This privacy notice replaces all previous privacy notices published on this website and is effective from 21st May 2018 in accordance with General Data Protections Regulations (GDPR).
1. WHO WE ARE AND IMPORTANT INFORMATION
Bulgaria Bed And Breakfast is a trademark of crossbrook group s.r.o., a Limited Liability Company registered in Slovakia under registered no. 48106232. Registered office is Plynarenska 3A, 82109, Bratislava, Slovakia.
You must read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.
This privacy notice is issued by crossbrook group s.r.o. so when we mention “crossbrook group s.r.o.”, “Bulgaria Bed And Breakfast”, or more generally “we”, “us” or “our” in this privacy notice, we are referring to crossbrook group s.r.o as the company responsible for processing your data.
For all data matters contact us at firstname.lastname@example.org.
crossbrook group s.r.o is the controller and responsible for this website.
2. WHAT WE DO
Bulgaria Bed And Breakfast is an online one-stop platform or marketplace for B&B and Self Catering accommodations in the Bulgaria, introducing and connecting Owners and Guests each other.
3. HOW WE USE YOUR PERSONAL DATA
We use your personal data (and the information of those travelling with you) for purpose of enabling travel bookings. This includes sharing your booking information with our suppliers or Owners in order for them to fulfil your booking. We also engage other third-party who provide services or functions on our behalf.
Where you choose to receive marketing information, we will let you know about any special offers that may be of interest to you. You are able to opt-out at any time by emailing us at email@example.com unsubscribing using the ‘Unsubscribe’ button on template email messages we may share with you from time to time. You can also contact us about updating or accessing your information using the same email address above.
We use information like cookies to improve your experience on our website which provide us with analytics information that will help us to improve our services and we collect information about travel destinations of interest to you so that you may see travel advertisement that are more relevant to you. From time to time and usually following an interaction with us, we may also ask you for your feedback to ensure we are providing the best service available.
4. THE PERSONAL DATA WE COLLECT ABOUT YOU AND WHY
Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data is, in simpler terms, any information from which a person can be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
We may collect, use, store and transfer different kinds of personal data about you which can be enlisted as follows:
Personal data that you provide directly to us
We may ask you to provide personal data directly to us. For example, we may ask you to provide your contact details such as full name, telephone number and email address in order to:
- enable your travel booking;
- create or register an account with us;
- provide the services and information you request such as details about your booking;
- have an emergency contact number for you;
- subscribe you to our marketing communications; and/or
- submit your enquiries.
You will also need to provide your billing information (such as credit card number, cardholder name and expiration date) to make a payment.
You may also provide personal data about any Guest on your booking, your marketing preferences and when you participate in a survey. When creating an account, you will provide a login name/member ID as well as a password.
Your personal data may also be linked to Cookies to enable the proper operation of our website, store your travel searches, and collect information on how you used our website.
For Owners, additional personal data may be collected for listing a property, communicating with a Guest and when you set up financial account information for payment processing.
Special categories of personal data
Certain types of personal data, such as some government-issued identification numbers, religion, health or sexuality, are considered sensitive and require additional protection under applicable laws. We limit the circumstances under which we may collect sensitive personal data. Examples of this information include the following:
- health-related personal data may be needed for you to arrange or book appropriate travel accommodation and accessibility or facility requirements;
- government-issued identification numbers like passport or driver’s license number may be required for travel reservation;
- other personal data that you can specify at your option and which may imply or suggest information like religion, health or other information, such as dietary needs.
Personal data that we collect automatically
When you visit us on our website, we may collect certain information automatically from your device. In some countries, including countries in the European Economic Area, this information may be considered personal data under applicable data protection laws.
Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type (such as Firefox, Safari, or Internet Explorer), your Internet Service Provider (ISP) and your operating system. For website users, details of any referring website or exit pages as well as broad geographic location (e.g., country or city-level location) may be also collected. We may also collect other technical information such as how your device has interacted with our website, including the pages accessed and links clicked, i.e., accommodations viewed and the time and date of these.
Collecting this information enables us to better understand the users who come to our website, where they come from, and what content on our website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our website for our users, for example, to customize your user experience, tailor your searches and show you advertisements that may be of interest. We also use this automatic information to prevent and detect fraud.
Some of this information may be collected using cookies and similar tracking technologies, as explained further on.
Personal data that we obtain from third party sources
Periodically, we may lawfully obtain personal data about you from affiliated entities, business partners and other independent third-party sources and add it to our databases. Personal data we may receive includes updated contact information like email, purchase history, and demographic information.
Personal data that we collect when you communicate with us via the social media
Personal data that we collect when you communicate with us via direct contact
Personal data that we collect when you communicate with us via other online communications
Personal data arisen from Guests’ reviews
We may collect information from the reviews written by Guests on a property they have stayed in. We are not responsible for the Owner deducing the Guest’s identity from the content of his review and contacting the Guest directly.
Cookies and similar tracking technologies
We use the personal information we collect from you only for the purposes described in this privacy notice.
5. WHO WE SHARE YOUR PERSONAL DATA WITH
We may disclose and share your personal data to the following categories of recipients:
- Third party service providers who provide data processing services to us (for example, to support the delivery of, provide functionality on, or help to enhance the security of our website), or who otherwise process personal information for purposes such as credit card processing, business analytics, customer service, marketing, distribution of surveys, to facilitate the delivery of online advertising tailored to your interests and fraud prevention. Where third-party service providers have access to personal data, they will only collect information as needed to perform their functions. They are not permitted to share or use the information for any other purpose.
- Business partners with whom we may jointly offer products or services, or whose products or services may be offered on our website. If you choose to access these optional services, we will on occasions share information about you, including your personal information, with those partners. If you were referred to our website via a hyperlink from an external site of one of our partners, we will share your personal information, browsing activity on our website, and purchase information with the referring partner.
- Any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your interests or those of any other person, or (iv) when we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities, to protect and defend the rights, property, or safety of our company or this website, our customers, or others, and in connection with our Terms and Conditions. Third parties include competent tax authorities or other authorities allowed to collect taxes.
6. HOW WE USE YOUR PERSONAL DATA
We will only use and process your personal data when the law allows us to do so.
If you are a visitor from the European Economic Area, our legal basis for collecting and using the personal data described in this privacy notice will depend on the personal data concerned and the specific context in which we collect it.
We will normally collect personal data from you only (i) where we need the personal data to perform a contract with you, (ii) where the processing is in our legitimate interests and not overridden by your rights, or (iii) where we have your consent to do so.
In some cases, we will have a legal obligation to collect personal data from you such as where it is necessary to use your transaction history to complete our financial and tax obligations under the applicable law.
If we collect and use your personal data in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our platform and communicate with you as necessary to provide our services to you, for security verification purposes when you contact us and for our legitimate commercial interest, for instance, when responding to your queries, improving our platform, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.
We ensure that (i) our interest in the use of your data is legitimate (i.e., we have a clear business needs), and (ii) our business needs, on balance, do not override your privacy rights.
When determining this, we assess the potential impact a specific use of the data may have on you as a customer and weigh this against our own business needs to ensure that we get the balance right. We also apply a series of security measures to minimise any potential risks.
By way of example in practice we would consider that the collection of our customers’ marketing preferences in the course of a booking is a legitimate business interest. We believe that this does not unduly impact your privacy rights as you may, most definitely, want to hear about our products and services going forward. However, to protect your privacy rights we ensure that you can opt out of these communications at any time, in your account, in the email itself or through our website.
In accordance with the legal grounds above, we use the personal data we collect to:
- fulfil the transactions that you make, such as for Guests: booking a property, or for Owners: to list a property;
- verify your identity for fraud prevention purposes;
- manage your account, including processing payments;
- communicate with you in general, particularly if such communication is related to your booking;
- provide customer services related to your booking or to respond to any inquiry you make;
- facilitate communication between Guests and Owners;
- measure interest in and improve our products, services, and website functionality;
- notify you about special offers, travel-related products and any other service that may be of interest to you. You may receive these by email, post or via advertisements on third-party sites, including through social media;
- otherwise customize your experience with this website or other media;
- obtain information from you, including through feedback you give us on surveys you complete;
- carry out statistical analysis about the use of our website and the services we offer, in order to improve each aspect of what we do;
- protect our rights as a company including our intellectual property for example;
- prevent potentially prohibited or illegal activities;
- enforce our Terms and Conditions.
If you have any question about or need further information concerning the legal basis on which we collect and use your personal information, please contact us.
7. HOW WE PROTECT YOUR PERSONAL DATA
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
Your personal data are stored in the UK or within the EEA in a safe place. This means that they will be fully protected under the GDPR.
Employees, agents, contractors and other third parties who have a business related to us, will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
8. WHERE WE SEND YOUR PERSONAL DATA
Countries outside of the European Economic Area (EEA) do not always offer the same levels of protection to your personal data, so European law has prohibited transfers of personal data outside of the EEA unless the transfer meets certain criteria.
Some of our third parties service providers are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.
Whenever we transfer your personal data out of the EEA, we do our best to ensure a similar degree of security of data by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission; or
- Where we use certain service providers, we may use specific contracts or codes of conduct or certification mechanisms approved by the European Commission which give personal data the same protection it has in Europe; or
- Where we use providers based in the United States, we may transfer data to them if they are part of the EU-US Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US.
If none of the above safeguards is available, and whereas the transfer of your personal data is deemed necessary to fulfil our contract with you (including pre-contractual steps or a contract with another party in your interests), we may request your explicit consent to such specific transfer. You will have the right to withdraw this consent at any time.
9. HOW LONG WE RETAIN YOUR PERSONAL DATA
We retain your personal data as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
By law we have to keep basic information about our customers (including contact, identity, financial and transaction data) for six years after they cease being customers for tax purposes.
In some circumstances you can ask us to delete your data and we may also anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice.
10. THE LEGAL RIGHTS YOU HAVE OVER YOUR PERSONAL DATA
You can easily access or update your contact information and personal details in the account section of our website. You can deactivate your account at any time and after such deactivation, you will not be able to sign in or access any of your personal information. However, you can open a new account at any time.
Unless subject to an exemption under the data protection laws applicable in your own country, you have the following rights with respect to your personal data:
- The right to request a copy of the personal data which we hold about you;
- The right to request that we correct any personal data if it is found to be inaccurate or out of date;
- The right to request the cancellation of your personal data where it is no longer necessary to retain such data (please note that we will need to retain any information that we require to fulfil our legal obligations or to establish, exercise or defend a legal claim);
- The right to withdraw your consent at any time, where consent was the lawful basis for processing your data (please note that if we have collected and processed your personal information with your consent, then you can withdraw your consent at any time but withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent);
- The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), where applicable (i.e. where our processing is based on consent or is necessary for the performance of our contract with you or where we process your data by automated means);
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to our processing of personal data, where applicable i.e. where processing is based on our legitimate interests (or in performance of a task in the public interest/exercise of official authority); direct marketing or processing for the purposes of scientific/historical research and statistics;
- The right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you.
If you wish to exercise any of the rights set out above, please contact us.
No fees are required (with some exceptions). You will not have to pay a fee to access your personal data (or to exercise any of the other rights), however, we may charge a reasonable admin fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in such circumstances.
We may also need to request specific information from you to help us to confirm your personal identity and to ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you in order to collect further information in relation to your request and to speed up our response.
We aim to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
We will reply electronically unless you ask us to send the information by post.
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws, however you also have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.
11. THIRD-PARTY LINKS
Our website may include links to third-party websites, plug-ins and applications, which fall outside of our control. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and we are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
12. CHANGES TO THIS NOTICE AND OUR DUTY TO INFORM YOU
13. QUERIES, REQUESTS OR CONCERNS
To exercise all relevant rights, queries or complaints in relation to any data protection matter between you and us, or to request whatsoever information to this privacy notice, please in the first instance contact us by email at firstname.lastname@example.org and we will investigate the matter and report back to you as soon as possible.
If this does not resolve your complaint to your satisfaction, you have the right to submit a complaint to your local data protection authority.
A cookie is a small file sent from a website and stored on your computer while you are browsing. It helps to remember information or to record your browsing activities. It can also be used to remember information that you previously entered into form fields such as names, addresses, passwords, and credit card numbers.
A cookie no gives us access to your computer or any information about you, other than the information you choose to share with us.
You can choose to decline cookies but this may prevent you from taking full advantage of our website. Most browsers automatically accept cookies, and you can easily modify your browser setting to decline cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site.
We may use the following cookies:
- Strictly necessary cookies. These are cookies that are required for the operation of our website. They may include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
- Analytical/performance cookies. They may allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
- Functionality cookies. These are used to recognise you when you return to our website. This may enable us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
- Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.
These cookies help the third parties to:
- count the number of users who clicked on a website, allowing them to calculate the amounts of traffic and thereby establish statistics;
- recognise your device at any subsequent browsing of any other site or service on which these third parties also place these cookies and, if necessary, adapt these third party sites and services to your device.
Third party cookies on our website include:
- Google Analytics, a web analytics service provided by Google Inc., which uses its own cookies to gather information about how visitors use our site. This information is then used for the purpose of compiling statistical reports to enable us to measure and analyse the number of visits to the site and its pages, the average time spent on the site and the pages viewed.
- Social Network cookies, of whom social buttons are visible on our website in order to allow you to share content via the main social networks, including Facebook, Pinterest, Twitter and Instagram. Cookies are placed by these platforms on our site, and allow them to collect information about your browsing.
Except for essential cookies, all cookies will expire after 30 days.