Personal data processing policy

Information about the controller of personal data

Purpose of processing

Categories of personal data

The following categories of data are processed for each guest:

First name, last name and last name
Social security number / date of birth / personal number of a foreigner
Nationality
ID card / passport number
Date of arrival and departure

Legal basis

The processing is carried out on the basis of Art. 6, para. 1, b. "c" of Regulation (EU) 2016/679 (GDPR) - fulfillment of a legal obligation of the controller.

Storage period

Personal data are stored for a period necessary to fulfill the obligations under Art. 116 of the Law on Tourism and the by-laws related to keeping a register of accommodated tourists. When the data is submitted to the Unified Tourist Information System (USTI), it is stored according to the Ordinance on the order and manner of conducting the USTI, which provides for the storage of the information for a period of up to 10 years. When keeping a local (paper or electronic) register, the data is stored only for the time necessary to fulfill legal obligations, after which it is destroyed or anonymized, in accordance with Regulation (EU) 2016/679 (GDPR) and the principle of storage limitation.

Recipients of the data

The following have access to the data:

The administrator and persons authorized by him
Competent state authorities - only if required by law

Data security

The administrator takes appropriate technical and organizational measures to protect personal data - limited access to the system, password protection, anti-virus software, backup copies, etc.

Rights of data subjects

Each guest has the right to:

Receive processing information
request access, correction or deletion of the data, if this does not conflict with the legal storage obligation
Filed a complaint with the Commission for the Protection of Personal Data (PCPD)

CPDP contacts: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2 Website: www.cpdp.bg

Automated processing

No automated decision-making, including profiling, takes place.