Privacy Policy

Data Controller

The controller responsible for your personal data is:

[InterBansko — legal entity name, registered address, company/VAT number, email, phone — owner to fill in]

Data protection contact: [DPO or responsible contact name and email — owner to confirm; a formal DPO may not be required, but a named contact should be provided].

Information We Collect

• •Booking information: when you make a reservation, we collect your name, email address, phone number, and the details of your booking (dates, services, party size).
• •Payment data: payments are processed securely by Stripe. We do not store your full card details on our servers; Stripe shares with us a transaction reference and status.
• •Inquiry data: when you contact us, we collect your name, email address, phone number, and the content of your message.
• •Usage and device data: with your consent, analytics and advertising tools collect information such as pages visited, time on site, device and browser type, approximate location derived from your IP address, and online identifiers stored in cookies. This data is not anonymous — it includes your IP address and identifiers that can relate to you.
• •Consent records: when you set your cookie preferences, we store a record of your choices (which categories you accepted or declined, the policy version, your language, a timestamp, and a randomly generated record identifier) so we can demonstrate that valid consent was given.

Legal Bases for Processing

We process your personal data only where we have a lawful basis under the GDPR. The basis depends on the purpose:

• •Performance of a contract (Art. 6(1)(b)): processing your booking, taking payment, and sending booking-related communications.
• •Consent (Art. 6(1)(a)): setting analytics and advertising cookies/tags and any related personalization. You may withdraw this consent at any time (see below).
• •Legal obligation (Art. 6(1)(c)): retaining accounting, tax, and transaction records for the periods required by Bulgarian and EU law.
• •Legitimate interests (Art. 6(1)(f)): operating the Google Consent Mode "Advanced" anonymized, cookieless signals described below, and protecting the security and integrity of the website.
• •Demonstrating consent (Art. 6(1)(c) read with Art. 7(1)): we keep the consent records described above to comply with our legal obligation to demonstrate that you gave consent.

Third Parties We Share Data With

We use the following processors and recipients. Several are based in the United States; where personal data is transferred outside the EEA, the transfer relies on the EU-US Data Privacy Framework (DPF) and/or the European Commission's Standard Contractual Clauses (SCCs), as noted.

• •Stripe (payment processing): receives your name, email, payment amount, and card/payment details to process your booking payment. Basis: contract. Transfers to the US rely on the Data Privacy Framework and/or SCCs.
• •Resend (transactional email): receives your name and email address to deliver booking confirmations and important updates. Basis: contract. Transfers to the US rely on the Data Privacy Framework and/or SCCs.
• •Google Analytics 4 (analytics): with your consent, receives your IP address, online identifiers (e.g. the _ga cookie), and interaction data to measure how the site is used. This data is not anonymous. Basis: consent. Transfers to the US rely on the Data Privacy Framework and/or SCCs.
• •Google Ads (advertising, including remarketing and Consent Mode conversion modeling): with your consent, receives advertising identifiers and conversion data used to measure and target advertising, including showing you relevant ads after your visit. Basis: consent. Transfers to the US rely on the Data Privacy Framework and/or SCCs.
• •Meta / Facebook Pixel (advertising): only when you consent, loads and receives event and identifier data (e.g. the _fbp cookie, page and conversion events) used for ad measurement and targeting. The Meta Conversions API may send equivalent server-side events when enabled. Until you consent, our security policy blocks the Pixel from loading at all. Basis: consent. Transfers to the US rely on the Data Privacy Framework and/or SCCs.

We do not sell your personal data to third parties.

Google Consent Mode ("Advanced")

We use Google Consent Mode in "Advanced" mode. This means that before you make a cookie choice — and if you decline analytics/advertising — Google still receives anonymized, cookieless "pings" (containing your IP address and basic page context, but no information stored on your device and no personal identifiers). Google uses these to model aggregate, statistical estimates of traffic. We rely on our legitimate interest (Art. 6(1)(f)) for these signals, and we have carried out a legitimate-interest assessment. These signals are transmitted to Google in the US under the Data Privacy Framework. No cookies or advertising identifiers are set unless and until you give consent.

Cookies and Similar Technologies

We use cookies and local storage for essential site functions and, with your consent, for analytics and advertising. The table below lists the main cookies and storage items we set:

Essential cookies are required for the website to function and cannot be switched off. Analytics and advertising cookies are set only after you accept them via the consent banner.

How We Use Your Data

• •To process and manage your bookings and payments.
• •To send booking confirmations and important updates about your reservation.
• •With your consent, to understand how the website is used and improve our services.
• •With your consent, to measure and deliver relevant advertising.
• •To respond to your inquiries and provide customer support.
• •To meet our legal, accounting, and tax obligations and to demonstrate consent.

Data Retention

• •Booking and transaction data: retained for up to [X — e.g. 5–10] years to meet accounting and tax obligations [owner to confirm the exact statutory period].
• •Inquiry data: retained for [X, e.g. 12] months after your last contact, then deleted [owner to confirm].
• •Analytics data: retained according to our Google Analytics configuration (up to [14] months) [owner to confirm].
• •Consent records: kept for the duration of the consent's validity plus [X — owner to confirm, e.g. 3 years] afterwards, so we can demonstrate that consent was validly given.

Your Rights

Under the GDPR, you have the right to:

• •Access the personal data we hold about you.
• •Have inaccurate or incomplete data corrected.
• •Request deletion of your data ("right to be forgotten"), where applicable.
• •Request that we restrict processing of your data.
• •Receive your data in a portable, machine-readable format.
• •Object to processing based on our legitimate interests.
• •Withdraw your consent at any time for analytics, advertising, and personalization, without affecting the lawfulness of processing before withdrawal.
• •Lodge a complaint with a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; email kzld@cpdp.bg; phone +359 2 915 3518; www.cpdp.bg. You may also complain to the authority in your country of residence.

To exercise any of these rights, contact us at:

Withdrawing Your Consent

You can withdraw or change your consent for all categories — analytics, advertising, and personalization — at any time using the "Cookie Settings" link in the website footer. Withdrawal takes effect on your next page load; we stop sending new data, and you can clear existing cookies in your browser.

Children

This site is not directed at children under 16, and we do not knowingly process children's data. If you believe a child has provided us with personal data, please contact us and we will delete it.

Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: