Privacy Policy

NOTIFICATION OF CONFIDENTIAL TREATMENT OF PERSONAL DATA (PRIVACY STATEMENT)

As a personal data controller, Vital Tour Ltd has a duty to inform you what to expect when it processes your personal information.

Details of the Administrator:

Who are we?

Vital Tour Ltd.

Vital Tour Ltd. is a trading company, owner of Spa Hotel Olimp Velingrad

Contact details Vital Tour Ltd.

Location:

Country.

Address. Velingrad, 1A Tsar Samuil Street

For reservations: +359 887 336863 ; +359 888 510 806

Email : reservations@olymp-bg.com

Seminars and events: office@olymp-bg.com

Marketing: marketing@olymp-bg.com

Contact details of the data protection officer:

E-mail: gdpr@olymp-bg.com

Maria Dermendzhieva

Vital Tour Ltd. is a data controller in respect of the data of its employees and contractors, and collects data of individuals to the extent necessary for the provision of a particular type of service, storing it responsibly and lawfully.

The personal data we may collect and process from you are:

Personal Data Category:

- first name, surname and last name;

- permanent address;

- date of birth/age;

- Unique Civil Number (UCN);

- email address;

- identity card/passport number;

- Internet Protocol (IP) address;

· cookie ID;

We may collect the following sensitive data only after obtaining your prior consent and/or where required to do so to comply with a legal obligation:

- Employee health data relating to rights under employment and social security legislation, such as employment, compensation, occupational health or social benefits such as supplementary health insurance; biometric data (fingerprint/template - mathematical code generated on the basis of a fingerprint); gender data (as required by the Tourism Act);

Source:

From the data subject (i.e. you) - we receive personal data from the data subject in person or by correspondence: by email or online contact form, by providing private or official documents.

From travel agents and partner tour operators;

From third parties: from people authorised to act on your behalf, from event organisers who provide data in connection with the organisation and conduct of the event, and from legal representatives regarding the persons they represent;

We declare that the personal data we collect will only be used for the following purposes:

• Human Resources;
• Counterparties;
• CCTV;
• Visitors;
• Complaints, signals and other requests,
• Data Breach Notifications;

The personal data we collect is used solely for the following purposes:

Purposes and principles of the use of personal data, that we collect:

The processing of your data is pursuant to the following grounds set out in Art. 6 para. 1 of the Regulation:

- Performance of obligations under a contract or for taking steps at the request of the customer before entering into a contract

- Compliance with a legal obligation applicable to the company

- For the purposes of our legitimate interest

- Explicit consent obtained from you as a customer;

Collection of personal data for the purpose of performing obligations under contracts.

In the performance of its activities, the company processes personal data of individuals for the performance of the contracts it concludes. In connection with the performance of these contracts, personal data of individual natural persons is processed, and information about them is processed in a minimum amount sufficient for the accurate performance of the obligations under the relevant contract. Access to this information shall only be granted to third parties where this is specified in a specific law. The Company only accepts and stores data that is necessary and relevant to the service provided.

The Company, as a personal data controller, does not accept or process personal data „by default“, even when received from another controller after a request for their transfer, and does not store all data received. These data shall be managed only for his needs and not for other purposes.

For the performance of its obligations under a contract, the company sometimes also processes data of children under the age of 18, which is provided by their legal representatives - a party to a contract with us. Children's data in hotel accommodation is necessary insofar as it is required by law.

In addition to the above purposes, Vital Tour Ltd. collects and processes personal data for the purpose of human resources management - personal data of job applicants, current and former employees of the company. In the course of human resources management activities, data on identification of natural persons, data on education and qualification, health data, contact data, as well as other data required by special laws regulating employment relations, tax and insurance relations, accounting of activities, safe and healthy working conditions, and social issues are processed.

In connection with the performance of employment relationships, only the personal data required by law are processed and stored for the periods specified by employment and social security legislation. Employee data is processed for the purposes of employment, tax and social security legislation (Labour Code, CSR, Social Security Code) and for the purposes of contractual relations in the performance of your job description. The processing of your health data is necessary for the purposes of preventive or occupational medicine, as well as under the Medical Examination Act and the CSR (for sick pay, maternity insurance, etc.).

Activities to ensure occupational health and safety shall be regulated by contract with the occupational health service in accordance with Ordinance No. 3 of 25 January 2008 on the conditions and procedure for the activity of the occupational health services.

Collection of personal data to respond to complaints, alerts and other requests

Complaints, signals and other requests in connection with the exercise of the powers of the company shall be submitted in accordance with the terms and conditions of the legislation in force. In processing the information contained in complaints, alerts and other requests lodged with the company, only personal data relevant to the specific case shall be processed. Data made known to the company in this connection may be disclosed to third parties only if provided for by law.

The collected data shall be used only for the purposes mentioned above and shall only be made available to third parties where this is provided for by law. In such cases, data may be provided, for example, to the NRA, the General Directorate of Labour Inspection and other public authorities, in view of their powers and competence. The information is not stored outside the EU and the European Economic Area. The Company ensures appropriate technical and organisational measures to protect your personal data.

 The grounds that entitle us to process your data are:

The processing is necessary to comply with our legal obligation:

- the Tourism Act, the Obligations and Contracts Act,

- Labour Code, Social Security Code and its by-laws

- the Tax Code and the VAT Act for the purposes of taxation (when issuing invoices)

- The Civil Registration Act (compulsory hotel registration in the place where you will stay)

- the Electronic Document and Electronic Certification Services Act (for payments via POS terminals). When using a virtual POS payment is directly to the bank, through the BORICA system. We do not process financial and banking information. Only your bank and the BORICA system do this. In this sense, payment via a virtual POS terminal is no different than payment via a physical POS terminal.

- Banking Act (in relation to payments) and the Anti-Money Laundering (Currency Exchange) Act;

The processing of your data on the basis of a contract with you.

The processing is based on:

- the mutually agreed consent, in case one of the above legal grounds is not present.

- for statistical purposes (in relation to interest in a product we offer).

- for the exercise or defence of legal claims.

- where the company has commissioned a third party to process personal data for the purposes of using a service.

- when booking a service provided through our hyperlink(s), we act only on your instruction as a user of the service and only to the extent that we can have control over the personal data you provide. Fairplay Properties Management has no control over the content and data that you, as a service user, choose to enter into the online system (including whether or not such data includes personal data within the meaning of the Regulation). In this case, the company has no role in deciding whether the user uses the service to process personal data, for what purposes and whether the same is correct. Fairplay Properties Management's responsibility in this case is limited to complying with the service user's instructions according to the contract and the booking system's terms and conditions and providing information about the service and its functionalities via its interface.

The processing of your data is based on your consent

• When organizing events, using services, etc.
• For marketing and communication. To the extent permitted, we may use your personal data to provide or offer you newsletters, promotions and up-to-date special offers, and other marketing communications depending on your stated preferences for receiving communications. We use your personal data to provide you with messages during your stay, notifications in relation to accounts and booking confirmations, to send you marketing messages and to run surveys, promotions and other competitions. We may provide these communications via email, mail, telephone and other means (including on-premises announcements, such as through the television in your room). With your consent, we also use user-generated content (such as photos) from social networking services to deliver visual advertisements or on our websites and in our apps.

Any legitimate interests pursued by us or by third parties who work for us are:

- Vital Tour Ltd. is a commercial company whose legitimate interest is directly related to the subject of activity and the performance of our contractual relations - the provision of basic and additional tourist services, real estate management and related legal relationships.

- The third parties that work for us are tour operators, travel agents, lawyers, security companies, carriers and others.

The following organisations/persons will receive your personal data:

- State authorities - NRA, Ministry of Interior, municipalities

The following organisations/persons may receive your personal data:

- Carriers (according to the social and living conditions accepted in the company)

- The law firm - (in the case of protecting our legitimate interest)

- Insurance company, in compliance with the Tourism Act

- Occupational Health Service (to ensure occupational health and safety)

Transfer of personal data to a non-EU country or international organisation

The Company does not provide personal data to third parties outside the EU or to an international organization, and does not intend to transfer your personal data to third parties without first obtaining your consent.

Data retention period

The Company stores your personal data for the following periods:

Concerning data the processing of which is necessary for us to comply with a legal obligation:

- Under the Accounting Act - 10 years, and/or until the completion of the audit and/or the counter-audit by the NRA (if the same has not been completed before the expiry of the 10 years).

- In case of employment and insurance relations - 50 (fifty) years.

- In court proceedings until 5 years after the case has been filed with the court (in order to recover costs) In cases of related cases (for example, where one case is preliminary to the other - the time limit expires for both cases on the expiry of the fifth year in respect of the latter in time).

Concerning data the processing of which is necessary for compliance with contractual obligations (unless the processing is on a lawful basis and the law obliges us to retain your data for a longer period):

- Until the expiration of the general five-year limitation period in contractual relations (under the Obligations and Contracts Act, with the possibility of extension beyond the expiration date of the aforementioned period by the period required to move the legal claim under the Civil Procedure Code)

      - Upon expiry of the period within which claims may be made under the contract

Regarding data for the processing of which it is necessary to provide your consent - as long as it is necessary for the purposes for which it was given or upon withdrawal of consent.

Your data will be stored on paper and electronic media, subject to the development of a policy and organisational security measures in accordance with the Regulation. We will retain your personal data for the period necessary to fulfil the purposes described in this Statement, unless a longer retention period is necessary or permitted by applicable law. We retain other personal information for shorter periods if possible and if permitted by law.

We will destroy your personal data as soon as possible and in such a way that it cannot be reproduced or retrieved. If it exists in printed form on paper, the personal data will be destroyed in a secure manner, for example by machine shredding or incineration of the paper documents or in any other such manner, and if it exists in electronic form, the personal data will be destroyed by technical means so that it cannot be reproduced or retrieved.

Consent:

By agreeing to accept this Privacy Policy (Privacy Notice), you give us permission to process your personal data only for the purposes we have specified.

Consent is necessary for us to process both types of personal data (ordinary and special), but it needs to be explicit.

Where we ask for consent for special (sensitive) personal data we will always justify why and how this information will be used.

You may withdraw your consent at any time by requesting withdrawal of consent via the specified email (letter) with free text.

Your rights as a data subject are as follows:

At any time while we are storing or processing your personal data, you have the following rights:

• You have the right to request a record/copy of your personal data from Vital Tour Ltd and the right to access your personal data at any time;
• you have the right to request from Vital Tour Ltd your personal data in a form convenient for transfer to another data controller, or to request that we do so without being prevented by us;
• you have the right to ask Vital Tour Ltd to correct inaccurate personal data as well as data that is no longer up to date;
• you have the right to request Vital Tour Ltd to delete your personal data on any of the following grounds:
• the personal data are no longer necessary for the purposes for which they were collected;
• when you have withdrawn your consent;
• where you have objected to the processing,
• where the processing is unlawful;
• where the personal data must be erased in order to comply with a legal obligation under EU or Member State law that applies to us as a data controller;
• where the personal data have been collected in connection with the provision of information society services.

We may refuse to delete your personal data for the following reasons:

• in the exercise of the right to freedom of expression and the right to information;
• for compliance with a legal obligation on our part
• for reasons of public interest;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in so far as erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing; or for the establishment, exercise or defence of legal claims.
• for the establishment, exercise or defence of legal claims 

• you have the right to ask Vital Tour Ltd. to restrict the processing of your personal data, in which case the data will only be stored but not processed. Our refusal to restrict will only be expressly in writing, and we are obliged to justify it with the lawful reason;
• you have the right to withdraw your consent to the processing of your personal data at any time by a separate request to the controller;
• you have the right to object to certain types of processing, such as direct marketing (unsolicited advertising messages);
• you have the right to object to automated processing
• you have the right not to be subject to a decision based solely on automated processing, including profiling;
• if we need to use your personal data for a new purpose not covered by this data protection statement, we will provide you with a new data protection notice and where and when necessary require your prior consent to the new processing.

All of the above requests will be forwarded if there is a third party (recipients, including non-EU and international organisations) processing your personal data.

The information and requests shall be processed free of charge, except in cases regulated by law, in which case the controller shall be entitled to charge a reasonable fee.

In order to gain access to your data that we process, you need to send a request for access to the contact details of Vital Tour Ltd or directly to the data protection officer. In order to verify your identity, it is necessary to provide data sufficient to make a correct check in our databases so that we can respond correctly and in a timely manner to your access request.

Address: gr. Velingrad, 1A Tsar Samuil Str.

For reservations: +359 887 336863 ; +359 888 510 806

Email : reservations@olymp-bg.com

Seminars and events: office@olymp-bg.com

Marketing: marketing@olymp-bg.com

Contact details of the data protection officer:

E-mail: gdpr@olymp-bg.com

Maria Dermendzhieva

You have the right to complain to the supervisory authority

You have the right to lodge a complaint directly with the supervisory authority, the competent authority being the Data Protection Commission.

In the event that you wish to lodge a complaint regarding the processing of your personal data through the Company, you may do so at the contact details of the Company set out above or directly to the Data Protection Officer at the contact details set out above.

Privacy Policy Changes

We reserve the right to change our privacy policy.

If you have any questions about the processing of your personal data, please contact us using the contact forms provided.