Privacy policy
-
Privacy Policy
Last updated: 12 August 2026
Zlatarov - Kapital OOD (“Hotel Iva & Elena”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal data when you visit www.ivaielena.com, make an enquiry or reservation, or stay at Hotel Iva & Elena.
1. Data Controller and Contact Details
The controller of your personal data is:
Zlatarov - Kapital OOD
UIC: 123680994
Registered address: 99 Sava Silov Street, Stara Zagora, Bulgaria
Hotel address: Studenets Area, Pamporovo, Bulgaria
Telephone: +359 885 110 202
Email: zlatarovkapital@gmail.comFor all questions concerning personal data and to exercise your data protection rights, please contact us at: zlatarovkapital@gmail.com.
2. Personal Data We Collect
Depending on how you interact with us, we may collect and process:
identification and contact details, such as your name, telephone number, email address and address;
reservation details, including arrival and departure dates, accommodation type, number of guests, special requests and preferences;
guest registration data required under applicable law, including identity-document information where required;
payment and invoicing information;
correspondence sent through our website contact form, by email or telephone;
data received through third-party booking platforms;
CCTV footage from monitored areas of the hotel;
technical and usage information collected through cookies and Google Analytics, such as IP address, browser type, device information and website activity.
We do not intentionally collect special categories of personal data unless this is necessary to provide a requested service or required by law.
3. Why We Use Your Personal Data
We process personal data for the following purposes and legal grounds:
To respond to enquiries and provide information — where necessary to take steps at your request before entering into a contract.
To make, confirm and manage reservations — where necessary for the performance of a contract or to take steps before entering into a contract.
To provide accommodation and hotel services — where necessary for the performance of a contract and compliance with legal obligations.
To register guests and comply with tourism, tax and accounting requirements — where necessary to comply with legal obligations.
To process payments and issue invoices — where necessary for the performance of a contract and compliance with legal obligations.
To protect guests, employees and hotel property — based on our legitimate interest in maintaining safety, preventing misconduct and investigating incidents.
To send newsletters and promotional messages — based on your consent. You may withdraw your consent at any time.
To operate and improve our website — based on your consent where required, or our legitimate interest in maintaining the website’s essential technical functionality.
Where the provision of personal data is necessary for a reservation, stay, registration or payment, failure to provide the required data may prevent us from providing the requested service.
4. Reservations and Payments
Direct reservations made through our website are managed through Exely. We may also receive reservation data from third-party booking platforms, such as Booking.com, Expedia and similar platforms, when you use them to book your stay.
Online payments are processed through DSK Bank VPOS. We do not store full payment-card details. Payment information is handled by the relevant payment service provider in accordance with its own privacy and security procedures.
5. CCTV
CCTV is used in the hotel’s common areas, entrances, reception, parking areas and exterior areas for the protection of guests, employees and property, and for the prevention and investigation of incidents.
CCTV is not used in guest rooms, sanitary facilities, changing rooms or the relaxation centre.
CCTV recordings are retained for 30 days, unless a recording is required for the investigation of a specific incident, the establishment or defence of legal claims, or compliance with a legal obligation. Access to recordings is restricted to authorised personnel.
6. Who May Receive Your Data
Where necessary, we may share personal data with:
Exely, as our reservation-system provider;
DSK Bank VPOS, for payment processing;
third-party booking platforms through which you make a reservation;
SuperHosting, as our website hosting provider;
public authorities, municipalities, tax authorities, law-enforcement bodies or courts where disclosure is required by law;
professional advisers, insurers or other service providers where necessary to protect our legal rights or legitimate interests.
We require service providers processing personal data on our behalf to apply appropriate confidentiality and security measures. We do not sell personal data or disclose it to third parties for their own marketing purposes.
7. International Data Transfers
Our service providers are primarily based in the European Union or European Economic Area. Some services, including third-party booking platforms and Google services, may involve processing or access to data outside the European Economic Area.
Where such transfers occur, we will ensure that appropriate safeguards are used in accordance with applicable data protection law, such as an adequacy decision or standard contractual clauses.
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law.
Enquiries submitted by email or contact form are retained for one month after the end of the communication.
Reservation and stay-related data are retained for five years.
Accounting and tax documents are retained for the period required by applicable law.
Marketing data are retained until you unsubscribe or withdraw your consent.
CCTV footage is retained for 30 days, unless a longer period is necessary in connection with a specific incident or legal matter.
9. Your Rights
Subject to the conditions set out in applicable law, you have the right to:
request access to your personal data;
request correction of inaccurate or incomplete data;
request erasure of your data where applicable;
request restriction of processing;
object to processing based on legitimate interests;
request portability of data processed by automated means on the basis of consent or contract;
withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with the Bulgarian Commission for Personal Data Protection.
To exercise any of these rights, please contact us at zlatarovkapital@gmail.com. We may request additional information to verify your identity. We will respond within the period required by applicable law.
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection at:
Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria
https://www.cpdp.bg10. Cookies and Google Analytics
Our website uses cookies and similar technologies. Cookies help us ensure the website functions correctly, remember preferences and understand how visitors use the website.
We use Google Analytics to collect aggregated information about website usage. Google Analytics cookies are used only in accordance with your cookie preferences.
You can manage or withdraw consent for non-essential cookies through the cookie banner on our website. You may also control cookies through your browser settings. Disabling certain cookies may affect some website functions.
11. Security
We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The latest version will always be published on www.ivaielena.comtogether with its last updated date.