Book a table
Book a table

Privacy Policy

Privacy Policy

 

This Privacy Policy is based on the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

 

GENERAL PROVISIONS:

 

Art. 1 (1) In connection with the provision of its services and the conduct of its activities, “ALPINЕ PROPERTY GROUP” Ltd. (hereinafter referred to in this Policy as “Restaurant Vratsata”) processes, as a controller, the personal data of its customers—natural persons—as well as the personal data of other individuals listed below (“Data Subject(s)”) in accordance with the rules and principles set forth in this Policy.

 

(2) “ALPINЕ PROPERTY GROUP” Ltd. is a company with UIC 206216850, with its registered office and address of management in Sofia 1415, Vitosha District, 28 Mavrovets Str.

 

(3) “Restaurant Vratsata” processes personal data in connection with its activities and determines the purposes and means of such processing. In this case, “Restaurant Vratsata” acts as a data controller.

 

(4) In cases where “Restaurant Vratsata” processes personal data for purposes determined independently by a third party or where the purposes are determined jointly by “Restaurant Vratsata” and a third party, “Restaurant Vratsata” acts either as a data processor (if the purposes are determined by the party that commissioned the processing) or as a joint controller.

 

Art. 2. Through these rules, “Restaurant Vratsata” regulates the processing and protection of personal data of its customers—natural persons—as well as of all other groups of individuals with whom “Restaurant Vratsata” enters into a relationship in the course of exercising its powers and conducting its activities.

 

Art. 3. (1) “Restaurant Vratsata” is a data controller within the meaning of Art. 4, item 7 of the General Data Protection Regulation (EU) 2016/679 and the Personal Data Protection Act.

 

(2) As a personal data controller, “Restaurant Vratsata” complies with the principles of personal data protection set forth in the General Data Protection Regulation (EU) 2016/679 (“the Regulation”), as well as European Union legislation and the Personal Data Protection Act.

 

PRINCIPLES OF PERSONAL DATA PROTECTION

 

Lawfulness.

 

Art. 4. “Restaurant Vratsata” processes personal data only when there is a legal basis for specific processing or when the data subject has given their explicit consent to the processing.

 

Art. 5 (1) Data processing based on the data subject’s consent is carried out when there is no processing for the purposes of the legitimate interest of “Restaurant Vratsata”;

 

(2) In cases where data of children under 14 years of age is processed, such processing is lawful only if and to the extent that such consent is given by the person exercising parental responsibility for the child;

 

(3) To fulfill and demonstrate compliance with “Restaurant Vratsata’s” obligation to obtain informed consent, data subjects are provided with a Declaration of Consent for the Processing of Personal Data;

 

(4) “Restaurant Vratsata” ensures that the data subject may withdraw their consent to data processing at any time.

 

Fairness and transparency.

 

Art. 6. (1) In compliance with the requirements of good faith and transparency in processing, according to which individuals should be informed of how their personal data is collected, used, or otherwise processed, as well as the scope of the data processing that is or will be carried out, “Restaurant Vratsata” informs data subjects of this processing.

 

Legal Determination of Purposes and Further Processing.

 

Art. 7. (1) The data collected by “Restaurant Vratsata” is related to purposes precisely defined by law (as a rule) or by “Restaurant Vratsata” (as an exception).

 

(2) Further processing is permitted solely for archiving or statistical purposes, provided there is no incompatibility with the established purposes.

 

Data minimization.

 

Art. 8. “Restaurant Vratsata” does not require the provision of more data than necessary, based on a legally defined minimum; where no such legal definition exists, compliance with this principle is the responsibility of the controller, who determines the scope of information required from data subjects.

 

Accuracy.

 

Art. 9. “Restaurant Vratsata” provides the opportunity to update inaccurate and incomplete data in accordance with the procedure for exercising the right to rectification. “Restaurant Vratsata” strives to ensure that the data it processes is accurate and complete. In connection with compliance with this principle, data subjects may request the updating and correction of their personal data.

 

Limitation of Storage.

 

Art. 10. (1) “Restaurant Vratsata” stores personal data only for the time necessary to carry out the processing activities and/or the functions and purposes of the hotel, unless a different storage period is required by law.

 

(2) Once the purposes for which the data was collected have been achieved, upon expiration of the retention period, at the request of the data subject (if applicable), or as necessary, the data shall be destroyed in a manner that prevents its recovery.

 

Integrity and Confidentiality.

 

Art. 11. “Restaurant Vratsata” processes personal data in a manner that ensures an appropriate level of security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by applying appropriate technical or organizational measures.

 

Security of personal data when processed by third parties.

 

Art. 12. (1) “Restaurant Vratsata” requires that technical and organizational measures be provided by those processing personal data on its behalf, which are included in the contract with each processor. The processor must demonstrate the necessary level of personal data protection, in accordance with the level of protection specified by “Restaurant Vratsata.”

 

Accountability and Documentation.

 

Art. 13. In accordance with the principle of accountability, “Restaurant Vratsata” documents the fulfillment of all its obligations regarding the protection of personal data.

 

PURPOSES OF PERSONAL DATA PROCESSING

 

Art. 14. Depending on the legal basis for processing personal data, “Restaurant Vratsata” collects, stores, and processes the information described in this Policy on the following grounds and for the following purposes:

 

  1. Purposes related to compliance with “Restaurant Vratsata’s” legal obligations;

 

  1. Purposes related to and/or necessary for the performance of contracts entered into with “Restaurant Vratsata” or for taking steps at the request of the Data Subject prior to entering into a contract;

 

  1. Purposes of the legitimate interest of “Restaurant Vratsata” or third parties;

 

  1. Purposes for which the Data Subject has consented to the processing of their data, including:

 

(a) Sending marketing and promotional messages regarding services, special offers, packages, events, and the like;

 

(b) Surveys regarding service quality;

 

(c) Sending newsletters;

 

(d) Other purposes for which the Data Subject has specifically provided consent.

 

DATA SUBJECTS

 

Art. 15. In connection with the services provided, “Restaurant Vratsata” processes information regarding the following Data Subjects:

 

  1. individuals visiting the website;

 

  1. natural persons who make reservations on their own behalf or on behalf of another natural or legal person via the Website;

 

  1. natural persons using the services provided by “Restaurant Vratsata,” including, but not limited to, restaurant services and related hospitality services, the provision of venues for organizing events, and other similar services, as well as natural persons representing or otherwise acting on behalf of legal entities that use these services;

 

  1. individuals who have submitted, on their own behalf or on behalf of another person they represent, inquiries, requests, reports, complaints, or other correspondence to “Restaurant Vratsata”;

 

  1. Individuals whose information is contained in inquiries (including via phone calls), requests, reports, complaints, or other correspondence to “Restaurant Vratsata.”

 

CATEGORIES OF PERSONAL DATA:

 

Art. 16 (1) Data related to the provision of restaurant services:

 

(a) Identification data: names.

 

(b) Contact details: telephone number; email address;

 

(c) Financial information or billing data—name of the legal entity; address of the legal entity; VAT number and/or other tax or registration number (for sole proprietors and individuals), card type and number, cardholder’s name, expiration date, as well as other information provided by the card-issuing bank.

 

(d) Information related to the customer’s special preferences and requirements regarding the service provided;

 

(2) Digital data – video recordings: This refers to data collected through the video surveillance systems used by “Restaurant Vratsata” in all premises for the purposes of security, monitoring, control, and protection of public order.

 

(3) In connection with the services and functionalities of the Website:

 

(a) Data processed in connection with making a reservation: names; phone number; email address; number of guests; special offers and guest preferences (if explicitly specified at the time of booking);

 

(b) “Cookies”: The use of “cookies” is necessary for the Website to function. A detailed description of the “cookies” used, their purpose, and the information processed through them can be found on the “Restaurant Vratsata” website, in the “Cookie Policy” section.

 

(6) With regard to complaints, applications, requests, petitions, and reports submitted by customers (including those in free-form text): information contained in the relevant complaints, applications, requests, petitions, and reports.

 

VIDEO SURVEILLANCE AND SECURITY

 

Art. 17 (1) In accordance with the requirements of applicable law, “Restaurant Vratsata” implements security measures that include the following technical means for access control and for ensuring security against intrusions into buildings and premises, as well as for the protection of the life and health of citizens: security alarm systems and a video surveillance system providing 24-hour video monitoring and consisting of recording and storage devices.

 

(2) Video surveillance and video recording may be conducted in publicly accessible areas and premises within “Restaurant Vratsata” and in those for which a special access regime is in place. Video surveillance is not conducted in sanitary facilities.

 

(3) Through information boards placed in a conspicuous location, Data Subjects and other visitors who may be recorded are notified of the use of technical means for surveillance and monitoring and of any other relevant information regarding the surveillance being conducted.

 

REFUSAL TO PROVIDE PERSONAL DATA TO “Restaurant Vratsata”

 

Art. 18. (1) “Restaurant Vratsata” clearly states, where applicable, whether the provision of the relevant data and/or documents is mandatory for the conclusion or performance of a contract, as well as the consequences of a refusal to provide such data.

 

(2) If additional information is required, any Data Subject may request it at “Restaurant Vratsata” locations or submit an inquiry to the contacts specified in Article 23 of this Policy.

 

(3) The Data Subject’s refusal to provide data and documents, when they are specified as mandatory, may constitute an insurmountable obstacle to the provision of a service by “Restaurant Vratsata,” as well as to the processing of submitted requests, applications, petitions, reports, etc. In such cases, “Restaurant Vratsata” is released from liability for non-performance.

 

(4) The provision of false data and documents may result in the inability to provide the relevant services or in the suspension of access to services provided by “Restaurant Vratsata”

 

PROCESSING OF INFORMATION BY THIRD PARTIES – PERSONAL DATA PROCESSORS

 

Art. 19. (1) For the purposes specified in this Policy and in connection with the services provided, “Restaurant Vratsata” may entrust personal data processing activities to third parties – data processors, in accordance with and within the scope of the requirements of the Regulation and this Policy.

 

(2) In the event of disclosure and processing of data by a third-party processor, this shall occur only to the extent and to the extent necessary for the performance of the tasks assigned to them by “Restaurant Vratsata.”

 

(3) Data processors act on behalf of “Restaurant Vratsata” and are obligated to process personal data solely in strict compliance with the instructions of “Restaurant Vratsata,” and shall not have the right to use or process the information in any other way for purposes other than those specified in this Policy.

 

RIGHTS OF DATA SUBJECTS

 

Art. 20. (1) Every data subject has the following rights regarding the processing of personal data concerning him or her:

 

  1. Right to information – to receive confirmation as to whether personal data concerning him or her is being processed, as well as to receive information regarding the processing being carried out;

 

  1. Right of access – to access the personal data being processed and to receive detailed information regarding the processing and their rights;

 

  1. Right to rectification – to request the correction or completion of their personal data if it is inaccurate or incomplete;

 

  1. Right to erasure – to request the erasure of their personal data if there are grounds for doing so;

 

  1. Right to restriction of processing – The data subject has the right to request that the controller restrict processing when they consider that the data is inaccurate or is being processed unlawfully;

 

  1. Right to data portability – to receive the personal data concerning him or her that he or she has provided to “Restaurant Vratsata” in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance from “Restaurant Vratsata.”

 

The right to data portability applies if the following two conditions are met:

 

(a) the processing is based on consent or a contractual obligation; and

 

(b) the processing is carried out by automated means.

 

  1. Right to withdraw consent to processing – where the processing of personal data is based solely on the consent given by the Data Subject, the Data Subject may withdraw their consent at any time. Such withdrawal does not affect the lawfulness of the processing based on the consent given prior to its withdrawal;

 

  1. Rights regarding automated individual decision-making, including profiling – not to be subject to an automated decision based solely on automated processing (i.e., processing without human intervention), including profiling within the meaning of the Regulation, which produces legal effects concerning the Data Subject or similarly significantly affects him or her, unless the grounds provided for in the Regulation exist and suitable safeguards to protect the rights and freedoms and legitimate interests of the Data Subject are in place. Such safeguards shall include, at a minimum, the right to human intervention, the right of the Data Subject to express his or her point of view, and the right to challenge the decision.

 

  1. Right to object – The data subject has the right, at any time and on grounds relating to his or her particular situation, the right to object to the processing of personal data concerning him or her, including profiling within the meaning of the Regulation, which is based on public interest, the exercise of official authority, or the legitimate interests of “Restaurant Vratsata” or a third party. In such cases, “Restaurant Vratsata” shall cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defense of legal claims.

 

Art. 21. The CONTROLLER shall ensure conditions that guarantee the exercise of these rights by the data subject:

 

(1) The data subject may exercise their rights related to personal data protection by personally submitting a written request to “Restaurant Vratsata”—submitted in person by the data subject at the address specified in Article 23 of this Policy or via a request sent by mail.

 

(2) The request under paragraph 1 may also be submitted electronically; for this purpose, it must be signed by the data subject with a qualified electronic signature and sent to “Restaurant Vratsata” at the email address specified in Article 23 of this Policy.

 

(3) Data subjects have the right to file complaints with the CONTROLLER, through the Data Protection Officer, regarding the processing of their personal data.

 

(4) The data subject may exercise the rights related to their personal data in person or through a person expressly authorized by them.

 

Supervisory Authority in the Republic of Bulgaria

 

Art. 22. The supervisory authority in the Republic of Bulgaria is:

 

Commission for Personal Data Protection

 

Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

 

Website: https://www.cpdp.bg/

 

Additional Information

 

Art. 23. The data subject may obtain clarification regarding the content and grounds for data processing, the manner of exercising rights under this Policy, as well as any additional information regarding their rights in connection with the processing of personal data by “ALPIN PROPERTY GROUP” Ltd. at:

 

Address: Hotel “Dom na Alpinista,” “Vratsata Restaurant,” Vratsa, “Markov Kamak” area

 

Email address: gm@domnaalpinista.bg

 

Phone: +359 87 670 0048

 

Data Protection Officer: Savva Chulkov

×