Luxury Villa Borina, located in the villa zone Yarema, Sofia Region, is managed by the company “Borina” Limited, with UIC:206127775, with registered office and address of management Sofia, PC 1618, Reg. Vitosha, “Ivan Susanin” str. 26A, 4th floor, appartement 13 ("the Company", "We", "Us") a company which is focused on the provision of tourist accommodation services and management of tourist sites. The Company is also responsible for the maintenance of the website https://luxury-villa-borina.com/ and all its contents, having exclusive rights over the published pictures, graphics and contents.

In carrying out our activities, the protection of your data and your privacy are a top priority for us, and therefore we strive to process them in minimization of the data to the necessary minimum and in limiting deadlines for their storage, by applying appropriate technical and organizational measures for their security. We value the privacy of your life and health and the confidentiality of your data.

The following privacy policy is intended to provide you with general information on how and what types of personal data we process (respectively we collect from and for you), why we need them, to whom they can be provided or disclosed and for how long it will be stored.

Contents:

1. Personal data administrator.
2. What types of personal data does the Company process?
3. How does the Company collect and process your personal data?
4. Who will have access to your personal data?
5. Where will your personal data be processed?
6. What are your rights in relation to your personal data?
7. How long does the Company store your personal data?
8. How can you contact the Company?
9. When is this Policy updated?

1. Personal Data Administrator

"Personal Data Administrator" is a person who alone or jointly with another person determines the purposes for which personal data will be processed (collected, used and stored) on paper or in electronic form.

The Company will act as an administrator of your personal data when there is a reason for its processing, for example in connection with your reservation or stay with us; execution of your requests, applications and complaints to us or related to our activity; the execution of contracts with us to which you are party or you are a representative of a party or which are basis of your rights; the implementation of or protection against your claims against the Company; implementation of other legal/legitimate interests of the Company.

In certain cases the Company may process your personal data as a joint administrator with other administrators, which also process your data on a legal basis.

2. What types of personal data does the Company process?

For the purposes of our accommodation activity, we process, for example, your full name, personal identification number or date of birth, place of birth, ID document’s data, arrival date, departure date, companions, phone number, email (in case of email communication with you).

Please consider that processing of your identification data is mainly because of the statutory obligations of the Company to identify the tourists and to keep records of them.

If the Company only communicates with you, the following data will be processed: your name, your email address, your phone number, your IP address, signature (perhaps, in case of written communication).

The general rule is that the types of data, which the Company processes, depend on our relations and the purposes the Company is aiming to achieve. Due to this reason, the types of processed data always vary but it’s under the Company’s control and in consideration of lawfulness and minimization of processing of personal data.

It is important to inform you that where the Company processes your personal data in connection with the performance of a contract to which you or the legal entity represented by you is a party or in connection to a request initiated by your side, there is a separate ground for processing of your personal data. Therefore, we have the right to process the above- mentioned personal data without your explicit written consent to processing.

The company does not collect and use personal data, revealing racial or ethnic origin, religious or philosophical beliefs or trade-union membership, and the processing of genetic data, data about the sex life or sexual orientation of the individual, therefore in the course of communication with the Company, you shall not disclose such data.

Cookies and technical data

Please consider that using the Website, you provide information to the Company which by itself does not have the character of ‘personal data’ or which can be considered as ‘personal data’ only in combination with other information or data gathered through the Website. The personal data which the Company will process in connection with the services provided through the Website are: name (surname and/or family name), email address, phone number, activity in social networks (Facebook, Twitter, You Tube etc.) – a minimal amount of data but necessary to provide the services you are looking for and to meet your expectations in the best possible way. When you use the Website, the Company will process data concerning your preferences and your interests. All of that data is processed to make the Website’s performance better and your interaction with it easier. The data may include information about:

• Your browser;
• Information gathered through cookies installed on your device (cookies, pixel tags or other technology);
• Location data or other information provided by you;
• Overall information about your experience with our Website.

Дружеството и трети страни (понякога доставчици на услуги на  Дружеството) имат много начини да събират цялата посочена информация, включително:

• The Company and the third parties (sometimes service providers for the Company) have many ways to collect all the provided information, including: Through your browser: Generally, most of the websites collect certain types of information such as your IP address, your MAC address, etc.;
• Through the use of cookies: Cookies perform essential functions in the modern web. Perhaps most importantly, authentication cookies are the most common method used by web servers to identify whether the user is logged in or not, and which account they are logged in with. Without such a mechanism, the site would not know whether to send a page containing sensitive information, or require the user to identify themselves by logging in. The security of an authentication cookie generally depends on the security of the issuing website and the user's web browser, and on whether the cookie data is encrypted.

Security vulnerabilities may allow a cookie's data to be read by a hacker, used to gain access to user data, or used to gain access (with the user's credentials) to the website to which the cookie belongs (see cross- site scripting and cross-site request forgery for examples).

The Company’s Website is using the following cookies:

• Маркетингови бисквитки на трета страна – Facebook (_fbp): Тази бисквитка изтича след 1 ден. (https://www.facebook.com/policy.php)
• Analytical cookies of third party - Google Analytics (_ga): This cookie expires after 2 years. (https://policies.google.com/privacy)
• Analytical cookies of third party - Google Analytics (_gid): This cookie expires after 1 day. (https://policies.google.com/privacy)

You may opt-out of the use of cookies from the settings of your browser. Please consider that the restriction of the use of cookies may result in problems with the performance of the Website.

3. How does the Company collect and process your personal data?

The purposes for which we process your personal data are:

• implementation of contracts;
• performance of legal obligations;
• realization of legal/legitimate interests;
• direct marketing.

In order to achieve these objectives, the Company collects information about you in a variety of ways, whereas most commonly personal data is submitted by you or from public records.

The Company processes your personal data by the application of a number of technical and organizational security measures through various processing operations (including, but not limited by: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise, data become available, alignment or combination, restriction, deletion or destruction) carried out manually and automatically. The type and the way of performing the specific processing operations depend on the purposes of processing and of the business processes related to these purposes.

In the course of its processing activity, The Company may use processing programs, in respect of which, it monitors compliance with high security requirements and confidentiality of processed personal data.

It is important to note that, as indicated above, your consent to the processing of personal data is not the only legal one grounds on which the Company substantiates its data processing activity. Therefore, the Company will process information about you in accordance to the legal requirements, even in case you do not explicitly agree with this processing or if you have given your consent, and you have exercised your right to withdraw the consent thus given for processing.

The Company guarantees that your personal data will be processed only in accordance with the purposes set out above. In connection with these purposes, your data can be provided/disclosed/transmitted to third parties, acting as administrators of personal data, such as processors or as joint administrators, such as:

• Government and other public authorities;
• Courts, prosecutors' offices;
• Technical consultants, lawyers, accountants, auditors, and companies which provide carrying out of specific activity (e.g. IT-support, courier or printing services, etc.).

4. Who will have access to your personal data?

The Company ensures that your personal data is processed only in accordance with the objectives set out above. In conjunction with these goals, your data can be provided / disclosed / transmitted to third parties acting as administrators of personal data in their capacity as joint administrators or processors.

As mentioned above, the security of Your data is a priority for us and because of this the Company will not disclose / provide / transmit your data to third parties who do not possess the right to know information about you.

5. Where will your personal data be processed?

Your data is mainly processed on the territory of the Republic of Bulgaria and within the borders of the European Union(with exception when the services of Facebook, Instagram and Youtube, which are connected to the website and are provided by independent third parties, which have their own confidentiality policies).

6. What are your rights in relation to your personal data?

Practices and methodologies for data protection and information security assurance implemented by us set out the parameters of the identified measures which aim to:

• Ensure the confidentiality of the information through the application of the system of approved restrictions on access and disclosure of information;
• Ensure the integrity of information by protecting it against improper modification or deletion of the information;
• Ensuring the availability of information through reliable and timely access to the information;
• Achieving accountability of information – through the introduction of access control and rights to information systems.

As a subject of personal data under Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (" The General Data Protection Regulation"), you have the following rights:

• The right of access to your data – upon your request, we will provide you with information about your data that is being processed;
• The right of rectification of your data – in case you find that certain of your data that we process is no longer up-do-date or is incorrect, or for any other reason, you have a right to request correction of such data that is being processed;
• The right to delete your data (“right to be forgotten”) – you have the right to ask for the deletion of the data that we process for you, we will honor your request just in case that for us there is no longer a legal basis to process your data. Accordingly, it is possible to partially honor your request for deletion of data;
• The right to restrict processing – you have the opportunity to exercise this right only when you have challenged the accuracy of the processing of your data, the restriction of the processing can last only for the period in which we check the accuracy of your data; when the processing is unlawful, but you oppose the deletion of the data; when we no longer need your data for the purposes of the processing, but you as the subject of the personal data require for the establishment, exercise or defense of legal claims; when you objected to the processing, a verification if the legitimate interests of the controller have a priority over your interests as the subject of the personal data shall be made;
• The right of portability of data – you can ask us to transfer all or part of your data that is being processed and that you have personally provided to us, to you or to another administrator in a form suitable for machine reading when the processing of these data is based on your consent or on the performance of the contract and where the processing is carried out by automated means;
• The right to object to the automated processing of your data, against profiling and against processing for purposes of direct marketing, we provide you with the opportunity to exercise this right at anytime and free of charge;
• The right to awareness of security breaches – you have the right to be promptly informed of any breach of the security of your data and we will fulfill our obligation in this regard, as we post information on the Website of any such violation, and may send you information via email when you have provided us with a correct email address;
• The right to object to the processing for the purposes of direct marketing – you have the right, at any time and for free, to change your marketing preferences and to withdraw a consent for the processing of your personal data for the purposes of direct marketing or to oppose such processing;
• The right to withdraw your consent for the processing of personal data – you have the right, at any time and free of charge, to withdraw already given by you consent to the processing of personal data. We would like you to know that your consent is not the only ground on which we process your personal data, thus it is possible that we continue to process your personal data even following the withdrawal of your consent if other grounds for processing exist.

Можете да упражнявате описаните права с промяна на настройките на Вашия браузър или мобилно приложение, доколкото това е технически възможно, или като се свържете с нас на контактите, описани по-надолу, като попълните Формуляр за упражняване на права съгласно Общия регламент за защита на данните, който можете да намерите на Уебсайта https://luxury-villa-borina.com/  и го предоставите в нашия офис с адрес, посочен по-долу, на хартия.

Given the fact that the Company makes contacts (establishes relationships) with different categories of persons and on various occasions (including on the occasion of your actual and indirect participation in certain events), then the proper examination of the submitted by you application for exercise of rights is directly linked to the exact identification of the circumstances in which the Company had to process your personal data.

In the exercise of your rights as a subject of personal data for the Company arises the necessity to request and process certain personal data for the purpose of establishing and verifying your identity. As an administrator of personal data, the Company is not just obliged to provide means for you to exercise your rights, but also to guarantee that those rights will be exercised only by the subjects, which are actually entitled to the certain right, governed by the General Regulation on data protection.

Your application for the exercise of rights, will be processed in due course, in the most general case for not more than 30 (thirty) calendar days, except if your request is not specific and is not in connection with in depth examination of information. Still our team will do the necessary to inform you, by sending and email, in case of delays in the examination of your request. Given the fact that the Company highly values the necessity for protection of data, it has established and implements a procedure for the examination of request concerning the exercise of rights, in accordance with the General Regulation on data protection, in which the deadlines for examination of, and response to submitted requests for exercise of rights by subject of data, are stated.

7. How long does the Company store your personal data?

The processing time of your data is also consistent with the processing purposes and with regulatory storage requirements of accounting and tax information. determining the deadline for the storage of your personal data is directly conditioned by the type of relationship, which we have established with you and due to which we have processed your personal data in the first place.

The company will not store your personal data longer than necessary, and will store them only for purposes for which have been collected.

8. How can you contact the Company?

Contact address: Bulgaria, Sofia, PC 1618, Vitosa Region, “Ivan Susanin” str., 26A, 5th floor, apartment 13.

Telephone Number: (+359) 888 737 656; (+359) 889 900 200

You can contact us by email at: villa.borina@gmail.com.

The Company has no obligation to appoint a Data Protection Officer, therefore there is no such.

On the occasion of the collection and processing of your personal data, you can refer to the Commission for Protection of Personal Data at the following address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg

When is this Policy updated?

Преглеждаме настоящата Политика редовно. Последната актуализация на настоящата декларация е от 10.12.2020 год.