forms of processing related to direct marketing requires your explicit consent to be informed by email, call and/or short messages about discounts, promotions, raffles and other marketing activities. Consent for this purpose may be withdrawn at any time.

WHAT MEASURES DO WE TAKE TO PROTECT THE COLLECTED DATA?

The protection and security of your data is important to us because we want to keep your trust. To prevent loss, misuse or unauthorized access, we apply all reasonable measures and remedies. However, in case of suspicion of a breach, we ask you to contact us or the Data Protection Officer immediately using the contact details provided.

FOR WHAT PERIOD DO WE STORE YOUR DATA?

The data related to your stay on the territory of the Hotel are stored for a period not longer than necessary, and in any case for no more than three years, taking into account the statutory periods within the meaning of tax legislation. Video recordings in the Hotel are stored for a period not longer than 2 months, by analogy with the Private Security Act. The data processed for the purposes of direct marketing, based on the express consent of the customer, are stored until the withdrawal of consent, but not more than two years after they have been provided, unless you have renewed your consent to receive marketing information.

WHAT RIGHTS DO YOU HAVE WHEN PROCESSING YOUR DATA?

The General Data Protection Regulation provides for a number of options for the protection of individuals with regard to the collection and processing of data, in particular:

• right of access and information about the processing of your data;
• the right to object to processing where the data are processed on the basis of the legitimate interest of the company;
• the right to withdraw your consent to the processing of data where the data is processed solely on the basis of your explicit consent;
• the right to portability of the data processed on the basis of your explicit consent or contract, and depending on your instructions, we will provide you with a copy of the same or automatically transfer it to another organization;
• the right to rectification in the event that the data we hold about you is not accurate;
• the right to request “be forgotten” when the data is processed on the basis of your consent or the processing is initially unlawful.
• the right to lodge a complaint with a supervisory authority (see more below).

TO WHOM CAN WE PROVIDE YOUR DATA?

In order to provide our services, ensure security in the Hotel and receive up-to-date information, we may provide your data to third parties, as well as to the following persons for the following purposes:

• other hotels of the Charlopov Group, where necessary and permissible by law;

• competent tax and other state authorities at the time of inspection, the authorities competent to detect and investigate crimes, as well as the bodies of the Judiciary;
• partners of the Hotel (e.g. tour operators, accountants, external archive company or litigation lawyers) in connection with the performance of the contract under which we provide services to you;
• in the event of a merger or merger, your data may be shared with the new owner (s), in their capacity as legal successors, of which you will be notified.

In any case, your data will not be shared with third parties established outside the EEA (EU, Norway, Iceland and Liechtenstein), unless expressly permitted by local law and adequate safeguards and mechanisms are in place.

HOW CAN YOU LODGE A COMPLAINT WITH THE COMPETENT SUPERVISORY AUTHORITY?

Notwithstanding the above, you have the right to lodge a complaint with the supervisory authority - the Commission for Personal Data Protection (CPDP):

• personally, at the address: gr. Sofia, blvd. “Prof. Tsvetan Lazarov” № 2;
• by letter,at the address: Gr. Sofia, apartment building 1592, blvd. “Prof. Tsvetan Lazarov” № 2;
• to the CPDP email- kzld@cpdp.bgIn this case, your complaint must be formed as an electronic document signed with a qualified electronic signature (not scanned!). ;
• through the CPDP websiteat: https://www.cpdp.bg/In this case, your complaint must be formed as an electronic document signed with a qualified electronic signature.

In view of the requirements of the legislation, the above information may be changed by the controller. For questions and up-to-date information about the processing of your data, you can contact us through the specified contact details.

‍