BG EN

Privacy Policy

Privacy Policy

of DELUX PROPERTY Ltd.

Last updated: July 2026

1. General Provisions

This Privacy Policy ("the Policy") governs the manner in which DELUX PROPERTY Ltd. collects, uses, stores, protects, and processes the personal data of individuals when they use the website https://deluxestay.bg, make reservations, use our short-term accommodation services, or otherwise communicate with the Company.

This Policy has been prepared in accordance with:

  • Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);

  • the Bulgarian Personal Data Protection Act;

  • the Bulgarian Tourism Act;

  • the Bulgarian Accountancy Act;

  • the Bulgarian Electronic Commerce Act;

  • and all other applicable Bulgarian and European legislation.

Our objective is to ensure a high level of protection for personal data and complete transparency regarding the way we process the information of our customers, visitors, and business partners.

2. Data Controller

The Data Controller responsible for the processing of personal data is:

DELUX PROPERTY Ltd.

UIC (Company Registration Number): 207167139

VAT Number: BG207167139

Registered Office and Business Address:

17 Acad. Boris Stefanov Street
Floor 4, Apartment 3
Studentski District
1700 Sofia
Bulgaria

Telephone: +359 897 970 072

Email: deluxepropertyeood@gmail.com

Website: https://deluxestay.bg

If you have any questions regarding the processing of your personal data, you may contact us using the details provided above.

3. Scope of this Policy

This Policy applies to all natural persons whose personal data are processed in connection with the activities of DeluxeStay, including:

  • visitors to our website;

  • individuals who submit enquiries through the contact form;

  • individuals making reservations through the website;

  • customers who book accommodation via Booking.com;

  • guests using our short-term accommodation services;

  • individuals making payments;

  • representatives of companies and corporate clients;

  • individuals contacting us by telephone or email;

  • individuals exercising their rights under the GDPR.

This Policy does not apply to the processing of personal data carried out by external platforms, including Booking.com, which act as independent data controllers for the personal data processed through their own systems.

4. Principles Governing the Processing of Personal Data

When processing personal data, DELUX PROPERTY Ltd. complies with the principles established by Regulation (EU) 2016/679 (GDPR).

Personal data are processed:

  • lawfully, fairly, and transparently;

  • solely for specific, explicit, and legitimate purposes;

  • only to the extent necessary;

  • while ensuring that the information remains accurate and up to date;

  • for no longer than is necessary;

  • using appropriate technical and organisational security measures.

The Company does not process personal data for purposes that are incompatible with the original reason for which the data were collected.

5. Categories of Personal Data We Process

Depending on the services you use, we may process different categories of Personal Data.

5.1 Identification Data

When making a reservation or checking in, we may process:

  • full name;

  • date of birth (where required by law);

  • nationality;

  • identity document number and related information, where required under applicable legislation;

  • signature, where necessary.

5.2 Contact Information

Depending on the method of communication, we may process:

  • telephone number;

  • email address;

  • correspondence or billing address.

5.3 Reservation Information

For the purpose of providing our services, we may process information such as:

  • selected accommodation;

  • check-in date;

  • check-out date;

  • number of guests;

  • special requests relating to the stay;

  • reservation number;

  • reservation history.

5.4 Payment Information

When processing payments, we may collect:

  • information regarding the selected payment method;

  • payment amount;

  • currency;

  • payment status;

  • bank transfer details;

  • information relating to issued invoices.

DeluxeStay does not store payment card numbers. Card payments are processed exclusively by certified payment service providers.

5.5 Communication Data

When you contact us, we may retain:

  • the content of email correspondence;

  • information from telephone conversations where necessary for customer support;

  • information submitted through the contact form;

  • correspondence relating to reservations;

  • complaints, reports, and requests.

5.6 Technical Data

When you use our website, we may automatically process information such as:

  • IP address;

  • approximate location;

  • browser type;

  • operating system;

  • language settings;

  • device information;

  • date and time of your visit;

  • pages viewed;

  • system log information.

5.7 CCTV Data

To ensure the safety of our guests, employees, and property, CCTV surveillance may be operated in the common areas of our buildings.

CCTV surveillance is not carried out in:

  • apartments;

  • sanitary facilities;

  • areas intended for private use.

Visitors are informed about the presence of CCTV through clearly displayed information signs.

6. Purposes of Processing Personal Data

DELUX PROPERTY Ltd. processes Personal Data solely for predefined, specific, and lawful purposes. We do not process Personal Data in a manner incompatible with the purpose for which it was originally collected.

Depending on the circumstances, Personal Data may be processed for the following purposes.

6.1 Reservation Management

Personal Data are processed in order to:

  • receive and confirm reservations;

  • verify availability;

  • communicate with guests before check-in;

  • amend or cancel reservations;

  • register guests in accordance with applicable legislation;

  • provide check-in instructions;

  • deliver services during the guest's stay.

6.2 Performance of a Contract

Processing Personal Data is necessary in order to:

  • provide the booked accommodation;

  • fulfil our contractual obligations;

  • process payments;

  • issue accounting and tax documents;

  • provide post-stay customer support.

6.3 Compliance with Legal Obligations

In certain cases, we are required by law to process Personal Data.

This includes:

  • registration of accommodated guests;

  • compliance with the Bulgarian Tourism Act;

  • accounting and tax reporting obligations;

  • fulfilment of obligations towards public authorities;

  • retention of documents in accordance with applicable legislation.

6.4 Customer Communication

We use the information you provide to:

  • respond to enquiries;

  • send reservation confirmations;

  • provide information relating to reservations;

  • assist with customer requests;

  • process complaints and reports.

6.5 Protection of Legitimate Interests

Where we have a legitimate interest, Personal Data may be processed for the purpose of:

  • preventing misuse;

  • preventing fraud;

  • protecting our property;

  • ensuring the safety of our guests;

  • defending our legal rights in judicial proceedings;

  • collecting outstanding debts;

  • establishing, exercising, or defending legal claims.

6.6 Security

Personal Data may also be processed for the purpose of:

  • maintaining the security of our information systems;

  • protecting against unauthorised access;

  • detecting malicious activities;

  • investigating security-related incidents.

7. Legal Bases for Processing

All processing of Personal Data is carried out on at least one of the legal grounds provided for in Article 6 of the GDPR.

7.1 Performance of a Contract

Most Personal Data are processed because they are necessary for the performance of our contract relating to the provision of short-term accommodation services.

Without such data, we would not be able to:

  • confirm a reservation;

  • provide access to the accommodation;

  • issue an invoice;

  • fulfil our contractual obligations.

7.2 Compliance with a Legal Obligation

Certain Personal Data are processed in order to comply with legal requirements, including:

  • the Bulgarian Tourism Act;

  • the Bulgarian Accountancy Act;

  • Bulgarian tax legislation;

  • the Bulgarian Measures Against Money Laundering Act (where applicable);

  • other applicable legal requirements.

7.3 Legitimate Interests

In certain circumstances, processing is based on the Company's legitimate interests, including:

  • protection of property;

  • CCTV surveillance in common areas;

  • prevention of misuse;

  • protection of our legal rights in judicial proceedings;

  • improving the security of our website.

Before relying on legitimate interests as a legal basis, we carefully assess whether our interests outweigh the rights and freedoms of the individuals concerned.

7.4 Consent

Where required by law, we will obtain your explicit consent before processing your Personal Data.

This may include:

  • the use of certain categories of cookies;

  • processing Personal Data for purposes other than the performance of a contract;

  • any other cases required by applicable legislation.

You may withdraw your consent at any time. Such withdrawal will not affect the lawfulness of any processing carried out prior to its withdrawal.

8. Sources of Personal Data

We may obtain Personal Data from the following sources.

8.1 Information Provided Directly by You

Personal Data may be collected directly from you, including when you:

  • complete a reservation form;

  • submit an enquiry through our contact form;

  • contact us by telephone;

  • communicate with us via email;

  • provide your information during check-in.

8.2 Booking.com

If you make a reservation through Booking.com, certain Personal Data necessary for the fulfilment of your reservation are shared with DELUX PROPERTY Ltd.

Booking.com processes Personal Data in accordance with its own Privacy Policy and acts as an independent Data Controller with respect to the processing carried out through its platform.

Once we receive your Personal Data, DELUX PROPERTY Ltd. processes them solely for the purpose of managing your reservation and complying with applicable legal obligations.

8.3 Payment Service Providers

When online payments are made, we may receive information relating to:

  • confirmation that the payment has been successfully completed;

  • the amount paid;

  • the transaction identifier;

  • the payment status.

We do not receive or store full payment card details.

9. Online Payments

Payments made through our website are processed using secure payment systems.

Payment card information is never stored on DeluxeStay's servers.

All payment transactions are processed by certified payment service providers that comply with the PCI DSS (Payment Card Industry Data Security Standard) and apply their own Personal Data protection policies.

10. Cookies

To ensure the proper functioning of our website, we use cookies and similar technologies.

These may include:

  • strictly necessary cookies;

  • functional cookies;

  • analytical cookies;

  • security cookies.

At present, DeluxeStay does not use cookies for email marketing campaigns or personalised marketing communications by email.

Further information regarding the cookies we use is available in our separate Cookie Policy, which forms an integral part of this website's documentation.

11. Disclosure of Personal Data

DELUX PROPERTY Ltd. does not sell, rent, or disclose Personal Data to third parties for their own marketing purposes.

Personal Data may only be disclosed where this is necessary for the provision of our services, compliance with legal obligations, or the protection of the Company's legitimate interests.

Recipients of Personal Data may include the following.

11.1 Public Authorities

Where required by law, Personal Data may be disclosed to:

  • the Bulgarian Ministry of Tourism;

  • the Bulgarian Ministry of Interior;

  • the Bulgarian National Revenue Agency;

  • the Bulgarian Commission for Personal Data Protection;

  • courts;

  • prosecution authorities;

  • other competent public authorities.

11.2 Accounting and Financial Partners

Where necessary for compliance with legal obligations, Personal Data may be shared with:

  • accounting service providers;

  • auditors;

  • tax consultants;

  • banks;

  • payment service providers.

11.3 IT Service Providers

We use external service providers to maintain our website and information systems.

These providers may process a limited amount of Personal Data on our behalf.

They act as Data Processors and process Personal Data solely in accordance with our instructions and under a data processing agreement compliant with Article 28 of the GDPR.

11.4 Booking.com

Where a reservation has been made through Booking.com, the exchange of the necessary information between Booking.com and DELUX PROPERTY Ltd. takes place solely for the purpose of managing the reservation.

11.5 Legal Advisors

Where necessary to protect the Company's legal rights, Personal Data may be disclosed to:

  • lawyers;

  • notaries;

  • enforcement officers;

  • courts;

  • arbitration bodies.

12. International Transfers of Personal Data

As a general rule, Personal Data are processed within the European Economic Area (EEA).

Where any of the Company's service providers store or process Personal Data outside the European Union, such transfers are carried out only where one of the safeguards set out in Chapter V of the GDPR applies, including:

  • an adequacy decision issued by the European Commission;

  • the Standard Contractual Clauses (SCCs);

  • any other lawful transfer mechanism permitted under Regulation (EU) 2016/679.

13. Data Retention Periods

Personal Data are retained only for as long as necessary to fulfil the purposes for which they were collected, unless a longer retention period is required by law.

The main retention periods are as follows.

Type of Information

Retention Period

Reservation records

Up to 5 years after completion of the stay

Accounting documents

10 years, in accordance with applicable accounting legislation

Customer correspondence

Up to 5 years

Enquiries that do not result in a reservation

Up to 12 months

Contact form submissions

Up to 12 months

System logs

Up to 12 months

CCTV recordings

Up to 60 days, unless required for the investigation of an incident

Upon expiry of the applicable retention period, Personal Data are securely deleted or irreversibly anonymised.

14. CCTV Surveillance

To ensure the safety and security of our guests, employees, and property, CCTV surveillance may be operated in the common areas of our premises.

CCTV surveillance is carried out solely for the purpose of:

  • preventing unlawful activities;

  • protecting the life and health of individuals;

  • safeguarding property;

  • investigating incidents.

CCTV surveillance is not conducted in:

  • apartments;

  • sanitary facilities;

  • areas intended for private use;

  • any other location where individuals have a reasonable expectation of privacy.

Clear information signs are displayed at all entrances and monitored areas.

15. Security Measures

DELUX PROPERTY Ltd. implements appropriate technical and organisational measures to protect Personal Data against:

  • unauthorised access;

  • loss;

  • destruction;

  • unlawful alteration;

  • unauthorised disclosure;

  • accidental damage.

Our security measures may include:

  • SSL encryption of the website;

  • secure servers;

  • restricted access to information;

  • individual user accounts;

  • strong password policies;

  • regular data backups;

  • anti-virus protection;

  • firewalls;

  • physical access controls;

  • employee training on Personal Data protection.

16. Protection of Personal Data When Using Our Website

When you visit DeluxeStay.bg, reasonable technical measures are implemented to safeguard your information, including:

  • encrypted HTTPS connections;

  • protection against unauthorised access;

  • restricted administrative access;

  • monitoring for unusual activity;

  • protection against automated attacks.

Although we implement appropriate safeguards, no internet-based system can guarantee absolute security. For this reason, the Company continuously reviews and updates its information security measures in line with technological developments and applicable legal requirements.

17. Your Rights Under the GDPR

In accordance with Regulation (EU) 2016/679 (GDPR), every individual whose Personal Data are processed by DELUX PROPERTY Ltd. has the following rights.

17.1 Right to Information

You have the right to receive clear and transparent information regarding:

  • which Personal Data we process;

  • the purposes for which they are processed;

  • the legal basis for the processing;

  • the applicable retention periods;

  • the recipients of your Personal Data.

17.2 Right of Access

You have the right to obtain confirmation as to whether we process your Personal Data.

Where Personal Data are processed, you have the right to receive:

  • a copy of your Personal Data;

  • information about the purposes of processing;

  • the categories of Personal Data processed;

  • the recipients of your Personal Data;

  • the applicable retention periods;

  • information regarding your rights under the GDPR.

17.3 Right to Rectification

You have the right to request:

  • the correction of inaccurate Personal Data;

  • the completion of incomplete Personal Data.

17.4 Right to Erasure ("Right to be Forgotten")

You may request the deletion of your Personal Data where:

  • they are no longer necessary for the purposes for which they were collected;

  • you have withdrawn your consent and there is no other legal basis for processing;

  • the processing is unlawful;

  • erasure is required by law.

The right to erasure does not apply where the processing is necessary to comply with a legal obligation or for the establishment, exercise, or defence of legal claims.

17.5 Right to Restriction of Processing

You have the right to request the restriction of processing in the circumstances provided for by the GDPR, including where:

  • you contest the accuracy of your Personal Data;

  • the processing is unlawful;

  • we no longer require the Personal Data, but you need them for the establishment, exercise, or defence of legal claims.

17.6 Right to Data Portability

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the Personal Data you have provided in a structured, commonly used, and machine-readable format.

Where technically feasible, you also have the right to request that such Personal Data be transferred directly to another Data Controller.

17.7 Right to Object

You have the right to object at any time to the processing of your Personal Data where such processing is based on our legitimate interests.

Upon receiving your objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

17.8 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

18. How to Exercise Your Rights

To exercise any of the rights described above, you may contact us using the following details:

DELUX PROPERTY Ltd.

Registered Office:

17 Acad. Boris Stefanov Street
Floor 4, Apartment 3
Studentski District
1700 Sofia
Bulgaria

Telephone: +359 897 970 072

Email: deluxepropertyeood@gmail.com

Where necessary, we may request additional information to verify your identity before responding to your request.

We will respond to all requests within one month, unless Regulation (EU) 2016/679 permits an extension due to the complexity or number of requests received.

19. Complaints to the Supervisory Authority

If you believe that the processing of your Personal Data violates applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In the Republic of Bulgaria, the competent authority is:

Commission for Personal Data Protection

Address:

2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria

Telephone:
+359 2 915 3518

Website:
https://www.cpdp.bg

Submitting a complaint to the supervisory authority does not affect your right to seek judicial remedies.

20. Changes to this Privacy Policy

DELUX PROPERTY Ltd. reserves the right to amend this Privacy Policy whenever necessary, including in the event of:

  • changes in applicable legislation;

  • changes to the services we provide;

  • implementation of new technologies;

  • changes in the way Personal Data are processed;

  • any other circumstances requiring an update.

Where significant changes are made, the updated version of this Privacy Policy will be published on www.deluxestay.bg and will become effective from the date of publication, unless otherwise stated.

We encourage all visitors to review this Privacy Policy periodically to remain informed about how we protect their Personal Data.

21. Final Provisions

This Privacy Policy applies to all Personal Data processing activities carried out by DELUX PROPERTY Ltd. in connection with the services provided through www.deluxestay.bg and the related business processes.

Any matters not expressly governed by this Privacy Policy shall be subject to the provisions of:

  • Regulation (EU) 2016/679 (GDPR);

  • the Bulgarian Personal Data Protection Act;

  • the Bulgarian Tourism Act;

  • the Bulgarian Accountancy Act;

  • the Bulgarian Electronic Commerce Act;

  • all other applicable legislation of the Republic of Bulgaria and the European Union.

In the event of any conflict between this Privacy Policy and mandatory provisions of applicable law, the relevant legal provisions shall prevail.

22. Controller Information

Data Controller

DELUX PROPERTY Ltd.

UIC: 207167139

VAT Number: BG207167139

Registered Office and Business Address:

17 Acad. Boris Stefanov Street
Floor 4, Apartment 3
Studentski District
1700 Sofia
Bulgaria

Telephone: +359 897 970 072

Email: deluxepropertyeood@gmail.com

Website: https://deluxestay.bg