Personal Data Protection and Privacy Policy

HVD Hotels EOOD

HVD Hotels EOOD (hereinafter referred to as the “Company”, “we”, “us”, or the “Data Controller”) respects the privacy of personal data of its guests, clients, and visitors to the website hvdhotels.com (hereinafter referred to as the “Website”).

This Privacy Policy describes what types of personal data we collect, how we use them, the conditions for sharing them with third parties, data retention periods, and the rights you have under applicable data protection legislation.

The processing of personal data is carried out in accordance with:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR);
The Personal Data Protection Act of the Republic of Bulgaria (PDPA).

1. Data Controller

HVD Hotels EOOD

📍 Address: 2 Khan Asparuh Str., Varna 9000, Bulgaria

📞 Tel.: +359 87 530 3030

✉️ Email: info@hvdhotels.com

🌐 Website: https://hvdhotels.com

For questions regarding the processing of personal data, you may contact the Controller at the email address provided above.

2. What Personal Data We Collect

2.1. Data Provided Directly by You

We collect the following categories of personal data when you explicitly provide them to us (e.g. when making a reservation, sending an enquiry via the contact form, subscribing to our newsletter, or communicating with us):

First and last name;
Email address;
Phone number;
Billing address (upon request);
Arrival and departure dates, number of adults and children, room or service preferences;
Special dietary needs or requests (during reservation);
Messages and text sent to us via the contact form or email.

2.2. Payment Data

Payment transactions are processed through an external licensed payment operator — Quendoo.bg EOOD. The Company does not store full credit or debit card details on its servers. Where partial data is stored for technical necessity (e.g., the last 4 digits of the card), this is done solely for transaction identification and accounting purposes.

2.3. Data Collected Automatically When Visiting the Website

During every visit to the Website, the following technical data is collected automatically:

IP address;
Browser type and operating system;
Device type (desktop, tablet, mobile);
Language preferences;
Date and time of visit;
Pages visited, session duration, and referring URL.

These data are collected via cookies and similar technologies (including Google Analytics 4). For more details, please refer to our Cookie Policy.

2.4. Video Surveillance (CCTV)

HVD Hotels properties use video surveillance systems to ensure the safety and security of guests, staff, and property. CCTV recordings are retained for up to 30 days and are accessible solely by authorized personnel.

3. Purposes and Legal Bases for Processing

No.	Processing Purpose	Legal Basis (Art. 6 of GDPR)
1	Processing reservations and providing hotel services	Art. 6(1)(b) — Performance of a contract
2	Handling customer enquiries and correspondence	Art. 6(1)(b) — Steps prior to contract; Art. 6(1)(a) — Consent
3	Sending marketing communications (newsletters, special offers)	Art. 6(1)(a) — Explicit consent
4	Website traffic analysis and optimization (Google Analytics 4)	Art. 6(1)(a) — Explicit consent
5	Remarketing and targeted advertising (Facebook Pixel, Google Ads)	Art. 6(1)(a) — Explicit consent
6	Protection against bots, spam, and abuse (Cloudflare Turnstile)	Art. 6(1)(f) — Legitimate interest
7	Ensuring Website security and preventing cyber threats	Art. 6(1)(d) — Vital interests / Art. 6(1)(f) — Legitimate interest
8	Compliance with legal obligations (tax, accounting, commercial)	Art. 6(1)(c) — Legal obligation
9	Video surveillance (CCTV) for physical safety	Art. 6(1)(f) — Legitimate interest; Art. 6(1)(d) — Vital interests

4. Retention Periods

Data Category	Retention Period
Reservation and contractual data	5 years after contract completion (pursuant to tax and accounting regulations)
Customer enquiry data	2 years from last contact
Marketing data (email lists)	Until consent is withdrawn
Analytical data (Google Analytics 4)	Up to 26 months
Security validation and bot protection tokens (Cloudflare Turnstile)	Session / up to 1 year
Server log files	30 days
CCTV surveillance recordings	30 days

5. Sharing Personal Data with Third Parties

a) Processors acting on behalf of the Company:

Quendoo.bg EOOD (online booking engine) — reservation processing (Location: EU);
Google LLC (Google Analytics 4, Google Tag Manager) — traffic analysis and script management (Location: USA, transferred under Standard Contractual Clauses / Data Privacy Framework);
Cloudflare, Inc. (Cloudflare Turnstile) — website security, bot mitigation, and DDoS protection (Location: USA / Global network, under Standard Contractual Clauses / Data Privacy Framework);
Meta Platforms, Inc. (Facebook Pixel) — marketing and remarketing only with explicit consent (Location: USA, under Standard Contractual Clauses);
Banks and payment processors — payment processing (Location: EU).

b) Public authorities: Disclosed only upon lawful statutory request.

The Company does not sell personal data to third parties.

6. Your Rights Under GDPR

Right of Access (Art. 15): To confirm whether we process your data and receive a copy.
Right to Rectification (Art. 16): To correct inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”, Art. 17): To request deletion when grounds for processing expire.
Right to Restriction of Processing (Art. 18): Under specific legal conditions.
Right to Data Portability (Art. 20): To receive your data in a structured, machine-readable format.
Right to Object (Art. 21): To object to processing based on legitimate interest or direct marketing.
Right to Withdraw Consent (Art. 7(3)): At any time without affecting past processing.
Right to Lodge a Complaint (Art. 77): With the Commission for Personal Data Protection (CPDP) — www.cpdp.bg or your local EU authority.

7. Contacts

HVD Hotels EOOD
2 Khan Asparuh Str., Varna 9000, Bulgaria
Tel.: +359 87 530 3030
Email: info@hvdhotels.com