Privacy Policy

Data protection policy of Zornitza Family Estate

1. Introduction

For us at Zornitza Family Estate, the protection of your personal data is of paramount importance. This Policy informs you of the legal basis, purposes, duration and means by which your personal data is processed when you visit the website www.zornitzaestate.com/en, as well as when you use our tourism and leisure services.

The activities of Zornitza Family Estate are carried out by Borgo la Vigna Ltd, reg. number 203249902, having its registered office and principal place of business in the city of Sofia 1164, Lozenets borough, 1A, Plachkovitsa Street, acting as a data controller within the meaning of Regulation (EU) 2016/679. For the purposes of this Policy, Borgo la Vigna Ltd uses its trading name Zornitza Family Estate.

As of 25 May 2018, the General Data Protection Regulation has been directly applicable across the European Union, including the Republic of Bulgaria (Regulation (EU) 2016/679 – “GDPR”), which grants you enhanced rights regarding the protection of personal data and imposes corresponding obligations on data controllers. Further information on these matters can be found below in this Policy.

In this Privacy Policy, “Zornitza Family Estate”, “the Company”, “we”, “us” or “our” refers to Borgo la Vigna Ltd, reg. number 203249902, whilst “you”, “your” and “user” refer to visitors to the website www.zornitzaestate.com/en, as well as customers of the services we provide.

Please read this Privacy Policy. By using our website and services, you confirm that you understand and agree to it. The Policy may be amended to comply with the lawsn or in the event of changes to our business. We recommend that you check this page periodically. Any significant changes will be published on www.zornitzaestate.com/en.

1. General terms used in this Policy

To make the information below easier to understand, we use the following terms in this Policy:

Personal data

Any information through which we can identify you directly or indirectly – for example, your name, contact details, online identifiers or other information relating to you as a natural person.

Data subject

A natural person who is identified or can be identified, directly or indirectly, on the basis of the personal data we process.

In connection with the tourism and leisure services provided by Zornitza Family Estate, we process personal data relating to the following categories of individuals:

• natural persons who visit the website www.zornitzaestate.com/en;
• natural persons who make bookings in their own name or on behalf of another natural or legal person via the website;
• individuals who use the services we offer, including, but not limited to, hotel accommodation, catering, wellness and spa services, event organisation, tastings and other related activities;
• individuals who represent or act on behalf of legal entities using our services.

Personal data processing

Any action we take with your personal data – such as collection, use, storage, analysis, restriction or erasure, regardless of the means used.

Data Controller

The controller of your personal data is Borgo la Vigna Ltd, reg. number 203249902. We determine the purposes and means of personal data processing, including the channels and technologies used (e.g. web forms, communication channels, video surveillance systems and other tools necessary for the provision of our services and the fulfilment of our legal obligations).
We ensure that your personal data is protected and processed securely, in compliance with all applicable legal requirements.

Data processor

This is a third party that processes your personal data on our behalf and in accordance with our instructions. We ensure that such parties comply with the requirements of the General Data Protection Regulation (GDPR).

An example of a data processor could be an external agency that assists with the management of marketing campaigns.

Personal data breach

An incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised access to, or disclosure of personal data.

Digital assets

The official website www.zornitzaestate.com/en, as well as all associated landing pages, maintained by the Company.

1. Who is responsible for your personal data and how to contact them

If you have any questions regarding the processing of your personal data, you can contact us at: Sofia 1164, Lozenets district, 1A, Plachkovitsa Street, or by email at marketing@zornitzaestate.com.

Our team will ensure that you receive a competent and timely response to any enquiry you may have regarding your rights and the processing of your personal data.

1. Categories of personal data, purposes and grounds for processing
   1. Personal data related to hotel accommodation
2. Identification data: names, date of birth, gender, nationality, personal identification number or other identifier, identity document number and validity, issuing country, signature.
3. Contact details: telephone number, email address, postal address.
4. Accommodation information: room number and type, floor, dates of stay, duration, holiday package used, special preferences, including dietary and other requirements.
5. Payment and billing details: payment method, information on payments made and due, currency, bank details (bank, IBAN, account holder), credit/debit card details (number, expiry date, CVC code, cardholder), details of a legal entity when services are requested by a company, VAT number or other identifier, documents or electronic forms certifying authorisation to make the payment.
6. Third-party data: where services are requested by a person other than the Data Subject, information regarding who is making the request, on whose behalf the request is made, and who is making the payment.
   1. Personal data related to the website and online shop
7. Booking information: names, email, telephone number, country, credit/debit card details, number of rooms and guests, special offers or preferences.
8. Logs and technical data: date and time of access, IP address, URL, browser and device information, server logs and logs from security devices, as well as cookies and other tracking technologies.
9. Online shop data: names, telephone number, email address, payment details, including bank accounts or cards, delivery address, billing details; the data is used for processing and fulfilling orders, communicating regarding orders, providing delivery services and managing returns or complaints; with explicit consent, it may be used for marketing and sales analysis.
   1. Additional categories of personal data
10. CCTV data: to protect the legal rights, security and privacy of the controller, its team and partners, as well as the safety and well-being of guests and the public.
11. Marketing and promotional data: with explicit consent, to send information about services, promotions and special offers.
12. Additional data collection channels: face-to-face meetings and conversations, email communications, social media, Wi-Fi registration; processed only for the specific purposes for which they were provided.
13. Data from enquiries and contact with us: when you contact us via the website contact form or by email, we process the contact details you provide and the content of your message solely for the purpose of responding to your enquiry and conducting follow-up communication.
14. Data of suppliers and partners: information about individuals or representatives of legal entities with whom we maintain business relationships or through whom we provide services and goods.
15. Marketing and information after the relationship has ended: with explicit consent, retention of contact details for news, promotions and special offers, including for individuals who are not customers but have subscribed or given their consent.

• How long is the data retained?

Personal data is retained for the periods necessary to achieve the purposes for which it was collected. Zornitza Family Estate adheres to the legal principle of limiting the retention period as much as possible; once the purpose of processing has been achieved, the data is destroyed, unless there is a legal basis for a longer period.

The Company retains your personal data for the following specific periods:

• where data is included in accounting records and invoices – in accordance with tax regulations and the Company’s legal obligations, data is retained until the expiry of the relevant statutory retention periods for tax and accounting information.
•  where the data is processed on the basis of consent – until you expressly withdraw your consent.
• where data is processed to protect the Company’s rights and interests, which have a legitimate overriding interest over the interests of individuals – until the right expires and/or the interest ceases to apply.
• Images captured by CCTV cameras – these are retained for the period necessary for the purposes of security and the protection of guests, staff and property at the premises. In the event of an incident or where there is a legitimate need, the recordings may be retained for the time necessary to assist investigations by the competent authorities.
• Personal data contained in CVs of candidates who have not been selected for the position, for a maximum period of 1 year, so that we may consider them for future vacancies. You may request that your data be deleted at any time immediately after the current recruitment process has concluded.

Once the specified periods have expired, unless there is another basis for processing (such as pending legal proceedings or the defence of legal claims), the data will be deleted or anonymised in a way that does not allow for your subsequent identification.

• Will my personal data be accessible to third parties?

Your personal data may be accessible to certain categories of persons who process the information on our behalf or as required by law. This includes:

1. Data processors acting on behalf of the Company:

• Technical service providers – companies that provide support, security and management of information systems, software, hosting services and booking platforms;
• Security firms – companies that provide physical security and CCTV surveillance on site to protect guests, staff and the property of Zornitza Family Estate Relais & Châteaux;
• Professional consultants – legal, accounting and tax experts who assist with the performance of business tasks;
• Couriers and logistics companies – for the delivery of written correspondence, vouchers or other materials to customers;
• Payment service providers – for processing credit card payments;
• Insurance companies – when reporting an insured event involving a tourist staying at the property.

All these suppliers are bound by confidentiality agreements and are required to comply with the requirements of the GDPR. Their activities are strictly monitored by us.

2. Recipients of data for the fulfilment of bookings and services:

• Business partners – travel agencies and their representatives, transport companies and airlines, providers of core and ancillary travel services, as well as other subcontractors with whom we have contracts.
• The data subject – You, when you exercise your rights to access or rectify your personal data.
• Customers or users of the servicesto whom the data relates (e.g. group bookings).

3. Public authorities and institutions:

• Ministry of the Interior – for the registration and notification of guests’ identities;
• Tax Administration (NRA) – for issuing invoices and fulfilling tax obligations;
• Municipality, National Social Security Institute (NSSI), Consumer Protection Commission, Personal Data Protection Commission, judicial and supervisory authorities – where there is a legal basis for the provision of data.

Your data is shared solely for the purposes of fulfilling contractual and legal obligations and is processed by third parties only to the extent necessary to fulfil these purposes.

To ensure the functioning of our services and platforms, your personal data may be transferred and processed outside the European Union, including to the USA. In such cases, we implement appropriate measures to protect your data in accordance with the requirements of the GDPR, including standard contractual clauses, to ensure an adequate level of protection. Please note that the legal framework for data protection in other countries may differ from that in the European Union.

• How do we protect your personal data?

At Zornitza Family Estate, the protection of your personal data is a priority. We implement all necessary organisational, technical and physical measures, in accordance with the General Data Protection Regulation (GDPR) and applicable national legislation, to ensure the security of the information you provide to us.

To this end:

• We maintain structures to prevent misuse and security breaches;
• We have appointed a Data Protection Officer (DPO) who monitors the proper implementation of protective measures;
• We use additional safeguards, including encryption, pseudonymisation and other technologies, where appropriate.
• Your rights as a data subject

As a customer or visitor to Zornitza, you have a number of rights under the GDPR which you may exercise in relation to your personal data. The provision of data is voluntary, but is necessary for the conclusion and performance of service contracts. If data is not provided, we cannot make bookings or provide other services.

We will respond to your requests within 30 calendar days. In exceptional cases, this period may be extended by a further 2 months, in which case we will notify you within 1 month of receiving the request.

Your rights under the GDPR

1. Right to information

You have the right to receive information about the processing of your personal data: purposes, legal basis, retention period, categories of recipients and more. If automated decision-making or profiling is used, you will be informed of the purposes and consequences thereof.

• Right of access

You may request a copy of all personal data we process about you. A reasonable fee may be charged for administrative costs in the event of additional data requests.

• Right to rectification

You have the right to request the rectification or completion of incomplete or inaccurate data.

• Right to erasure (‘right to be forgotten’)

You may request the erasure of personal data if:

• It is no longer necessary for the purposes for which it was collected;
• You withdraw your consent and there is no other legal basis;
• You consider the processing to be unlawful.

Erasure may be restricted if the law requires retention or there are legal obligations, pending proceedings or a need to protect rights.

• Right to restriction of processing

You may request restriction of processing if:

• You contest the accuracy of the data;
• The processing is unlawful, but you do not wish to have the data erased;
• The data is not necessary for us, but is needed to protect your rights;
• You object to the processing on grounds of legitimate interest.
• Right to data portability

You may receive your personal data in a structured, machine-readable format and transfer it to another controller where the processing is based on consent or a contract and is carried out by automated means.

• Right to object

You may object at any time to processing based on legitimate interest. If you have given consent for marketing, you have the right to withdraw it without giving a reason.

• Right to lodge a complaint

If you believe that we have breached applicable data protection legislation in the processing of your data and, as a result, your rights have been infringed, please contact us. Of course, you also have the right to lodge a complaint with the Personal Data Protection Commission, which is the supervisory authority in the field of personal data protection, at the following address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2, tel. 02/91-53-518, e-mail: kzld@cpdp.bg.

How can you exercise your rights?

You can submit a request to exercise your rights:

• In person or through an authorised representative (with a power of attorney) at the following address:
  Sofia, Oborishte district, 22 Oborishte Street, flat 1
• By email: marketing@zornitzaestate.com
• By telephone: +359 876143046

Exercising your rights is free of charge, except in rare cases of multiple requests that require significant resources – in which case a reasonable fee for administrative costs may be charged.

If you submit a request electronically, we will provide the information electronically as well, unless you request otherwise.

The identity of the person making the request is verified by an authorised company representative where we have reasonable doubts as to their identity.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal. Data may continue to be processed if there is another legal basis.