Hotel Caesar Palace Golden Sands Book
BOOK NOW
BOOK NOW
Hotel Caesar Palace Golden Sands Book

Privacy Policy

PRIVACY POLICY AND PERSONAL DATA PROTECTION at “VEST” Ltd.

We, “VEST” Ltd., recognize the importance of protecting the personal data of our clients and partners. We strive to maintain sound policies and practices that ensure the highest possible level of protection of your personal data, processed during and/or in connection with the provision of basic and/or additional tourism services related to accommodation and catering, as well as other services offered on-site at the hotels managed by us.

This Privacy Policy is based on the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regards to the processing of personal data and on the free movement of such data, and the repealing Directive 95/46/EC (“Regulation (EU) 2016/679”).

All changes and amendments to the Privacy Policy will be applied after the publication of its updated content, accessible through our website: caesarpalace.eu

The Privacy Policy applies to your personal data if you are an individual or a representative of a legal entity that uses or wishes to use the services provided in the hotel complexes managed by “VEST” Ltd., including those offered online through a specialized platform on our website, as well as through social networks.

1.КWho Processes and Is Responsible for Your Personal Data:

“VEST” Ltd. (“we”) is a commercial company registered in the Commercial Register at the Registry Agency with UIC 102835904, which collects, processes, and stores your personal data under the conditions of the Privacy and the applicable legislation of the European Union and the Republic of Bulgaria.

“VEST” Ltd. is a personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regards to the processing of personal data and on the free movement of such data, as well as the Personal Data Protection Act.

For any questions related to the processing of your personal data, you can contact us at our management address: Colosseum 1 or Hotel Caesar Palace at the following contact details: colosseo1@abv.bg

2. What Data We Process, for What Purposes, and on What Legal Basis::

2.1 Depending on the specific purposes and legal grounds, “VEST” Ltd. processes the following data independently or in combination:

A) Data Provided by You, Necessary for Identification and Fulfillment of Your Confirmed Reservations at Our Hotels, including:

  • Full name, phone number and/or email address for contacting you or a designated contact person, date and time of check-in and check-out, children and their ages.

  • Data collected when making a payment to us — credit or debit card number, bank account information and other details gathered and processed in relation to payment transactions via bank transfer, direct debit, or POS terminal of “VEST” Ltd.

  • Data from your profile used to access our online reservation platform — username, booking history, and payment records.

  • Information about the services you use and insights derived from them regarding your preferred destinations, hotels, and services offered by us.

  • Any other data you provide in connection with services you have already used or your preferences for our hotels.

B) Data Provided by You and Stored by “VEST” Ltd. during the Provision of On-Site Accommodation Services at Each Hotel:
These data are collected, processed and stored in compliance with the applicable regulatory requirements for maintaining a register of accommodated tourists by hotel operators, namely:

  • Full name of the person; Personal Identification Number (PIN) (for Bulgarian citizens) or Foreign National Identification Number (FNIN) (for foreign citizens with residency in Bulgaria), or date of birth (in all other cases).

  • Gender.

  • Nationality.

  • Identity card number / valid national identity document, issuing country.

C) Other Data:

  • Digital Data – Video Recordings:
    These are data collected through video surveillance systems used by “VEST” Ltd

  • in all publicly accessible areas within each of our hotels (lobby, reception, restaurant, lobby bar, fitness area, corridors, staircases, entrances) for security, monitoring, control, and public order protection.

  • IP Address when visiting our website or online reservation platform.

  • Data Related to Complaints About Tourism Services Provided by Us and Used by You:

  • Information about the type and content of your reservation, as well as any other related information, including email correspondence, letters, requests, petitions, complaints, feedback and other communication we receive from you.

2.2. Purposes and Legal Grounds for Processing Personal Data:

The primary basis for processing and storing personal data is the performance of a contract to which the data subject is a party or taking steps at the request of the data subject prior to entering into such a contract. At the same time, the processing of certain personal data is necessary for compliance with legal obligations of the company under the Tourism Act, Civil Registration Act, Accounting Act and other applicable legal acts, as well as for protecting the legitimate interests of the controller or a third party, such as:

A) We process and store personal data that is minimally necessary and legally required for the purposes of providing tourism services related to accommodation and catering, as well as for all other on-site services at our hotels, including:

  • Client identification when making, modifying, or canceling reservations, as well as when providing tourism services related to accommodation and catering and all other on-site services. Client identification is carried out through all commercial and communication channels — at the hotel reception by presenting an identity document, by phone, through our online platform via an electronic contact form, by email, and more.

  • Updating your personal data or information about services at our hotels at your request for correction/modification of data/services.

  • Handling and responding to customer complaints/inquiries/claims. Adjustments of amounts due for already completed reservations related to accommodation and catering when there is a valid reason for that.

B) In compliance with its legal obligations, “VEST” Ltd. processes your data for the following purposes:

  • Providing information to the Ministry of Interior, the competent municipality where the hotel is located, the Consumer Protection Commission and the Personal Data Protection Commission, in connection with our obligations as a hotel operator under the applicable regulations in this field.

  • Processing your data in invoices issued to your name for other purposes compatible with the original purpose of data collection.

  • Conducting tax and social security audits by the respective competent state authorities.

  • Providing information to the court and third parties within the framework of judicial proceedings, for the purpose of protecting our legitimate interests, including collecting receivables from clients through legal means.

C) “VEST” Ltd. processes your data also for the following legitimate interests:

  • Direct marketing purposes — sending you offers containing information about our current promotions, discounts for hotel accommodation, and/or changes to the terms of already used services.

  • Including your name, photographs, videos, and other data in promotional brochures, the website, and other publications of “VEST” Ltd

  • as a result of your participation in group activities and events organized at our hotels (dances, sports activities, and other entertainment).

Protecting, exercising, or preserving the legal rights, privacy, safety, or property of the controller, users of the controller’s services, and members of the community.

3. Categories of Third Parties Who Access and Process Your Personal Data: In connection with our business activities and the fulfillment of our contractual obligations with our clients, we provide your data to the following groups of recipients:

  • Data Subjects — whenever they exercise their right to access their data.

  • Users/Clients to whom the data pertains.

  • Business Partners — for the purpose of fulfilling your reservations, including:
    Travel agents and representatives in Bulgaria and abroad.
    Transportation companies and airlines.
    Providers of essential and additional tourism services and other subcontractors with whom we have signed contracts.

  • Payment Service Providers for online payments via credit cards.

  • Insurance Companies — when claiming an insurance event involving a tourist accommodated at our hotels.

  • IT Companies that maintain our information systems, corporate website, software, and reservation management platforms

  • Public Authorities (e.g., Ministry of Interior, municipality, National Revenue Agency (NRA), Consumer Protection Commission, Personal Data Protection Commission, judicial and other controlling bodies).

  • Other Data Controllers to whom “VEST” Ltd.

  • provides personal data on a legal basis and/or under a mutually signed contract.

It may be necessary — by law, in the case of a legal dispute and/or upon request from public and governmental authorities within or outside your country of residence, as well as for national security, law enforcement, or other matters of public significance — to disclose your personal data when such disclosure is necessary or appropriate.

We may also disclose information about you if we determine that such disclosure is reasonable and necessary to enforce our company policies and terms or to protect our operations, legitimate interests, and the rights and legal interests of other users.
Additionally, in the event of a reorganization, merger, or sale, it is possible to transfer any and all collected databases to the respective third party as a legal successor.

4. Retention Period of Your Personal Data. Security: :

The duration of personal data storage depends on the purposes for which the data was collected:

Personal data processed for the purpose of providing and executing tourist accommodation and catering services in our hotels are stored for up to 3 (three) years from the date of your departure from the hotel or until the final settlement of all financial obligations between the parties, respecting any statutory deadlines if applicable.

Personal data processed for the purpose of issuing accounting/financial documents to carry out tax and social security control (such as invoices, debit and credit notes) are stored for at least 3 (three) years, unless the applicable legislation requires a longer period.

Video recordings (CCTV) are stored for up to 30 days from the date of recording.

Longer retention periods may be applied to protect the legitimate interests of “VEST” Ltd., as well as to preserve data until the expiration of the relevant limitation period, in order to protect against potential claims by clients related to the execution or termination of the provided accommodation and catering services in our hotels. In the event of an ongoing legal dispute, documents are stored until the final resolution through a court or arbitration decision that has come into force.

As a Data Controller, “VEST” Ltd

takes all necessary care and implements the required administrative, technical, and physical measures, as well as personnel-related measures (such as training and awareness-raising), to protect the information we hold. This includes safeguarding clients’ personal data from loss, theft, unauthorized use, disclosure, modification, and any other unlawful forms of processing.

We have physical, electronic, and procedural safeguards that comply with our legal obligations regarding personal data protection and we maintain these measures in line with modern technological advancements.
We are responsible for the protection of clients’ personal data acquired in connection with our activities as a hotel operator and while providing the tourism services specified in the General Terms and Conditions and this Policy. However, we are not responsible in cases of force majeure, accidental events or malicious actions by third parties, as well as when the client themselves has made such information accessible to third parties.

5. Video Surveillance

The common areas of each of our hotels are subject to 24/7 video surveillance through stationary security cameras located at designated points.

Video surveillance is conducted to protect, exercise or preserve the legal rights, privacy, safety or property of the Administrator, its employees and/or contractors, and to ensure the safety, privacy and security of hotel guests and members of the public.

The video surveillance is organized and controlled by employees of the controller specially trained for data protection.

The recordings are stored on video servers for a period of 30 days, except in the case of a registered violation of the rights of the administrator, tourists or third parties, in which case the retention period may be extended according to specific needs.

You have the right to request a review of records if you allege a violation of rights that applies to you or a person you supervise, and your request will be considered within the time limits set forth in Section 6 of this policy.

The Company may refuse to consider requests that are unreasonably repetitive, require disproportionate technical effort, or threaten the privacy of other users.

6. What are your rights in relation to the processing of your personal data by WEST Ltd. and what actions should you take to exercise them:

  • the right of access to data relating to him or her – the customer has the right to request from us at any time confirmation of whether data relating to him or her is being processed, information about the purposes of that processing, the categories of data and the recipients or categories of recipients to whom the data is disclosed;

  • the right to rectify and update their personal data where it is inaccurate or incomplete for the purposes of processing;

  • the right to erasure (the right to be forgotten) where his or her data are being processed unlawfully or on a no longer valid basis (the original purpose for which they were collected and processed has been fulfilled, the retention period (including the limitation period) has expired, consent to processing has been withdrawn, you have objected to their processing, etc.), there is no other basis for processing them or national or European law requires it;

  • right to restriction of processing – in the event of a legal dispute between VEST Ltd.

  • and the natural person until its resolution and/or for the establishment, exercise or defence of legal claims; where the processing is unlawful but the data subject does not wish the personal data to be erased, but requests instead the restriction of their use; where you object to the processing of your personal data for the duration of the verification of its validity;

  • right to data portability – the data subject has the right to request us to transfer his or her personal data in machine-readable format to another controller explicitly designated by him or her without hindrance;

  • obligation to notify when correcting or deleting personal data or restricting processing – the customer has the right to require us to notify the third parties to whom their personal data has been disclosed of any deletion, correction or blocking of such data, except where this is impossible or involves excessive effort for VEST Ltd.

  • the right to notification of a personal data breach – where the data breach is likely to pose a high risk to the rights and freedoms of natural persons. We are not obliged to notify you if: we have taken appropriate technical and organisational measures to protect the data affected by the data breach, and we have subsequently taken measures to ensure that the breach will not result in a high risk to your rights and if notification would require a disproportionate effort.

  • the right to object to the processing of your personal data at any time and on grounds relating to the particular situation of the data subject, provided that there are no compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or legal process.

Where personal data are processed for direct marketing purposes, the User shall have the right at any time to object to processing of personal data concerning him/her for this type of marketing, which includes profiling, insofar as it is related to direct marketing. At the latest at the time of the first contact with the user, the user shall be expressly informed of the existence of the right to object described above, which shall be provided to the user by means of a notification in a clear manner and separately from any other information.

  • the right to judicial and administrative redress – the right to lodge a complaint with a supervisory authority, the right to an effective judicial remedy against a supervisory authority, the right to an effective judicial remedy against a controller or processor; the right to compensation for damage suffered.

Procedure for exercising rights: You can exercise all your rights regarding the protection of your personal data through the forms attached to this Policy. Of course, these forms are optional and you can make your requests in any form that contains a statement to that effect and identifies you as the data holder.

“VEST” Ltd. shall consider and decide on the User’s request in accordance with the requirements of the applicable legislation as soon as possible and in any case within 1 /one/ month of receipt of the application. If necessary, this period may be extended by a further 2 /two/ months, taking into account the complexity and number of applications. “MPM HOTELS Ltd. shall inform the user of any such extension within one month of receipt of the application, indicating the reasons for the delay.

Details of supervisor:

DATA PROTECTION COMMISSION /DPC/,

Sofia 1592, 2 Tsvetan Lazarov Blvd,

Tel: 02/91-53-518, fax: 02/91-53-525,

e-mail: kzld@cpdp.bg

www.cpdp.bg

7. Can you refuse the provision of personal data to VEST Ltd?

and what are the consequences?

In order to fulfill your reservation and to provide you with the accommodation services you have requested in our hotels, we need certain data, which are legally defined by the legislation in force in the Republic of Bulgaria.

Failure to provide the personal data mentioned in point 2.1. prevents VEST Ltd. from accepting your reservation and, accordingly, from providing you with the services requested on site at our hotels.

8. Our Cookie Policy

“VEST Ltd uses cookies on its website www.caesarpalace.eu, which are important for its correct operation. By visiting our website, you accept the use of cookies.

Types of cookies we use:

  • Mandatory cookies – these cookies are necessary for the website to work properly. For example, we use these cookies to show you information on our site, photos, videos, etc., and to help the search engine function properly so you don’t have to enter the same information on different pages. These cookies are temporary and are deleted when you close your browser.

  • Analytical cookies – thanks to these cookies we monitor the traffic on our website and can analyse how easy it is for our users to use it (Google Analytics cookies). These cookies do not give us any information about your personal data. They show us which pages of our site are viewed, whether our site is visited via a mobile or desktop device and other anonymous data.

You can set the cookies you receive from our site in the browser you use. Please note that if you restrict certain types of cookies, our site may not work properly and you may not be able to use its full functionality.

9. PRIVACY POLICY CHANGES

“VEST Ltd shall have the right, where circumstances so require, to unilaterally update, amend and supplement the Privacy Policy at any time in the future. Any additions or changes to this Policy will be published on the Company’s website caesarpalace.eu and/or made available upon request.

This policy was last updated on 21.05.2018.