Privacy Policy

Denis Podorozhkin
Andrey Lyapchev 1, Sofia 1000, Bulgaria
Email: bulneoeu@gmail.com

Newsletter subscriptions: email address, name (optional), language preference, and signup source — collected when you subscribe to our newsletter.

Contact & partnership requests: name, email address and the content of your message (for partnership requests also your role, property name and phone number) — collected when you use our forms.

Hotel booking inquiries: name, email address, phone number (optional), travel dates, party size and your message — collected when you send an inquiry to a hotel through our site.

Account and guest reviews: when you create an account (via our authentication provider, Clerk) we process your email address, name and authentication data. When you leave a review, we store your display name, rating, review text and stay date, linked to your account id — your email address is not stored with the review itself.

Usage data: when you visit, your browser sends standard log data (IP address, browser type, pages visited, referrer URL). Processed solely for security and troubleshooting.

Analytics data: with your consent, we collect anonymised analytics data via Google Analytics 4 to understand how the site is used and improve our content.

Cookie consent: we store your cookie preference in a cookie on your device.

• Newsletter: to send updates on Bulgarian thermal tourism — legal basis: consent (Art. 6(1)(a) GDPR)
• Analytics: to understand site usage and improve content — legal basis: consent (Art. 6(1)(a) GDPR)
• Server logs: security and troubleshooting — legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Contact/partnership requests: to handle and respond to your request — legal basis: pre-contractual steps or legitimate interest (Art. 6(1)(b)/(f) GDPR)
• Booking inquiries: to forward your inquiry to the hotel you selected — legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR)
• Account and reviews: to provide an account and publish your guest reviews — legal basis: performance of a contract / consent (Art. 6(1)(b)/(a) GDPR)

We share your data with the following processors who act on our instructions:

• Supabase Inc. (Frankfurt, EU) — database hosting for newsletter subscriber data, booking inquiries and guest reviews
• Clerk Inc. (US) — authentication and account management; covered by Standard Contractual Clauses
• Brevo SAS (Paris, EU) — email delivery for newsletter and transactional emails
• Sanity Inc. (US) — content delivery network; covered by Standard Contractual Clauses
• Google LLC (US) — Google Analytics 4, only with your cookie consent; covered by Standard Contractual Clauses
• Meta Platforms Inc. (US) — Facebook Pixel, only with your cookie consent; covered by Standard Contractual Clauses

Booking inquiries are forwarded to the hotel you selected; the hotel processes your inquiry as an independent data controller.

• Newsletter subscriber data: retained until you unsubscribe, then deleted within 30 days
• Contact and partnership messages: as long as needed to handle your request
• Booking inquiries: up to 24 months (record-keeping and billing), then deleted
• Account and review data: until you delete your account; rejected or spam-flagged reviews are deleted after 90 days
• Analytics data: per the default retention settings of each analytics service
• Server logs: up to 30 days

Under GDPR you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent at any time without affecting the lawfulness of prior processing
• Lodge a complaint with a supervisory authority

To exercise your rights, email us at bulneoeu@gmail.com. You can also delete your account and reviews yourself via your account settings.

The supervisory authority for Bulgaria is the Commission for Personal Data Protection (CPDP):
Website: www.cpdp.bg
Address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria

We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent revision.