Privacy Policy of Pamporovo AD

We at Pamporovo AD strive to provide unique products, services and experience within the resort of the same name and in the ski area of the town of Chepelare. We highly value our business, but at the same time your security is extremely important to us. We know that privacy is an important issue. We act in the interest of our customers and are transparent about how we process your personal data.

We strive to make our website user-friendly and containing as much information as possible that may be of interest to you. We also take care of its safe use so that you are sure that your personal information and rights are protected. We have prepared the Privacy Notice to clarify our practices regarding the personal data we collect from you or about you on this site or through our applications, through written or oral communication with us when you visit any of our facilities, or from other sources.

In addition, the Privacy Notice gives you information on how to contact us, if you have questions about your personal data that we will gladly answer. Please, also read the separate Cookie Statement, which will introduce you to how Pamporovo.me uses cookies and other similar technologies.

By using our products or services and/ or by accepting this Privacy Notice, such as in the course of registration for any of our products or services, you consent to the collection and use of personal data, as described in this Privacy Notice.

We may from time to time amend the Privacy Notice of Pamporovo AD concerning the personal data policy. If you insist on the security of your data, visit this page regularly to stay up-to-date. If we make changes to the Privacy Notice concerning the personal data policy that will affect you (for example, if we intend to process your personal data for purposes other than those discussed in the previous Privacy Notice), we will notify you of these changes before taking any further action.

Unpleasant, but it should be mentioned: If you do not agree with certain aspects of our personal data policies, you must stop using our services. If you agree with our personal data policies, then you can easily book your next stay.

Please, note that this Privacy Notice does not apply to the way we process personal data on behalf of or as directed by third parties, such as other service providers, companies that organize or offer package travel services, marketing partners, or corporate clients.

Who are we?

Pamporovo AD is entered in the Commercial Register kept by the Registry Agency with UIC: 830166943.

What do we do?

Pamporovo AD, as a company operating in the field of tourism, processes personal data for the purpose of providing tourist services (accommodation at its own hotels or at the hotels it operates; providing food at its own restaurants, providing sports and recreational services at the hotel complexes, providing accommodation in other hotels as a tour operator, providing transportation services by buses and vans of the company as part of the package services that it offers or as a carrier, providing carriage of passengers by lift and towing facilities as a lift operator in the ski area of Pamporovo Resort and the town of Chepelare, rental of skiing and snowboarding equipment, ski training as the largest ski school within the resort, services for rental of shops, restaurants and other facilities, as well as other services related to the persons whose data are processed (data subjects), or for the purpose of considering the possibility of providing such services to the data subjects. The provision of personal data by the individuals is voluntary.  In case of refusal to provide personal data, Pamporovo AD will not provide the requested tourist services or perform the relevant commercial transaction, insofar as the processing of personal data is to the largest extent in fulfillment of the company’s legal and statutory obligations.

Contact details of Pamporovo AD

4870 Pamporovo Resort, Chepelare Municipality, Hotel Orlovetz

E-mail:           marketing@pamporovo.me

Telephone:     +359 3 0958409; 359 700 17 702

Fax:                + 359 3 0958110

Website:         https://www.pamporovo.me

Data Protection Officer (DPO) of Pamporovo AD:

Katerina Radicheva

E-mail:            dpo@pamporovo.me

Тelephone:      359 3 0958409

Personal information we collect

We collect personal information at any point of contact or interaction with our guests and in the performance of all aspects of our business. There is no way to help you book accommodation or use any of the services we provide, if you do not provide us with information. Therefore, when you use our services, we request certain information from you. This personal information may include: your name, mailing address, email address, IP address, telephone number, information related to your booking or stay; participation in a membership program or a loyal customer program of other partner organizations of Pamporovo AD that provides discounts on the price of various services; participation in a contest, lottery or marketing program (even if you are not accommodated in any of our hotels); information related to the purchase and receipt of products or services; personal characteristics, nationality; travel history; payment information such as your payment card number and other information about it, as well as authentication information and other details for invoicing and payment account related to mobile payments; guest preferences; communication and marketing preferences; groups you are connected with when staying at hotels; information provided for membership programs and account creation; other type of information that you have chosen to provide us or we may obtain for you.

We may request data on height, weight, gender, age, foreign language proficiency, related to the provision of the service for ski equipment rental and/ or ski school. We may also collect call-related information, including by recording and tracking customer service calls, for quality assurance and training, as well as other communications such as in-app messages and SMS.

In addition, we collect other personal information in certain cases, such as:

• Surveys: We may ask you for demographics and other personal data in user surveys. Completing the surveys is voluntary – we process the information received from you based on your consent and in support of our business interests, including marketing, service improvements and analyses.
• Collecting information at the site:
• When booking a hotel and staying at any of our hotel properties, we process your name, address, contact details and details of your stay (day and time of arrival and departure, vehicle information, and travel and stay information) based on our contractual relationship with you. We also process such data for our business interests, including marketing, service improvement, analysis and personalization of services.
• We collect additional personal information during the check-in / accommodation at our hotels such as Personal ID Number / Alien’s Personal Number, name, date of birth, gender, nationality, ID Card number or valid national identity document, country issuing the identity document, in order to comply with legal obligations under the Tourism Act (TA) and Foreigners in the Republic of Bulgaria Act (FRBA).
• We may also use an internal video surveillance system and other security measures in our facilities that can take or record photos of our guests and visitors in public places, as well as information related to your location during your stay in our facilities (through access cards and other technologies).
• We process personal information in connection with hotel-related serviced and use of ski area services (such as childcare services, equipment rental, individual or group ski teacher hire, use of lift facilities, etc.) to provide you with services and for our business interests, including for marketing, service improvement, etc.
• Event profiles: If you plan an event with us, we collect event details, event date, number of guests, guest room details, and for corporate events – information about your organization. We also collect information about guests who are part of your group or event. If you visit us as part of a group, we may have personal information provided for you by the group and you may receive suggestions from us as a result of your stay in a group or an event visit, depending on your preferences and to the extent permitted by law. If you visit us as a participant in an event, we may share your personal data with the event organizers, to the extent permitted by law. If you are an event organizer, we may also share information about your event with third-party service providers who may offer you their event services, to the extent permitted by law. We process the personal information received in connection with your event based on our contractual relationship with you and for our business interests, including marketing, service improvement, analyses and personalization of services.
• Social media: If you choose to participate in activities or offers on social networks sponsored by Pamporovo AD, we may receive certain information from your social network account according to your settings on the social network service, such as location, registrations, activities, interests, photos, status updates and list of friends. We may also give you the opportunity to participate in photo contests, such as those taken during your stay with us, which you can share with your contacts on the social networks for evaluation by voting, shared offers or other promotions. Participation in activities in social media, lotteries, competitions and other promotional offers sponsored by Pamporovo AD is voluntary, i.e. based on your consent. We also use certain information for our business purposes, including for marketing, service improvement and analyses.
• Subscribe to Pamporovo AD Newsletter / Direct Marketing: We use your information to send you marketing messages, news releases, promotional materials and materials for Pamporovo AD’s various services and to personalize the ads and content provided to you online, by email, mobile and visual ads, as well as on our sites and in our applications and through our customer service center, depending on your preferences for receiving messages based on your consent. You can withdraw your consent for direct marketing communications at any time by contacting us at marketing@pamporovo.me or by following the unsubscribe instructions in the marketing message or by logging into your account on our website and updating your preferences for communication.
• Job applications:  If you choose to apply for a job at Pamporovo AD online, see our note on the confidentiality of applicants.

In addition to the information we collect directly from you, we may also infer information about you from the data you provide us or from Other information we receive. We may also collect information about you from third parties, including our airline partners, payment cards, etc., from your social networking services in accordance with your settings for these services and from other sources that are third parties and are legally entitled to share your information with us. We use and share this information (and may add this information to other information that we have about you) for the purposes described in this Privacy Notice.

Pamporovo AD processes your data for the above-stated purposes on one or more of the following grounds:

• The processing is necessary to implement a contract with the Company, to which the data subject (tourist) is a party, or to take steps to conclude a contract at the request of the data subject;
• The processing is necessary to comply with a legal obligation that applies to the Company as a data controller;
• The data subject (tourist) has consented to the processing of his / her personal data for one or more specific purposes. The data subject (tourist) has the right to withdraw his / her consent at any time.
• The legitimate interest of Pamporovo AD or of a third party, when it takes precedence over the interests or fundamental right and freedoms of the data subject (tourist), for example for the purpose of preventing crimes, including fraud, preventing money laundering and other lawful purposes.

Processing of personal data by consent of the data subject / Right of withdrawal of consent:

Pamporovo AD processes personal data of the data subject (tourist) only with his / her consent in the following cases: (а) for the purposes of direct marketing; (b) when providing personal data to third parties; and (c) when processing sensitive data for the processing of which there is no regulatory obligation on the data controller.

In cases where we request consent for special (sensitive) personal data, we will always justify why and how this information will be used, except in cases where we process sensitive data in fulfillment of regulatory obligations.

In cases where the personal data of the data subject (tourist) are processed solely on the basis of his / her consent, you can withdraw your consent at any time by submitting a request of withdrawal of consent.

You do not have the right to withdraw your consent, if Pamporovo AD processes your personal data on the grounds and for the purpose of entering into a contract with Pamporovo AD, fulfilling a regulatory obligation of Pamporovo AD as a data controller or protecting the legitimate interest of Pamporovo AD or a third party.

Personal information we share

To provide you with the expected level of hospitality and best service, we may share your personal information with our service providers and other third parties, as described in detail below:

• Bulgarian, international or foreign bodies, institutions and persons to whom Pamporovo AD is obliged to provide personal data under the applicable legislation (Court; Prosecutor’s Office; Investigation Service; Ministry of Interior; Ministry of Tourism; National Revenue Agency; National Social Security Institute; National Statistical Institute; State Agency for National Security, etc.);
• Group events and meetings:  If you visit facilities of Pamporovo AD as part of a group event or a meeting, the information collected for planning the meeting and the event will be shared with the organizers of such meetings and events and, where necessary, with the guests who organize or participate in the meeting or the event.
• Business partners:  We may partner with other companies to provide you with products, services or offers based on your experience in our facilities, and may accordingly share your information with our business partners such as tour operators or other hotels, ski schools and wardrobes in cases where Pamporovo AD acts as a tour operator.
• Co-sponsoring promotions:  We co-sponsor promotions, lotteries, competitions or contests with other companies and provide prizes for competitions sponsored by other companies. If you participate in any of these competitions, we may share your information with joint sponsors or a third-party sponsor.
• On-site services: We may share personal information with third-party service providers who provide on-site services such as restaurant services, recreational and sports services, etc.
• Service providers:  We rely on third parties to provide services and products on our behalf and may share your personal information with them, as appropriate. In principle, our service providers are contractually obliged to protect your personal information and are not allowed to use or share your personal information in any other way, except as may be required by law. However, our fraud detection service providers may use your personal information, without sharing it, to detect fraud. We may use service providers to communicate news or provide promotional materials and transaction materials to you on our behalf, including personalized online and mobile ads, depending on your preferences and the applicable laws. For more information, please, see our Cookie Statement. Pamporovo AD will only work with persons who offer a method to unsubscribe from such advertising. We may also share information with service providers that enable you to create travel routes by selecting hotels, activities and restaurants from lists that we have personalized for you based on your preferences and information from third parties.
• Other:  Furthermore, Pamporovo AD may disclose personal information in order to: (а) comply with the applicable laws, (b) respond to requests from the government or requests from the public authorities, (c) comply with existing legal procedures, (d) protect the rights, privacy, safety or property of Pamporovo AD, site visitors, guests, employees or the public, (e) allow us to seek available indemnification or restrictions of damages that may be caused to us, (f) apply the Privacy Notice and the General Terms of our websites, and (g) respond in emergency situations.

Pamporovo AD does not apply automated decision-making, including profiling.

Other information

When you visit and use the websites and applications of Pamporovo AD, we collect other data that does not directly disclose your identity for your use of the site, such as a directory of the sites you visit and the number of your visits to our sites (‘Other Information’). We use other information and data obtained from third parties to provide you with email, online (on our websites or other websites) and mobile ads.

We use cookies and other technologies (such as ‘pixel tags’, ‘web beacons’, ‘clean GIFs’, email links, JavaScript, device IDs assigned by Google or Apple, or similar technologies) to obtain this information. If you want to remove or block Cookies at any time from your device, you can update your browser settings (see your browser’s help menu to learn how to delete or block Cookies). Pamporovo AD is not responsible for the settings of your browser. If you are located in Europe, you can also change your cookie preferences by making changes to the ‘Cookie Settings’ of the Cookie Consent Manager.

We do not currently respond to ‘Do Not Track’ alerts or similar mechanisms.  For more information, please, see our Cookie Statement.

We may use the information collected or aggregated by us or anonymized personal information obtained from third parties to learn more about our users (for example, we may use aggregated information to determine the percentage of our users with a specific phone code). This includes demographics such as date of birth, gender and marital status, implied commercial interests, such as favourite products or activities, and other information that we may collect from your or from third parties.

Because the Other Information does not disclose your identity, we may disclose this information for any purposes, where permitted by law.  In some cases, we may combine Other Information with Personal Information. If we combine Other Information with Personal Information, the combined information will be treated as Personal Data in accordance with this Statement.

Confidential information

The term ‘sensitive information’ refers to information, related to your racial or ethnical origin, political views, religious or philosophical beliefs, union membership, health status, sexual life or sexual orientation, genetic information, criminal history, and any biometric data used to for identification purposes.

Generally, we do not collect sensitive information, unless it has been voluntarily provided by you or if we are not required to do so by the applicable laws or regulations. We may use the health information provided by you to better serve and meet your specific needs (for example, to provide access for disabled people).

Personal information from children

We do not knowingly collect personal information from persons under the age of 18. As a parent or legal guardian, do not allow your children to submit personal information without your permission. For children under the age of 16, the use of our services is permitted only with the consent of a parent or guardian. In rare cases, as part of the booking, the ordering of services related to the travel or other emergencies (such as family amenities), Pamporovo.me may only collect and use information for children with the consent of a parent or guardian. If we process information about a child under the age of 16 without the clear consent of a parent or guardian, we reserve the right to delete this information.

Mobile services

We provide mobile applications that you can download to your smartphone or mobile device. In addition to providing services, our applications may collect Personal Information and Other Information that will be used in accordance with this Privacy Notice. We provide all of these mobile and location-based services only to the extent permitted by the applicable laws.

Links to third-party websites and services

Our site and our mobile applications may contain links to third-party websites. Please, note that we are not responsible for the collection, use, maintenance, sharing or disclosure of data and information from such third parties. If you provide information and use third-party websites, the Privacy Notices (Declarations) and General Terms of Service of these sites will apply. We recommend that you read the Privacy Notices (Declarations) on the websites you visit before submitting personal information.

Personal data protection

Pamporovo AD will take reasonable steps in order to: (а) protect the personal information against unauthorized access, disclosure, alteration or destruction, and (b) maintain the personal information accurate and up-to-date. The team of Pamporovo AD is responsible for monitoring our systems for potential intrusions, responding to a potential incident, maintaining information security and providing information security training of Pamporovo AD. IT professionals provide control over the systems that support certain accounting, registration, management and financial functions. In the event of a security incident, Pamporovo AD will notify the regulatory authorities and/ or users, as required by the applicable laws or regulations.

We also require our partners and service providers, with whom we share personal information, to make reasonable efforts to ensure the confidentiality of your personal information. For online transactions, we use technological means within the reasonable limits of protecting the personal information you send us through our website. However, unfortunately, there is no security system or data transfer system on the Internet that is fully secure.

For the protection of your privacy, please, do not send your payment card numbers or other confidential personal information by email.

We will contact you via mobile / text message or email to ask you to provide your confidential personal data or your payment card data. We will request payment card details by phone, only when you make a booking or book a promotional package.

Transfer of personal data abroad

Pamporovo AD does not intend to transfer your personal data to third parties in non-EU countries or international organizations without first obtaining your consent, except when required by law by Competent Authorities.

Your rights as a data subject. Alteration and access.

At any time while we are storing or processing your personal data, you have the following rights:

• You have the right to request a copy of your personal data, which is processed by Pamporovo AD, and the right to access your personal data at any time;
• You have the right to request from Pamporovo AD to submit your personal data in a form convenient for transfer to another data controller and to request us to do it without being hindered by us;
• You have the right to ask Pamporovo AD to correct without undue delay your inaccurate personal data, as well as data that are no longer up-to-date;
• You have the right to request from Pamporovo AD your personal data to be deleted without undue delay, if any of the following reasons is available:
  • the personal data are no longer needed for the purposes for which they were collected;
  • when you have withdrawn your consent /in cases where the processing of your personal data is solely based on your consent/;
  • when you have objected to the processing,
  • when the processing is unlawful;
  • where the personal data must be deleted in order to comply with a legal obligation under the EU or Member State law that applies to us as a data controller;
  • where the personal data have been collected for the provision of information society services.

We may refuse to delete your personal data for the following reasons:

• to comply with a legal obligation of Pamporovo AD;
• for statistical purposes, to the extent that the deletion is likely to make impossible or seriously impede the achievement of the objectives of such processing, or for the establishment, exercise or defense of legal claims;
• you have the right to request from Pamporovo AD to restrict the processing of your personal data, in which case the data will only be stored and not processed. Our refusal to restrict will explicitly be only in writing and we must motivate it for a legitimate reason;
• you have the right to withdraw your consent to the processing of your personal data at any time by a separate request made to the data controller, in cases where the processing of your personal data is solely based on your consent;
• you have the right to object to certain types of processing, such as direct marketing (unsolicited advertising messages);
• you have the right to object to automated processing, including profiling;
• you have the right not to be subject to a decision based solely on automated processing, including profiling;
• if we need to use your personal data for a new purpose that is not covered by this Privacy Notice, we will provide you with a new Privacy Notice and, when and where necessary, will require your prior consent for the new processing.

All above requests will be forwarded, if there is a third party (recipients, including non-EU and international organizations), when processing your personal data.

Right of appeal to the supervisory authority

You have the right to submit a complaint directly to the supervisory authority, as the competent authority in Bulgaria is the Personal Data Protection Commission, with address: No: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia (www.cpdp.bg).

If you wish to submit a complaint regarding the processing of your personal data through Pamporovo AD (recipients, including non-EU and international organizations), you can submit it to the specified contact details of Pamporovo AD or directly to the Data Protection Officer (at the above-stated contact details.)

Storage of personal data

We will store your personal data for the period necessary to achieve the objectives set in this Privacy Notice, unless a longer storage period is required and/ or permitted by the applicable laws. We will retain the personal information collected to fulfill guest bookings for seven years after the end of the stay. We will retain other personal information for shorter periods, if possible and if permitted by the law.

We will destroy your personal data as soon as possible and in such a way that it cannot be reproduced or restored.

If printed on paper, the personal data will be destroyed securely by machine shredding (shredder) into small parts or otherwise, and if in electronic form, the personal data will be destroyed by technical means so that it cannot be reproduced or restored.

We will take all necessary technical and organizational measures to protect your data from unauthorized access.

Choice - marketing communications

If you have provided us with contact information (mailing address, fax number, email address or telephone number), we may wish to notify you of our products and services, depending on your preferences, or to invite you to participate in events by or via email, online advertising, social networks, telephone, text message (including SMS and MMS), push notifications, in-app notifications, mail, our customer service center and other means (including in-room messaging, such as in-room TV).

If you prefer not to send you marketing materials by email, you can unsubscribe at any time by using the unsubscribe feature of the email received from us. It can take up to ten business days to fulfill unsubscribe requests.

You can control the sending of push notifications to you from our mobile applications by changing the notification settings on your mobile device. If we send you in-app messages, we will provide you with an option to control them in our app settings. For more information on cookies and interest-based ads and to learn how these technologies are managed, please, see our Cookie Statement.

Changes to the Statement

We may periodically change this Privacy Notice. When we make significant changes to this Privacy Notice, we will post a link to the updated Privacy Notice on the homepage of our website and, if you have signed up for any of our products or services, we may also notify you through the communication channel provided by you. You will find out when this Privacy Notice was updated by checking the link and the date at the beginning of the Privacy Notice. Any changes to our Privacy Notice will take effect upon posting of the amended Privacy Notice on the website. By using the website and/ or any of our products and services and/ or by accepting the updated Privacy Notice after such changes, you accept the currently amended Privacy Notice.

Who is responsible for processing personal data in Pamporovo AD (Pamporovo.me) and contacting us

If you have any questions about this Privacy Notice or about how Pamporovo AD processes your personal data or if you would like to send us a compliment or a complaint, you can contact us by email at: dpo@pamporovo.me or by mail at address: Pamporovo AD, Pamporovo Resort, Hotel Orlovetz, Data Protection Officer. We will respond within 30 days or sooner, if applicable. If necessary, this period may be extended by another two months. The company shall inform the data subject of any such extension within 1 month of receipt of the request, indicating the reasons for the delay. Where the data subject submits a request by electronic means, the information shall, where possible, be provided by electronic means, unless otherwise requested by the data subject.

The Privacy Notice of Pamporovo AD is based on:

Regulation (ЕU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, collectively referred to as the ‘General Data Protection Regulation’ (GDPR).

Questions and Answers:

What are personal data?

According to the General Data Protection Regulation, personal data are defined as:

‘Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.

Can I find out what personal data you have and process?

Pamporovo AD will, at your request, answer you what information we store for you and how it is processed.

If we are processing your personal data, you can request the following information:

• contact details of the Data Protection Officer;
• the purposes of processing;
• the legal basis of processing;
• the relevant categories of personal data being processed;
• the recipients or categories of recipients to whom the data is or will be disclosed;
• the recipients in third countries or international organizations, if there is a transfer of personal data to them, as well as guarantees that their data security will be at least at EU level;
• if the processing is based on the legitimate interests of Pamporovo AD or a third party, information about these interests;
• the period for which the personal data will be stored;
• details of your rights to request correction or deletion of personal data or restriction of the processing of personal data, as well as to object to such processing;
• information about your right to withdraw your consent at any time;
• details of your right to appeal to a supervisory authority;
• information on whether the submission of personal data is a mandatory or contractual requirement or a requirement necessary for the conclusion of a contract, and whether or not you are obliged to provide personal data and the possible consequences of the inability to provide such data;
• the source from which your personal data is collected, when not collected directly from you;
• all details and information about the availability of automated decision-making, such as profiling and any meaningful information about the underlying logic of these operations, as well as the significance and expected consequences of this processing.

How to receive access to my data that are processed?

You need to fill in a Data Subject Request Form or to submit a request to the specified contact details of Pamporovo AD or directly to the specified contact details of the Data Protection Officer.